NVIDIA Certified Professional: AI Networking Practice Questions: InfiniBand Security Domain

Correct Answer: D

Explanation: InfiniBand partitioning is a critical security measure that allows for logical segmentation of the network into isolated groups, called partitions. Each partition can enforce access controls and ensure that only authorized devices can communicate with each other, thus preventing unauthorized access and ensuring data integrity during transmission. VLAN tagging and IPsec are not directly applicable to InfiniBand, and QoS policies are more related to traffic management than security.

Correct Answer: C

Explanation: InfiniBand partitioning with P_Key enforcement is specifically designed for InfiniBand fabrics to create isolated network partitions, ensuring that only authorized devices communicate within a partition. VLAN tagging and IPsec are more applicable to Ethernet networks, and physical isolation is not practical in dynamic enterprise environments.

Correct Answer: C

Explanation: Implementing role-based access control (RBAC) is a best practice for securing management access to an InfiniBand fabric, as it restricts access based on user roles. Telnet and SNMPv1 are insecure protocols, and disabling logging features would hinder auditing and troubleshooting.

Correct Answer: A

Explanation: Subnet Manager (SM) Authentication is a security feature in InfiniBand networks that ensures only authorized subnet managers can control the network, preventing unauthorized access to network resources. VLAN tagging is related to Ethernet networks, QoS policies manage traffic prioritization, and LACP is used for link aggregation in Ethernet networks.

Correct Answer: C

Explanation: A Trusted Platform Module (TPM) is used to store and manage cryptographic keys securely in hardware, providing a secure environment for key management. This is crucial in maintaining the integrity and security of an InfiniBand network. While TPM can assist in encryption, its primary role is not to manage partition keys or monitor network traffic.

Correct Answer: B

Explanation: The Management Key (M_Key) in InfiniBand networks is specifically designed to prevent unauthorized nodes from joining the network. It is used to authenticate and authorize management operations, ensuring that only trusted devices can participate in the network. Options A, C, and D do not directly address the prevention of unauthorized node access.

Correct Answer: B

Explanation: Implementing end-to-end encryption is a critical security measure that ensures data confidentiality during transmission across the InfiniBand network. This prevents unauthorized interception and access to sensitive data. A dedicated management network and VLANs are more about network segmentation and isolation, while Adaptive Routing is a performance feature that optimizes path selection but does not inherently provide data security.

Correct Answer: B

Explanation: The Subnet Manager is responsible for managing the InfiniBand fabric, including security policies and configurations. It handles tasks such as assigning LIDs, configuring P_Keys, and managing partitions. While HCAs and switches are part of the fabric, they do not manage security policies. The Fabric Manager may assist in broader management but is not specifically focused on security configurations.

Correct Answer: D

Explanation: The primary function of the InfiniBand Subnet Manager regarding security is to configure and enforce partition keys (D), which are used to control access and communication between nodes. Encrypting data packets (A) is not handled by the Subnet Manager. Managing routing tables (B) is a general network management task. Authenticating devices (C) is not the primary role of the Subnet Manager.

Correct Answer: B

Explanation: Using InfiniBand Partitions (B) is the correct strategy for isolating different groups of compute nodes in an InfiniBand network, as it allows for logical segmentation and access control. IP Filtering (A) and VLAN Segmentation (C) are not applicable to InfiniBand. NAT (D) is used for IP address translation, not for isolation in InfiniBand networks.