A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?
A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?
An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?
A security analyst is investigating a web application vulnerability and identifies that user input is reflected directly inside a JavaScript block without adequate sanitization, leading to execution in the victim's browser. What specific type of vulnerability is present?
A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?
A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?
A web application development team is reviewing the OWASP Top 10 web application security risks. Which TWO vulnerabilities directly involve improper handling of user-supplied data that is subsequently executed or interpreted by backend interpreters?
A software developer is writing a secure web application and needs to protect sensitive user session cookies against theft and cross-site scripting (XSS) attacks. Which TWO cookie attributes must be set when creating session cookies?
A security analyst is examining a Windows Server 2022 file server that stores payroll records. The analyst discovers that the payroll folder inherits permissions from the parent volume, and members of the Domain Users group have Read access to every payroll file. The company policy requires that only the Payroll department and the CFO may read these files, and that access must be auditable. After removing the inherited permissions and granting NTFS Read to the Payroll group and CFO account, what should the analyst do to ensure the restriction is enforced when users access the share over the network?
A security engineer is hardening a Linux web server that hosts a PHP application. The engineer needs to configure the PHP runtime so that user-supplied input cannot be executed as PHP code, even if an attacker manages to upload a file with a .php extension into an upload directory. Which PHP directive should be set to disable the execution of PHP code in files that are not explicitly intended to be scripts?
An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?
An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?
A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?
A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?
An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?
An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?
A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?
A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?
An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?
A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?
An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?
A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?
An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?
A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?
A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?
An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?
An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?
A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?
An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?
A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?
An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?
An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?
A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?
An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?
An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?
A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?
An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?
A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?
An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?
A financial services company stores customer records in a Microsoft SQL Server 2019 database. A security administrator must ensure that sensitive columns such as credit card numbers are encrypted at rest and that even a database administrator with full server access cannot read the plaintext values without an additional secret. Which SQL Server feature should be implemented to meet this requirement?
A healthcare organization is implementing a data loss prevention (DLP) program for endpoints running Windows 10. The security team wants to prevent protected health information (PHI) from leaving the organization through email and removable media. Which TWO controls should be enabled in a Microsoft Defender for Endpoint DLP policy to directly block these exfiltration channels? (Choose two.)
A small business wants to secure its web application against SQL injection without modifying application code. The application uses a MySQL database and receives user input through web forms. Which defensive measure should be implemented at the database layer to reduce the impact of SQL injection attacks?
A security analyst is reviewing an application that stores user passwords in a database. The analyst finds that passwords are hashed with SHA-256 and a unique salt per user. The organization wants to increase resistance to offline brute-force attacks using GPUs. Which change should the analyst recommend?