Infrastructure And System Security

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

What is the primary purpose of a TPM chip in a laptop?

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

When designing a secure API, which protocol is recommended for authorization?

What is the primary security goal of an 'Air-Gapped' network segment?

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?

Which security measure is most effective at preventing unauthorized access to a physical data center?

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Which THREE of the following are valid security controls for a database?

Which of the following is the most effective way to secure a remote access connection for employees?

Which THREE of the following are common network security architecture tools?

You need to protect a legacy web application that cannot be patched. What is the best strategy?

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Which TWO of the following are best practices for securing API endpoints?

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Which TWO of the following are essential for protecting against SQL Injection?

Which THREE of the following are critical for a secure identity architecture?

Which TWO of the following are common methods to protect data during transit?

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Which TWO of the following are fundamental pillars of information security (CIA triad)?

Which THREE of the following are best practices for securing a remote worker's endpoint?

Which THREE of the following are indicators of a potential system compromise?

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

In a VMware NSX-T environment, you need to implement a 'Distributed Firewall' (DFW) policy that separates traffic based on the application tier regardless of which ESXi host the VM is running on. What is the primary object used to achieve this logical grouping?

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?