Infrastructure And System Security

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

What is the primary purpose of a TPM chip in a laptop?

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

When designing a secure API, which protocol is recommended for authorization?

What is the primary security goal of an 'Air-Gapped' network segment?

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?

Which security measure is most effective at preventing unauthorized access to a physical data center?

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Which THREE of the following are valid security controls for a database?

Which of the following is the most effective way to secure a remote access connection for employees?

Which THREE of the following are common network security architecture tools?

You need to protect a legacy web application that cannot be patched. What is the best strategy?

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Which TWO of the following are best practices for securing API endpoints?

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Which THREE of the following are risks associated with using shared cloud storage buckets?

Which TWO of the following are essential for protecting against SQL Injection?

Which THREE of the following are critical for a secure identity architecture?

Which TWO of the following are common methods to protect data during transit?

Which THREE of the following are components of a defense-in-depth strategy?

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Which TWO of the following are fundamental pillars of information security (CIA triad)?

Which THREE of the following are best practices for securing a remote worker's endpoint?

Which THREE of the following are indicators of a potential system compromise?

You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?

A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?

In a VMware NSX-T environment, you need to implement a 'Distributed Firewall' (DFW) policy that separates traffic based on the application tier regardless of which ESXi host the VM is running on. What is the primary object used to achieve this logical grouping?

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Which THREE of the following items should be addressed when designing a secure remote access architecture for a hybrid cloud environment using a VPN gateway?