To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?
You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?
A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?
A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?
An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?
You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?
You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?
A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?
Which THREE of the following items should be addressed when designing a secure remote access architecture for a hybrid cloud environment using a VPN gateway?
A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?
A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?
A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?
You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?
You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?
A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?
When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?
You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?
An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?
You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?
An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?
An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?
A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?
A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?
A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?
An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?
You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?
You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?
In a VMware NSX-T environment, you need to implement a 'Distributed Firewall' (DFW) policy that separates traffic based on the application tier regardless of which ESXi host the VM is running on. What is the primary object used to achieve this logical grouping?
A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?
You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?
Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?
You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?