CCNA Security Architecture Questions

AES-SIV is a misuse-resistant AEAD mode that produces a deterministic ciphertext for a given plaintext and associated data, so identical account numbers map to identical ciphertext. This preserves equality searches, joins, and unique indexes while keeping values unreadable to DBAs who lack the key, satisfying the stated business requirement.

SASE couples identity-based, zero trust access with cloud-delivered security inspection, evaluating each session against user identity and device posture rather than granting broad network reach. Traditional VPNs authenticate once and then place the user on the network, which is the gap the stem highlights.

Host-based firewall agents enforce policy at the workload level and can use identity tags rather than IP addresses, so rules remain valid when the workload moves between hosts. This satisfies both explicit peer authorization and policy portability, making it a core microsegmentation control.

A SOC 2 Type II report provides an independent auditor's opinion on the design and operating effectiveness of controls over a period of time, covering security, availability, and confidentiality. It gives assurance without an on-site audit and is specifically designed for service providers handling sensitive data.

This design places the jump host in a screened subnet so it is reachable from the internet, but the EHR servers remain on an isolated internal segment. Requiring VPN with MFA authenticates the unmanaged vendor laptops, and RDP from the jump host provides a controlled, recorded session. Session recording gives the hospital an audit trail of every vendor action, which is essential for compliance and incident response.

AWS Direct Connect provisions a dedicated 1 Gbps or 10 Gbps fibre cross-connect from your on-premises data centre to an AWS Direct Connect location, carrying traffic over private circuits rather than the public internet. This satisfies the stem's requirement for a private connection that bypasses internet routing entirely, unlike site-to-site VPN, which still traverses the public internet.

A hash chain makes any alteration detectable because it breaks subsequent links, while offline hardware security module signing prevents an attacker with storage access from forging new checkpoints. Encrypting with keys unavailable to the provider keeps contents confidential, satisfying all stated requirements simultaneously.

CRYSTALS-Kyber is a lattice-based key encapsulation mechanism selected by NIST for post-quantum standardisation, resisting attacks from both classical and quantum computers. Its Module-LWE hardness underpins the 30-year confidentiality requirement, unlike RSA or ECC, which Shor's algorithm breaks.

AWS KMS customer managed keys allow the company to create and manage unique keys per tenant, and encryption context can enforce tenant-specific authorization. This provides centralized key management with per-tenant cryptographic isolation, meeting the requirement for unique encryption keys and central control.

The Certificate Authority is the trusted entity that signs, issues and publishes revocation status for certificates within the PKI hierarchy. It satisfies the stem's requirement by performing both lifecycle functions, using CRLs or OCSP to distribute revocation data to relying parties.

Rate limiting caps the number of requests a client may make within a defined window, throttling or blocking once the threshold is exceeded. This directly prevents abuse from excessive API calls, the specific threat named in the stem, while preserving availability for legitimate consumers.

The zero trust model enforces authentication and authorisation at every access request, regardless of network location, by requiring continuous verification of identity, device health, and session context before granting resource access. This satisfies the stem’s requirement for a foundational principle, as it directly opposes the traditional perimeter-based trust model. In Microsoft Entra ID, conditional access policies implement this by evaluating real-time signals for each request.

DSPM discovers and classifies sensitive data across on-premises and multi-cloud environments, then applies consistent protection policies. With centralized key management, it can enforce encryption and access controls regardless of where the data resides, meeting the cross-provider, data-centric requirement without vendor lock-in.

Host-based enforcement keyed to workload labels decouples policy from IP addresses and network topology. Because the agent travels with the workload, rules continue to apply correctly after automated redeployments change IP addresses, and policy can be expressed in terms of workload identity such as application tier or environment, satisfying both stated requirements.

Validating partner-issued JWTs against their published JSON Web Key Sets lets the gateway verify authenticity using public keys, so no shared secret is exchanged. Claims such as issuer, audience, scope, and subject can then drive authorization decisions and per-partner throttling policies at the gateway.

MAM applies policy to specific apps rather than the whole device, allowing personal use while preventing data leakage. App-level encryption and containerization keep patient data within the managed app and block copy/paste or local storage to unauthorized apps. This matches the requirement to avoid full device management.

An HSM is tamper-resistant hardware that generates, stores and uses cryptographic keys internally, so keys never exist in plaintext outside the module. This directly addresses secure key storage and cryptographic operations, unlike software keystores where keys reside in memory or on disk.

Host-based firewalls with identity labels enforce policy at the workload level regardless of host or IP changes, and a central controller distributes consistent rules. This allows only required east-west flows and follows workloads across migrations, directly satisfying the microsegmentation requirement in a dynamic data center.

CRYSTALS-Dilithium is a lattice-based digital signature scheme selected by NIST for post-quantum cryptography standardisation, providing quantum-resistant authentication. It satisfies the stem's requirement for cryptographic agility against quantum attacks, unlike RSA or ECDSA, whose security collapses under Shor's algorithm. Its selection as a NIST PQC standard confirms its suitability.

NetworkPolicy is the native Kubernetes mechanism to enforce pod-level segmentation. A default-deny ingress policy blocks all traffic not explicitly allowed, satisfying least privilege and stopping lateral movement. Explicit allow rules then permit only the required database access from the front end. This directly addresses the scenario's requirement to block unauthorized east-west traffic without adding external components.

A cloud identity provider with conditional access evaluates real-time signals such as device compliance and on-premises risk before issuing short-lived tokens. Because token issuance happens in the cloud and does not trust on-premises domain controllers to sign tokens, a compromised domain controller cannot forge cloud access, satisfying both requirements.

SDP uses a deny-by-default model with single-packet authorisation, keeping resources invisible to unauthenticated users. Attackers cannot scan or target what they cannot see, so the exploitable attack surface shrinks — the specific benefit the zero trust scenario requires.

Mutual TLS in a service mesh authenticates and encrypts every service-to-service call, giving cryptographic workload identity rather than relying on network location. This directly protects east-west traffic inside the cluster, where perimeter controls cannot inspect lateral microservice communication.

An SBOM must enumerate every open-source library and its exact version, because version data is what lets you map components to advisories and licences. Without this inventory, the supply chain constraint of knowing what ships inside your software cannot be met.

Data residency requires that stored data physically remains within a permitted jurisdiction. Choosing the correct AWS region determines the physical location of the data at rest, directly satisfying the legal constraint that data must not leave the approved territory.

IaaS leaves the customer responsible for the guest OS, runtime, middleware, applications and data, whereas PaaS and SaaS shift those layers to the provider. This maximal customer ownership of the stack is precisely what satisfies the stem's requirement for the model placing the most security responsibility on the customer.

Signed commits prove the author's identity and, combined with mandatory peer review and branch protection, ensure only reviewed code reaches the build. Verifying dependency signatures against a trusted allowlist detects tampered or substituted packages before they enter the artifact. Together these controls directly address both code provenance and dependency integrity in the pipeline.

A software-defined perimeter authenticates and authorizes endpoints before any network access is granted, creating identity-based, need-to-know connectivity between workloads. This directly limits lateral movement because unauthenticated workloads cannot reach protected segments, and it supports policy based on workload identity rather than static IP addresses.

This approach uses a customer-managed VPN gateway and HSMs to store keys, ensuring that the cloud provider does not have access to the encryption keys. IPsec with customer-managed certificates provides strong encryption and authentication. This meets the requirements for data confidentiality against the provider and compliance with strict key management controls.

Scanning detects vulnerabilities and embedded secrets, while signing produces a cryptographic attestation of image provenance. Enforcing signature verification at deploy time ensures only unaltered, approved images run, directly preserving the integrity guarantee that immutable infrastructure depends on.

An HSM performs cryptographic operations internally, so the private key never leaves the tamper-resistant hardware. Compromising the host server yields no usable key material, satisfying the requirement that the key stay protected despite server compromise.

AWS Config continuously records resource configurations and evaluates them against rules, flagging non-compliant changes across the account. This satisfies the SOC 2 monitoring and enforcement constraint by providing auditable configuration history and automated remediation triggers.

Micro-segmentation applies granular, workload-level security controls and policies between individual segments, so a compromised host cannot reach neighbouring workloads. This directly satisfies the zero trust requirement that no implicit trust exists between network segments, blocking lateral movement even after one segment falls.

Micro-segmentation creates granular, workload-level security policies enforced at each virtual network interface, so lateral movement between workloads is blocked regardless of subnet boundaries. This satisfies zero trust's requirement to isolate individual workloads rather than trusting the network perimeter.

A hierarchical key management system uses unique data encryption keys (DEKs) for each data object or session, and wraps them with key encryption keys (KEKs). Compromise of one DEK exposes only the data it protects, not the entire dataset. This minimizes risk and meets the requirement that a single compromised key does not expose all data.

NetworkPolicy objects select pods via label selectors and enforce ingress and egress rules at layer 3/4, restricting traffic to explicitly permitted pod, namespace, or CIDR combinations. This satisfies the stem's requirement for fine-grained pod-to-pod communication control, which Kubernetes denies by default until a policy selects the pod.

Runtime protection continuously monitors executing workloads for malicious behaviour such as process injection or fileless attacks, then blocks or alerts in real time. This satisfies the hybrid cloud constraint because on-premises and cloud workloads share the same runtime threat surface, which static scanning alone cannot address.

IPsec operates at the network layer and can be implemented in hardware for high throughput. IKEv2 supports perfect forward secrecy through Diffie-Hellman key exchange, ensuring that compromise of long-term keys does not compromise past session keys. This combination provides confidentiality and high availability for data in transit between data centers.

Dependency and flow mapping establishes which systems genuinely need to communicate, which is the prerequisite for writing allow-list policy that does not break production. Without this baseline, microsegmentation rules either block required traffic or remain so permissive that lateral movement is still possible.

A service mesh with mutual TLS authenticates both ends of every service connection using cryptographic identities and enforces authorization policies for which services may call which endpoints. This directly limits east-west movement between containerized tiers and provides visibility into service dependencies, complementing host-based controls for workloads that sit outside the mesh.

ZTNA typically uses outbound-only connections from the application to the trust broker, which hides the application from the internet and prevents inbound exposure. This design ensures that users connect through the broker and that the application remains protected behind the broker's policy enforcement.

A CASB sits between users and multiple cloud providers, delivering the required visibility into sanctioned and unsanctioned application usage, policy enforcement, and data protection such as DLP and encryption. This directly satisfies the multi-cloud visibility and policy constraint in the stem.

Sensitivity labels persist with the data and provide consistent classification across Microsoft 365, endpoints, and integrated applications. Unified DLP policies using exact data match and trainable classifiers reduce false positives by matching actual regulated records and learning business context, and they enforce policy at egress points across all three channels.

A unidirectional gateway physically or logically enforces one-way traffic, so controllers can emit telemetry toward the historian while no path exists for inbound connections from the business network. This directly satisfies the requirement to block workstation-initiated access to unpatched controllers. It is purpose-built for this exact industrial constraint, where endpoints cannot defend themselves.

Threat modelling produces structured diagrams of systems, data flows and trust boundaries, then enumerates potential attack vectors against them. Conducted during design, it shifts security left, satisfying the DevSecOps goal of integrating security early in the development lifecycle.

SBOM generation plus dependency analysis inventories every open-source component and its transitive dependencies, then cross-references them against vulnerability databases to flag known CVEs. This directly satisfies the stem's constraint: identifying vulnerabilities in open-source libraries, which static code scanning or container hardening would not target at the dependency layer.

CloudHSM provides dedicated, single-tenant hardware security modules where the organisation retains sole control of key material; AWS cannot access the keys. This satisfies the stem's requirement to maintain control over encryption keys for data at rest, unlike KMS, where AWS manages the underlying key infrastructure.

Immutable infrastructure replaces servers rather than modifying them in place, so every deployment starts from an identical known image. Because running instances are never patched or hand-edited, configuration drift between environments is eliminated, which is the stated benefit.

Network segmentation restricts lateral movement by dividing the network into isolated zones with enforced access rules, blocking traffic before it reaches targets. This preventive, network-layer control satisfies the defense-in-depth requirement by stopping intrusion attempts rather than merely detecting them.

Rate limiting policies at the API gateway cap the number of requests a client may make within a defined window, throttling or blocking excessive calls. This directly mitigates the identified API abuse risk arising from absent rate limiting.

Micro-segmentation enforces granular, workload-level policies on east-west traffic, isolating application tiers across subnets within a virtual network. Unlike perimeter controls, it inspects inter-VM flows directly, satisfying the requirement to limit lateral movement between tiers at the virtual network level.

Identity-based access policies evaluate each request against user identity and context rather than network location, which is what enables micro-segmentation to be enforced per identity across multiple clouds. Network-centric controls alone cannot deliver identity-centric segmentation in a multi-cloud estate.

CSPM continuously monitors multi-cloud infrastructure for misconfigurations and automatically remediates drift, satisfying the requirement to enforce consistent policy across AWS, Azure and GCP. Unlike native tools that operate within a single provider, CSPM normalises posture assessment across heterogeneous environments, directly addressing the cross-provider constraint in the stem.

Under the shared responsibility model, the provider secures the cloud infrastructure, but customers configure their own network access controls, security groups and firewall rules. This makes network access control configuration a customer responsibility, matching the stem's question.

ZTNA brokers access per application based on continuous evaluation of user identity and device posture, and it issues context-bound tokens that are validated for each session. This prevents session hijacking because tokens are tied to the session context and cannot be replayed from a different device or location, meeting both requirements.

CSPM continuously assesses configurations against benchmarks and compliance frameworks across AWS, Azure and GCP through native APIs, satisfying the single-tool, multi-cloud monitoring and enforcement constraint. It detects misconfigurations such as public storage buckets and overly permissive IAM policies, unlike single-cloud native tooling.

A CASB enforces data-security policy between users and cloud services, delivering the threat protection, data-loss prevention and visibility SASE requires for cloud-bound traffic. It satisfies the stem's SASE component requirement because SASE converges networking with exactly these cloud-security functions, alongside SWG, ZTNA and FWaaS, rather than relying on on-premises appliances.

A shared symmetric key means any compromised service can forge valid tokens for every other service, breaking per-service authentication boundaries. Asymmetric signing with per-service keys, or centralised issuance, would contain the blast radius of a single compromised credential.

Federating AD DS with SAML 2.0 allows the on-premises domain to act as the identity provider, so employees use their existing AD credentials and the SaaS application receives assertions about group membership and account status. This avoids separate passwords and enforces on-premises account state in real time because the identity provider evaluates the account at each authentication. It is the standard approach for hybrid identity with SaaS.

A CASB sits inline or via APIs between users and cloud services, enforcing policy at that boundary. This directly satisfies the stem's requirement for a primary function: it governs access and data flows to sanctioned and unsanctioned cloud applications, providing visibility and control.

TLS 1.3 cuts the handshake to a single round trip by combining key exchange and authentication, and supports zero round-trip resumption for repeat connections. This directly satisfies the question's comparison against earlier versions, which required two round trips, thereby reducing latency.

Mandatory access control enforces access decisions by comparing the subject's clearance level with the object's classification label, and the labels are managed by the system rather than by users. This directly satisfies the requirement to consider clearance and classification together and prevents users from changing their own labels. It is the standard model for need-to-know enforcement in government and defense environments handling sensitive data.

FedRAMP requires an independent assessment by a Third-Party Assessment Organization accredited under the programme, which validates the cloud service's security controls against NIST baselines before an agency can grant authorisation. This external evaluation is the key requirement the stem asks for.

Mutual TLS with certificates bound to a Kubernetes service account gives each service a cryptographic identity that cannot be transferred to another service without its private key. A service mesh certificate authority can issue short-lived certificates and rotate them automatically, and the service account binding ensures a compromised pod cannot claim a different service identity. This satisfies authentication, non-impersonation, and automated rotation in one design.

SAST analyses source code without executing it, detecting vulnerabilities during development and satisfying shift-left by finding flaws before deployment. It integrates into CI pipelines and IDEs, unlike DAST, which requires a running application and therefore tests later in the lifecycle.

The shared responsibility model defines the security boundary between provider and customer, satisfying the cloud-first scenario's need to clarify who secures what. The provider secures the cloud infrastructure, while the customer secures data, identities, and access in the cloud. This division varies by service model (IaaS, PaaS, SaaS), directly answering the stem's requirement.

Distributed firewalls in an SDN fabric enforce policy at the hypervisor level using workload identity tags rather than IP addresses. This allows rules to follow the workload as it migrates between hosts, maintaining least-privilege east-west controls. It directly satisfies the requirements of identity-based enforcement and mobility without rule changes, making it the correct architectural choice.

An external key store lets the cloud KMS delegate cryptographic operations to key material held in the organization's own HSM, so plaintext keys never enter the provider's infrastructure. The provider still performs server-side encryption using the externally held key, satisfying both the residency mandate and the server-side encryption requirement. This is the designed pattern for exactly this regulatory scenario.

Federation through SAML or OIDC centralizes authentication with the identity provider, while conditional access policies evaluate device posture and other signals. Just-in-time elevation issues short-lived credentials, eliminating long-lived secrets in the cloud. Together, these satisfy all three architectural requirements.

Microsegmentation with identity-based policies enforces least-privilege access between workloads and applications by using identity and context rather than IP addresses. It supports continuous verification and limits lateral movement, aligning with Zero Trust. This mechanism is essential for dynamically controlling access based on device health and user identity.

Admission controllers intercept API requests before pods are created, rejecting unsigned or unapproved images, while PodSecurityPolicy restricts privileged escalation and capability use. Together they enforce image provenance and prevent privilege escalation, matching both stem constraints.

An SBOM enumerates every component and version in the product, giving the inventory needed to trace third-party dependencies. Combined with provenance attestation, it lets the architect verify what was supplied and detect tampering or unexpected inclusions, satisfying the integrity and provenance requirement.

SDP employs a deny-by-default model where the controller authenticates and authorises both endpoints before any connection is brokered, so applications never respond to unauthenticated probes. This satisfies the zero trust requirement that resources remain hidden from unauthorised users, mitigating scanning and reconnaissance.

Never trust, always verify requires every access request to be authenticated and authorised explicitly, regardless of network location, replacing implicit trust with continuous verification. This is the foundational tenet from which all other zero trust controls derive.

Entra ID Conditional Access can require that a device be marked compliant by Intune before granting access to Microsoft 365. Intune enforces device configuration and compliance on Android and iOS without requiring on-premises infrastructure or VPN, directly meeting the requirement to restrict access to compliant devices.