CCNA Casp Security Architecture Questions

Content inspection with pattern matching and classifiers is the foundation of any DLP program because it identifies regulated data such as card numbers and PII within files, messages, and uploads. Without accurate classification, neither discovery at rest nor prevention in motion can distinguish sensitive content from ordinary business data, so this capability is essential to meet both stated requirements.

An HSM is tamper-resistant hardware that generates and stores the root CA private key internally, performing signing operations without exposing the key to software or memory. This provides the physical protection and non-exportability that high-assurance root key custody demands.

Immutable infrastructure replaces rather than patches instances, so every deployment derives from one hardened image. Drift and configuration creep disappear, and no lingering services or stale packages accumulate, which is precisely the consistent-configuration reduction of attack surface the stem asks for.

Host-based firewalls with tag-based rules enforce policy at the workload level, so protections move with the VM even if it is migrated. This restricts lateral movement because only explicitly allowed traffic can reach the workload, regardless of network topology or host compromise.

Direct Connect provisions a dedicated private circuit between the on-premises data centre and the cloud provider, bypassing the public internet entirely. This satisfies all three stated constraints simultaneously: low latency, high bandwidth, and no internet traversal, which VPN or internet-based alternatives cannot guarantee.

FedRAMP authorisation directly evaluates the cloud service provider's implementation of NIST SP 800-53 security controls, satisfying the stem's compliance constraint. Assessment covers the provider's control environment, not customer-side configurations or data classification. This makes the CSP's security controls the object of FedRAMP review under Microsoft Entra ID-governed environments.

A software-defined perimeter creates identity-based, need-to-know network segments, so access to resources is granted per user and device rather than by network location. This enforces identity-centric control, satisfying zero trust's requirement that trust be continuously verified before any connection is established.

Software-defined networking policies centralise control and enforce per-workload rules through a programmable controller, segmenting traffic independently of physical topology. This satisfies micro-segmentation's requirement for granular, identity- and workload-based east-west controls, unlike VLANs or subnet ACLs, which segment only at coarser network boundaries and cannot isolate individual workloads dynamically.

The secure web gateway is the SASE component that inspects and filters web traffic, enforcing acceptable-use and malware policies. Converging it into SASE delivers SWG filtering from the cloud edge, satisfying the requirement to combine network and security functions in one architecture.

Standing admin rights violate zero trust's assume-breach stance. Just-in-time privilege elevation grants access only when needed, then revokes it, shrinking the blast radius of compromised accounts. This directly satisfies the identity-centric requirement that entitlements are scoped and time-bound rather than permanent.

Keeping raw payment records local satisfies data residency, while forwarding normalized telemetry such as authentication events, network flows, and alerts gives the central SIEM the visibility needed for global threat detection. The telemetry is stripped of payment data, so no regulated records cross borders, and correlation across regions remains possible for detecting coordinated attacks.

Direct Connect and ExpressRoute provide dedicated private circuits from on-premises into the cloud provider's network, so traffic never traverses the public internet. This satisfies the low-latency, private connectivity constraint, unlike site-to-site VPNs, which still ride the internet.

Health-checked global server load balancing continuously probes each regional API endpoint and withdraws a failed region from DNS answers, so existing clients resolve to a healthy region on their next lookup without any client-side change. This directly addresses regional failover for API consumers while preserving a single stable hostname.

A NAT gateway in a public subnet allows instances in a private subnet to initiate outbound connections to the internet while preventing unsolicited inbound connections. This is exactly the pattern needed for software updates. The application servers remain unreachable from the internet, and the NAT gateway handles address translation and return traffic, preserving the private subnet's isolation while still permitting necessary outbound access.

Under IaaS, the customer controls everything above the hypervisor, including guest operating systems, applications and data. Encrypting data at rest within that environment therefore falls to the customer, whereas the provider secures the physical hosts, network fabric and underlying storage infrastructure.

The exp claim is a registered JWT payload field holding the expiration time as a NumericDate, after which the token must be rejected. Validating exp lets the analyst determine whether the token has lapsed, directly answering which field carries the expiration time.

Threat modelling examines data flows, trust boundaries and architecture during design, exposing flaws before code exists, when remediation is cheapest. It directly satisfies the requirement to identify design flaws early, unlike code scanning or penetration testing, which occur later.

seccomp operates as a syscall filter, restricting which system calls a process may invoke. Applied to containers, it blocks dangerous calls such as those used in privilege-escalation exploits, directly satisfying the requirement to limit the system calls a container can make.

Endpoint DLP agents monitor and block sensitive data at the source, such as copying files to removable media or pasting into web forms. In a hybrid environment, this complements inline cloud inspection by covering local egress paths that network-based controls cannot see, ensuring enforcement follows the data.

SASE converges network and security functions in the cloud, providing secure web gateway for malware inspection and zero trust network access for user authentication before accessing applications. It enforces policy consistently regardless of user location, meeting the branch's needs without backhauling traffic. This makes it the correct recommendation.

seccomp filters the system calls a container may invoke, using a profile to block unused or dangerous calls such as ptrace or mount. This reduces the kernel attack surface, directly enforcing least privilege at the syscall layer rather than through filesystem or capability controls.

SAST scans source code statically during development, identifying injection flaws, insecure patterns and coding errors before compilation or deployment. Running it in the development phase satisfies the shift-left constraint, giving developers immediate feedback while remediation remains cheapest.

Under the shared responsibility model, the cloud customer always owns identity and access management — defining users, roles, permissions and authentication. The provider secures the underlying infrastructure, but customer identities and their access rights remain the customer's responsibility.

A CASB acts as an inline policy enforcement point between users and cloud services, applying access, data-loss prevention and threat policies regardless of device or location. This satisfies the requirement to enforce security policies on cloud application traffic.

CSPM tools continuously assess cloud configurations against benchmarks and policies, surfacing misconfigurations and regulatory breaches. Detecting compliance violations is a core capability, directly matching the stem's request for typical CSPM functions rather than runtime workload protection.

Under the shared responsibility model, the customer is responsible for securing data in the cloud, including enabling encryption at rest and managing encryption keys. The cloud provider may offer key management services such as AWS KMS, Azure Key Vault, or Google Cloud KMS, but the customer must configure and use them appropriately to meet PCI DSS requirements.

A just-in-time access broker grants per-session, short-lived credentials and proxies administrative connections without exposing inbound management ports on the virtual machines. This directly reduces the attack surface by removing persistent SSH access and eliminating standing credentials, matching the architect's recommendation.

Immutable infrastructure replaces instances rather than patching them, so any attacker modification to system files is discarded when the instance is rebuilt. This removes the persistence mechanism attackers rely on to survive reboots and remediation.

Input validation enforces length and format checks on user-supplied data before processing, directly satisfying the constraint that input size must be bounded. By rejecting oversized payloads at the boundary, it prevents the buffer overflow the penetration tester exploited, whereas output encoding or parameterised queries address different vulnerability classes.

Confidential computing encrypts guest memory with keys managed by the CPU, so even a compromised hypervisor or a malicious provider administrator sees only ciphertext. TEEs provide cryptographic isolation of tenant workloads from the provider and other tenants, directly meeting the requirement that plaintext never be exposed to the cloud provider at any layer.

A Hardware Security Module provides tamper-resistant hardware that generates, stores and uses private keys without exposing them to host memory, satisfying the stem's requirement for protected keys and cryptographic operations in a tamper-resistant environment. Unlike software keystores, its physical and logical controls detect intrusion and zeroise key material, defeating extraction attempts.

An admission controller intercepts pod creation requests before persistence and evaluates them against policy. OPA/Gatekeeper enforces rules restricting image sources, so only images from the trusted registry are admitted, directly satisfying the stem's trusted-registry constraint.

Threat modelling identifies design-level weaknesses by systematically analysing data flows, trust boundaries and attack paths before coding completes. Applying it early satisfies the stem's requirement to find vulnerabilities during development, complementing code-level scanning with architectural risk discovery.

Zero trust architecture continuously evaluates identity and device posture through a policy engine and enforces decisions at policy enforcement points. Placing enforcement at each microservice allows the hospital to authorize every request based on user, device, and context regardless of network location, satisfying both the managed workstation and unmanaged contractor scenarios with one consistent model.

Zero trust treats network location as insufficient evidence of trust, so every access request is authenticated and authorised explicitly, regardless of whether it originates inside or outside the corporate perimeter. Continuous verification replaces the implicit trust granted by legacy castle-and-moat designs.

A service mesh with mutual TLS authenticates and encrypts all service-to-service communication, and authorization policies can restrict which services are allowed to talk to each other based on identity. If a container is compromised, the attacker cannot impersonate another service or communicate with services that are not explicitly authorized, which significantly limits lateral movement. This is a strong control for microservices environments.

Seccomp profiles filter the syscalls a container may invoke, blocking everything outside an explicit allowlist. This directly satisfies the stem's requirement to restrict system calls to only those the application needs, unlike AppArmor or SELinux, which enforce mandatory access control over file paths, network ports and capabilities rather than the syscall interface itself.

SAST analyzes source code or binaries for vulnerabilities without executing the application. Integrating it into the build process allows developers to receive immediate feedback on security issues as they commit code. This shifts security left, enabling early remediation and reducing the cost of fixes. SAST is ideal for identifying issues like SQL injection and cross-site scripting early in the SDLC.

Data classification and encryption remain customer responsibilities because the provider cannot determine sensitivity or manage keys without the tenant's context. In the shared responsibility model, the customer always owns data governance, including classifying information and controlling encryption keys, while Microsoft Entra ID and the underlying infrastructure stay with the provider.

Dependency analysis inspects third-party libraries and transitive packages for known CVEs before they enter the build, directly satisfying the supply chain security requirement. It catches vulnerable or malicious components at the point of integration, preventing compromised dependencies from reaching production artefacts.

CRYSTALS-Kyber is the NIST-standardised key encapsulation mechanism (ML-KEM, FIPS 203), built on module learning-with-errors. It satisfies the stem's requirement for a PQC KEM candidate by enabling two parties to establish a shared symmetric key over a public channel, unlike CRYSTALS-Dilithium, which is a digital signature scheme.

Network Policies enforce pod-level ingress and egress rules, restricting traffic to explicitly authorised pod selectors within the cluster. This directly satisfies the requirement that only authorised pods communicate, since default Kubernetes networking permits all pod-to-pod traffic. Unlike service mesh or firewall controls, Network Policies operate at layer 3/4 using label selectors native to the cluster.

A hardware security module provides tamper-resistant, FIPS 140-2 Level 3 validated hardware that generates and stores cryptographic keys internally, preventing extraction. This satisfies the requirement to protect signing keys for financial transactions with physical tamper resistance.

Short expiry limits the window in which an intercepted token remains usable, directly mitigating replay. Refresh token rotation invalidates the prior refresh token on each exchange, so a stolen refresh token is detected and rejected once the legitimate client rotates, satisfying the replay-resistance requirement.

Validating all input defends against injection attacks such as SQL injection and cross-site scripting by rejecting malformed or malicious payloads before processing. This directly satisfies the requirement to secure web service APIs against untrusted client-supplied data.

Kubernetes NetworkPolicies are the native mechanism for pod-level segmentation. They select pods via labels and define ingress and egress rules that allow or deny traffic between namespaces, pods, and CIDR blocks. Because the CNI plugin enforces them dynamically, newly scheduled pods that match a label selector inherit the policy automatically, giving the architect the isolation and automation required without external appliances.

Zero trust removes implicit trust based on network location. Assuming breach means every request is treated as potentially hostile, so each access is verified explicitly using identity, device and context signals before granting least-privilege access, which is fundamental to the model.

SCEP provides a standardised protocol for devices to request and receive certificates automatically from a CA, enabling enrolment without manual intervention. For thousands of IoT devices, this automates issuance, renewal and revocation workflows, which is the lifecycle management constraint the stem demands.

CSPM continuously compares deployed cloud resource configurations against security baselines and compliance policies, then flags or automatically remediates drift such as public storage buckets or permissive security groups. That misconfiguration monitoring and remediation is precisely the primary function the scenario asks for.

An API gateway terminates client requests and enforces authentication, authorisation and rate limiting centrally before forwarding to microservices, so only validated clients invoke backends. This satisfies the requirement for centralised access control and abuse prevention.

802.1X performs port-based network access control, requiring devices to authenticate via EAP before gaining Layer 2 connectivity. This enforces the requirement that only authorised devices reach the corporate network, blocking rogue hardware at the access layer.

Immutability means running containers are never patched in place; any change requires redeploying a fresh image. Because the container filesystem and process are not writable by operators or attackers, unauthorised modification of a live container is prevented, satisfying the stem's requirement directly.

AWS Direct Connect provisions a dedicated private network link between on-premises infrastructure and AWS, bypassing the public internet. This satisfies the hybrid requirement for high bandwidth, low latency and consistent connectivity, unlike VPN tunnels that traverse public networks.

HYOK keeps the root keys in an external HSM managed by the organization, outside the cloud provider's control. The provider only receives wrapped data keys, so it cannot decrypt data. Revoking access is immediate by disabling the external HSM or key, satisfying all requirements.

Micro-segmentation enforces granular firewall rules at the workload or pod level, using distributed virtual firewalls or network security groups to restrict lateral movement between application tiers. This directly reduces east-west traffic risks in a hybrid cloud by limiting the blast radius of a compromised host, satisfying the constraint of controlling internal, cross-subnet communication rather than perimeter ingress.

SASE converges network and security functions with identity-aware policy. Remote browser isolation renders the EHR session in a disposable cloud container, so no data touches the unmanaged device, and access decisions can incorporate user identity, device posture signals, and geolocation. This satisfies agentless access and contextual enforcement while isolating the session.

Micro-segmentation enforces least-privilege east-west controls between individual workloads, so a compromised host cannot reach unrelated systems. This directly satisfies the stem's constraint of preventing lateral movement inside the data centre, unlike perimeter or identity-only controls that leave internal traffic largely trusted.

MAM with containerization allows the company to enforce policies such as screen lock, encryption, and remote wipe on the corporate applications and data only, without managing the entire personal device. This preserves employee privacy and is the appropriate solution for a BYOD scenario where the company wants to control corporate data but not the whole device. It directly meets the stated requirements.

SIEM aggregates and correlates logs from multiple sources, while SOAR provides automated response actions and orchestration. Together they enable real-time detection and automated response across endpoints, networks, and cloud workloads, meeting the requirement for correlated events and automation.

Direct Connect and ExpressRoute provide dedicated private circuits between on-premises infrastructure and the cloud provider's network, bypassing the public internet entirely. This satisfies the private, low-latency, non-internet-traversing constraints that site-to-site VPN over the internet cannot guarantee.

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, bypassing the public internet entirely. This satisfies both constraints in the stem: low latency, since traffic avoids internet routing variability, and security, since data never traverses public infrastructure. Site-to-Site VPN would encrypt traffic but still traverse the internet, failing the no-internet requirement.

Input validation rejects malformed or suspicious input at the boundary, while parameterised queries ensure user-supplied values are treated as data, never executable SQL. Together they provide overlapping defence: if validation is bypassed, parameterisation still prevents injected statements from altering query structure.

SAST analyses source code without executing it, flagging injection flaws, insecure patterns and coding errors during development. This satisfies the SSDLC requirement to identify vulnerabilities early, before code reaches testing or production, reducing remediation cost for the sensitive-transaction application.

CSPM continuously assesses configurations across AWS and Azure against a unified policy baseline, detecting misconfigurations and compliance drift in both environments. This directly satisfies the stem's requirement for centralised, consistent policy enforcement spanning multiple clouds, since CSPM ingests native APIs from each provider rather than relying on a single-vendor security stack.

TDE performs real-time I/O encryption and decryption of the data and log files at the page level, protecting data at rest without application changes. It uses a database encryption key protected by a certificate stored in the master database, and the certificate can be backed by an HSM via Extensible Key Management, satisfying the key custody requirement while maintaining performance.

DAST tests a running application from the outside, exercising it as an attacker would and observing responses. This detects vulnerabilities in executing code, including runtime and configuration flaws that static analysis of source cannot reveal, matching the team's requirement.

AWS Direct Connect establishes a dedicated private network link from on-premises infrastructure to the VPC, keeping sensitive traffic off the internet. It delivers the required high bandwidth and low latency, satisfying the stem's explicit prohibition on internet traversal.

An intrusion detection system monitors network or host activity and raises alerts on malicious patterns, which is detection after the fact rather than prevention. That matches the detective control requirement, unlike firewalls or access controls, which block activity and are preventive.

CRYSTALS-Kyber is the NIST-selected key encapsulation mechanism, standardised as ML-KEM (FIPS 203), designed for general encryption against quantum attacks. It satisfies the stem's requirement for a post-quantum key encapsulation algorithm, unlike CRYSTALS-Dilithium or Falcon, which NIST selected for digital signatures rather than encryption.

Envelope encryption uses a DEK to encrypt each record and a KEK to encrypt the DEK. To rotate keys, only the KEK needs to be rotated, and the DEKs are re-encrypted with the new KEK, not the data itself. This allows regular key rotation without re-encrypting the entire database. It also limits the scope of a compromised DEK to a single record.

Host-based microsegmentation enforces security policy at the workload level using identity and tags rather than IP addresses. This allows policies to follow workloads across environments, including containers and legacy systems, and supports least-privilege access between individual workloads. It meets the requirement to decouple policy from network topology.

Continuous compliance monitoring against benchmarks such as CIS satisfies the multi-cloud requirement by evaluating configurations across AWS, Azure and Google Cloud against a common control baseline, detecting drift as it occurs. This provides the ongoing assurance the architect needs, rather than a one-off point-in-time assessment.

Zero Trust removes implicit trust based on network location, requiring every access request to be authenticated and authorised explicitly before granting resources. "Never trust, always verify" captures that continuous verification principle, which is the model's foundational tenet.

Federation trusts the partner's identity provider to authenticate users and assert identity claims to the portal. Partners keep their existing corporate credentials, and when the home organization disables an account, the next authentication attempt fails because the portal never holds the credential. This directly satisfies single sign-on, no new passwords, and home-organization authority over access.

IaaS lets the organisation manage its own operating systems, middleware and applications, giving maximum control over security configuration, while the provider's FedRAMP authorisation covers the underlying infrastructure. PaaS and SaaS shift more configuration responsibility to the provider, reducing customer control.