CCNA Casp Security Architecture Questions

A mutually authenticated API gateway with schema validation and signed messages enables selective field exchange, real-time communication, strict schema enforcement, and tamper-resistant auditing. It avoids exposing internal databases and provides the necessary security controls for partner data sharing.

CRYSTALS-Kyber is a NIST-approved post-quantum cryptographic algorithm designed for key encapsulation (KEM), selected in the NIST PQC standardization process. It is based on module learning with errors (MLWE) and provides secure key exchange resistant to quantum attacks. RSA-4096 and ECDHE are classical algorithms vulnerable to quantum computers, and CRYSTALS-Dilithium is designed for digital signatures, not key encapsulation.

Secure Web Gateway (SWG) is one of the core converged capabilities of a SASE platform, alongside CASB, ZTNA, FWaaS, and SD-WAN. SASE merges network and security functions into a cloud-delivered service, and SWG provides web filtering, malware inspection, and policy enforcement for user web traffic. It is explicitly expected in a SASE architecture.

Token binding is the only mechanism that cryptographically links the session token to the client's TLS connection, so a token stolen via XSS cannot be replayed from a different device or network. Lifetime reduction, cookie flags, and local storage encryption mitigate other risks but do not satisfy the explicit cross-device reuse requirement.

Client-side encryption with keys held in an on-premises HSM ensures that data is encrypted before it reaches the cloud, so the provider only stores ciphertext and never possesses the key. This architecture preserves confidentiality even if the provider's infrastructure is breached, which is essential for ePHI under strict regulatory requirements.

An HSM is a dedicated, tamper-resistant hardware appliance that generates, stores, and uses cryptographic keys without ever exposing them to the host OS or application memory. It provides FIPS 140-2/3 validated key protection and performs crypto operations (signing, encryption, key wrapping) inside the secure boundary. For a PKI requiring secure private key storage and tamper-resistant cryptographic operations at scale, an HSM (or cloud HSM service) is the correct answer.

Zero Trust Network Access (ZTNA) is essential for enforcing security policies based on user identity and device posture in a SASE architecture. ZTNA provides secure, identity-based access to applications, ensuring that only authenticated and authorized users with compliant devices can connect, regardless of location.

An API gateway sits in front of microservices and acts as a single entry point for all client requests, making it the ideal enforcement point for cross-cutting security controls. Centralizing authentication (e.g., OAuth2/JWT validation), authorization, rate limiting, and threat protection at the gateway means individual microservices don't each need to reimplement these policies. This reduces attack surface and ensures consistent policy enforcement across the entire API estate.

The Secure Web Gateway (SWG) is the SASE component that proxies outbound user web traffic and performs full TLS inspection, URL filtering, malware scanning, and DLP on decrypted content. Because it terminates and re-originates TLS sessions, it can inspect encrypted traffic for threats. This is its core function within the SASE stack.

The shared responsibility model clearly delineates which security tasks are handled by the cloud provider and which by the customer, varying by service type (IaaS, PaaS, SaaS).

High-fidelity DLP combines exact data matching, which fingerprints the organization's own sensitive records, with trainable classifiers that recognize document categories from labeled examples. Together they detect both known data and semantically sensitive content while avoiding the noise of generic regex or keyword rules. Size limits and broad patterns do not target sensitive content and increase false positives.

IAM is the cloud-native service that manages identities, roles, and permissions, controlling who can do what on which resources. It is the foundational access control plane in every major cloud provider (AWS IAM, Azure Entra ID/RBAC, GCP IAM). The question asks specifically about managing user permissions and access, which is IAM's core purpose.

Zero Trust Network Access matches the stated constraints because it inverts the traditional model: users connect outbound to a broker, the internal EHR network is never published, and authorization is continuously re-evaluated based on identity and device posture. VPN concentrators, reverse proxies, and network access control all require either inbound exposure or do not deliver per-session verification.

Federating identities through a gateway that consumes SAML assertions allows the portal to trust the partner's identity provider without exchanging credentials. Attributes carried in assertions can drive authorization decisions locally, and SAML single logout supports centralized session termination. The other approaches either require shared or duplicated credentials, lack SAML support, or expose internal directory services to an external party, none of which meet the stated interoperability and revocation requirements.

The service mesh architecture uses sidecar proxies to intercept all service-to-service communication, enabling transparent mutual TLS and Layer 7 policy enforcement without modifying application code. This satisfies the demand for cryptographic identity across microservices and eliminates per-application reconfiguration, making it the appropriate design for a containerized trading platform.

Kubernetes RBAC (Role-Based Access Control) uses Roles/ClusterRoles bound to users, groups, or service accounts via RoleBindings/ClusterRoleBindings to authorize actions like create or modify on pods. Configuring RBAC with verbs such as create, update, and patch on the pods resource enforces exactly who can manipulate pods.

Isolating the cardholder data environment in a segmented enclave with strict ingress and egress filtering, dedicated administration, and no shared authentication lets assessors treat the surrounding corporate network as out of scope. This directly reduces the number of systems subject to the audit while keeping a defensible, monitored boundary around the payment systems that handle card data.

The requirement is to verify image signatures and vulnerability status before the container runtime starts the image. A Kubernetes admission controller enforces these checks at pod creation, rejecting non-compliant images. SAST analyzes code, registry scanning only alerts, and runtime agents act after startup, so none provide the required pre-runtime enforcement.

Transparent data encryption encrypts database files at rest without requiring application changes, providing confidentiality and integrity with minimal performance impact. It is specifically designed for the scenario's constraints, unlike application-level encryption or transit encryption.

Admission controllers intercept requests to the Kubernetes API server before objects are persisted, and can validate or mutate them — including rejecting pods whose images come from unauthorized registries or lack required signatures. This is the correct enforcement point for cluster-wide policy on what containers may run.

When a server fails to verify the JWT signature, an attacker can modify the token's payload (e.g., change the 'sub' or 'role' claim) and re-encode it without needing the signing key, because the server will accept any token whose signature it never validates. This is JWT tampering — the attacker forges or alters claims to impersonate another user or escalate privileges. The vulnerability is specific to improper cryptographic validation of the token, not to input handling or access control logic.

Continuous access evaluation and device posture attestation together give the policy engine live signals to make and revisit authorization decisions. Continuous access evaluation enforces revocation the moment risk changes, while posture attestation supplies the endpoint trust data that fuels those decisions. Combined, they ensure that a compromised device loses access to sensitive applications mid-session, satisfying the auditors' requirement.

Dynamic secrets with workload identity binding issue credentials only after the platform verifies the caller, and the credentials expire automatically with their lease. This removes static passwords from the environment and ensures that deleting a deployment terminates its database access without manual intervention. Secrets storage, mutual TLS, and auditing each address part of the problem but do not deliver identity-bound, automatically revoked credentials.

A Secure Web Gateway (SWG) sits at the network edge and inspects outbound web traffic, enforcing URL filtering, malware blocking, and acceptable use policies — exactly the function described. In a SASE architecture, SWG is the component that governs user web access regardless of location, applying policy based on categories, reputation, and content inspection. It is distinct from ZTNA (which controls application access), CASB (which governs cloud service usage), and SD-WAN (which optimizes WAN transport).

A Cloud Access Security Broker (CASB) is specifically designed to discover cloud applications in use (shadow IT), enforce security policies, and provide visibility and governance over cloud service usage. It sits between users and cloud providers, applying policy via inline proxies or API integrations. This matches the question's three requirements — discovery, policy enforcement, and visibility — which are CASB's core functions.

A Hardware Security Module (HSM) is a dedicated tamper-resistant hardware appliance designed to generate, store, and manage cryptographic keys, with physical and logical protections that prevent key extraction. For TLS termination, HSMs provide FIPS 140-2/3 validated key storage and can perform cryptographic operations without exposing private keys. This directly addresses the requirement to prevent key extraction.

In the cloud shared responsibility model for IaaS, the customer is responsible for managing the guest operating system, including patch management, security updates, and configuration. The cloud provider is responsible for the hypervisor, hardware, and physical security of data centers. Therefore, guest OS patch management is the customer's responsibility.

Host-based firewalls with workload identity tags and an SDN overlay with distributed policy enforcement both enable granular, identity-aware microsegmentation across hybrid cloud environments. They enforce least-privilege access, limit lateral movement, and provide east-west visibility. The other options either provide broad connectivity, address non-security concerns, or operate only at the perimeter.

Local internet breakout with integrated NGFW and SWG at the branch enables direct cloud access while still inspecting traffic for threats. This design eliminates the need to backhaul traffic to a central data center for security inspection, balancing performance and security for branch offices.

Rate limiting per API consumer is a capability unique to API gateways because the gateway understands API keys, OAuth tokens, and consumer identities, allowing it to enforce quotas and throttling on a per-client basis. A traditional WAF operates at the network/HTTP layer and inspects traffic patterns for attacks but does not natively identify API consumers or apply per-consumer quotas. This makes per-consumer rate limiting the distinguishing capability in this comparison.

The described need is centralized ingestion, normalization, correlation, retention, and custom detection across many log sources, which is the core purpose of a SIEM. Vulnerability scanners, network performance monitors, and configuration databases each serve different operational functions and none provides the combined correlation and retention capability required.

SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without executing the program, making it the correct choice for finding vulnerabilities before compilation. It integrates into the IDE or CI pipeline and can flag issues like hardcoded secrets, injection flaws, and insecure API usage at the code level. Because it works on the code itself, it is the only option that fits the 'before it is compiled' requirement.

Application-level encryption with deterministic encryption for the searchable field ensures that data is encrypted before storage and remains unreadable if the database is compromised. Deterministic encryption allows equality searches on that field without decrypting the entire dataset. Other methods either leave data readable in memory, prevent searching, or introduce a separate high-value target.

Hypervisor-based introspection enforces policy outside the guest OS, so even root-level malware cannot disable the control. It provides tamper-resistant visibility and can prevent execution of unauthorized binaries, meeting the agentless and root-resistant requirements. Agent-based tools and log correlation are either bypassable or detective only.