CCNA Application And Data Protection Questions

A security administrator is configuring a corporate proxy server (Squid) to inspect outbound HTTPS traffic from endpoints. To perform SSL interception (Man-in-the-Middle inspection) for content filtering and DLP, what cryptographic setup must be installed on client workstations?

A security analyst is reviewing IIS 10 web server logs and notices numerous requests attempting path traversal using URL-encoded characters such as '%2e%2e%2f'. Which built-in IIS feature or security tool should be configured to automatically block such requests?

A developer is configuring TLS 1.3 encryption on an Nginx web server. To ensure maximum cryptographic strength and forward secrecy, which cipher suite configuration should be specified for TLS 1.3?

An organization is evaluating methods to secure data in transit across public networks. Which TWO cryptographic protocols or mechanisms provide secure communication channels?

An administrator is configuring Microsoft BitLocker Drive Encryption on a Windows Server 2019 machine. Which TWO authentication methods are natively supported by BitLocker for operating system volume startup protection?

An enterprise security architect is configuring database security controls in Microsoft SQL Server 2019. Which THREE native features should be implemented to ensure comprehensive data protection and auditing?

A penetration tester is evaluating a web application built on Node.js and discovers that user objects passed into an administrative function are vulnerable to prototype pollution. Which remediation strategy should the development team apply to prevent this vulnerability?

An organization is deploying a Data Loss Prevention (DLP) solution to protect sensitive intellectual property. Which TWO locations or data states must a comprehensive DLP architecture monitor?

A security engineer is performing a security audit on an enterprise PostgreSQL database server. Which THREE hardening steps should be implemented to secure database access and data at rest?

A security administrator is hardening an Apache HTTP Server 2.4 configuration on Ubuntu to protect web applications against Cross-Site Scripting (XSS) and clickjacking. Which directives should be added to the httpd.conf file to enforce a Content Security Policy (CSP) and prevent framing?

An administrator needs to configure Microsoft BitLocker Drive Encryption via Group Policy to require a startup PIN on a Trusted Platform Module (TPM) equipped system. Which specific policy path must be navigated in the Local Group Policy Editor?

An organization is utilizing PostgreSQL to store sensitive customer records and needs to implement Transparent Data Encryption (TDE) for data at rest. Which core native PostgreSQL mechanism or extension should the Database Administrator configure?

A security analyst is investigating a web application vulnerability and identifies that user input is reflected directly inside a JavaScript block without adequate sanitization, leading to execution in the victim's browser. What specific type of vulnerability is present?

A systems administrator needs to secure data at rest on an enterprise Linux server by encrypting an entire secondary disk partition (e.g., /dev/sdb1) using LUKS (Linux Unified Key Setup). Which command should be executed first to initialize the encrypted partition?

A software developer is writing a secure web application and needs to protect sensitive user session cookies against theft and cross-site scripting (XSS) attacks. Which TWO cookie attributes must be set when creating session cookies?

An enterprise security architect is deploying Digital Guardian DLP to protect intellectual property on Windows endpoints. An employee attempts to upload proprietary source code to a personal cloud storage provider via a web browser. Which DLP component intercepts this action at the browser level?

An enterprise application stores user passwords in a PostgreSQL database. To comply with modern cryptographic standards, which hashing algorithm configuration should the database administrator verify is in use to ensure strong password protection against offline brute-force attacks?

A cybersecurity analyst is auditing a Linux server running Apache Tomcat. To prevent attackers from exploiting directory traversal vulnerabilities to download sensitive configuration files from outside the web root, which Tomcat configuration parameter must be properly configured in server.xml?

A security analyst is hardening an enterprise Microsoft Exchange email server and needs to prevent Server-Side Request Forgery (SSRF) and insecure deserialization attacks targeting Exchange web components. Which security control or update management practice is most critical?

A security engineer is configuring a Web Application Firewall (WAF) to protect an online banking portal. The WAF must detect and drop HTTP requests containing patterns typical of SQL injection attacks before they reach the web server. What category of WAF protection rule is being utilized?

An enterprise network administrator needs to enforce data loss prevention rules across corporate endpoints. They deploy McAfee Data Loss Prevention Endpoint. Which client component inspects and blocks data movement to USB mass storage devices locally on the workstation?

An enterprise database administrator is configuring Microsoft SQL Server Always On Availability Groups and needs to ensure that database traffic transmitted between replicas across the network is encrypted. Which configuration setting must be enabled?

A security analyst is deploying Snort IDS to inspect incoming web traffic and needs to write a rule that triggers when the HTTP URI contains the exact string 'admin_login.php' regardless of case. Which Snort rule option modifier accomplishes this?

A security analyst is hardening an Apache HTTP Server against web attacks. Which TWO directives or modules should be configured to enhance application security and mitigate common web threats?

A security engineer is configuring AWS Key Management Service (KMS) for an application storing customer data in Amazon S3 buckets. The security policy dictates that the Customer Master Key (CMK) must be automatically rotated every year, and the key material must be managed within a dedicated hardware security module. Which KMS key type and rotation setting fulfill these requirements?

An organization is implementing database encryption in Oracle Database 19c and wants to protect specific sensitive columns containing Social Security Numbers using Advanced Security Transparent Data Encryption (TDE). Which SQL command correctly creates a table with a column encrypted using AES256?

A security engineer is configuring a Symantec Data Loss Prevention (DLP) Network Monitor policy to intercept outgoing HTTP traffic containing credit card numbers. Which detection technology should be selected to match standard credit card formats using Luhn algorithm validation?

An application security team is performing static code analysis on a Java Spring Boot web application. The scanner flags a potential SQL injection vulnerability in a JDBC template query. Which remediation method should the developer implement to secure the database interaction?

An enterprise security auditor is reviewing an Elasticsearch cluster configuration. To prevent unauthorized access to stored indices containing sensitive PII and financial records, which authentication and transport layer security (TLS) settings must be enforced?

A software developer is writing a Python Flask web application that accepts file uploads from users. To prevent arbitrary file upload vulnerabilities leading to Remote Code Execution (RCE), which validation procedure must the developer implement?

A cybersecurity architect is designing an enterprise Data Loss Prevention (DLP) deployment strategy across endpoint, network, and storage vectors. Which THREE technical capabilities are standard functions of enterprise storage discovery DLP tools?

An organization wants to secure data in transit between microservices communicating within a Kubernetes cluster. Which service mesh technology provides mutual TLS (mTLS) encryption automatically between service pods without modifying application code?

A security practitioner is deploying an intrusion prevention system (IPS) rule to detect XML External Entity (XXE) injection attacks in HTTP POST requests. Which core feature of an XML parser is being abused in an XXE attack and must be disabled?

An organization is implementing database transparent data encryption (TDE) and needs to understand its architectural security boundaries. Which THREE security characteristics or limitations are true regarding TDE?

An organization is implementing database activity monitoring (DAM) to detect unauthorized data access and SQL injection attempts against their enterprise SQL Server databases. Where should the DAM sensor ideally be placed to capture all database queries accurately without relying solely on database logs?

An enterprise application developer is implementing JSON Web Tokens (JWT) for stateless session authentication. Which implementation flaw represents the highest risk of signature forgery and unauthorized privilege escalation?