Infrastructure And System Security

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

Which TWO of the following are essential for protecting against SQL Injection?

Which security measure is most effective at preventing unauthorized access to a physical data center?

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

Which THREE of the following are common network security architecture tools?

What is the primary security goal of an 'Air-Gapped' network segment?

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Which THREE of the following are indicators of a potential system compromise?

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

In a VMware NSX-T environment, you need to implement a 'Distributed Firewall' (DFW) policy that separates traffic based on the application tier regardless of which ESXi host the VM is running on. What is the primary object used to achieve this logical grouping?

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

When designing a secure API, which protocol is recommended for authorization?

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

You need to protect a legacy web application that cannot be patched. What is the best strategy?

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

Which THREE of the following are critical for a secure identity architecture?

Which THREE of the following are valid security controls for a database?

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Which THREE of the following are best practices for securing a remote worker's endpoint?

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Which TWO of the following are common methods to protect data during transit?

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Which TWO of the following are fundamental pillars of information security (CIA triad)?

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Which TWO of the following are best practices for securing API endpoints?

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

What is the primary purpose of a TPM chip in a laptop?

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Which of the following is the most effective way to secure a remote access connection for employees?

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?