67 questions · Infrastructure And System Security topic · All types, answers revealed
Which THREE of the following are components of a defense-in-depth strategy?
Another layer of defense.
Why this answer
Defense-in-depth uses layers of security including host, network, and application controls.
You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?
Security Groups act as a virtual firewall for EC2 instances to control inbound and outbound traffic.
Why this answer
Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.
Which TWO of the following are essential for protecting against SQL Injection?
The most effective defense against SQLi.
Why this answer
Prepared statements and input validation are the primary defenses against SQLi.
Which security measure is most effective at preventing unauthorized access to a physical data center?
Physical barriers are the only defense against physical intrusion.
Why this answer
Layered physical security (e.g., mantraps, badge access, surveillance) provides the most comprehensive defense for physical infrastructure.
Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?
TLS provides both encryption and data integrity for log transport.
Which THREE of the following are common network security architecture tools?
Essential for monitoring and alerting.
To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?
Security Groups support dynamic membership based on tags, facilitating intent-based policy.
Why this answer
Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.
What is the primary security goal of an 'Air-Gapped' network segment?
Physical isolation prevents all network-based access.
Why this answer
Total physical isolation ensures that no network traffic can enter or leave the segment, protecting critical systems from remote attacks.
A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?
RLS provides strong, built-in isolation at the data tier.
Why this answer
Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.
You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?
This exposes the attack surface and prevents internal network isolation.
Why this answer
If a function is not in a private VPC, it cannot interact with internal resources securely and is exposed to potential internet-based discovery and interaction.
A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?
MAC provides a system-wide policy that is enforced regardless of user uid.
Why this answer
SELinux (or AppArmor) uses Mandatory Access Control (MAC) to restrict process capabilities based on security policies, regardless of user privileges.
A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?
Nonces and short lifespans prevent attackers from reusing captured credentials.
Why this answer
Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.
Which THREE of the following are indicators of a potential system compromise?
Common sign of C2 activity.
Why this answer
Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).
A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?
HSMs are specifically designed for the secure management of cryptographic keys.
Why this answer
Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.
You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?
The Client SSL profile is applied to the Virtual Server to decrypt traffic arriving from the client.
Why this answer
A Client SSL profile is required on the Virtual Server to handle the decryption of traffic from the client.
Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?
This is a core ZTA principle.
Why this answer
Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.
Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?
mTLS is the industry standard for secure service-to-service communication.
Why this answer
Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.
An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?
Preventative scanning of IaC is the best way to catch configuration drift before deployment.
Why this answer
Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.
You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?
This is the core purpose of DNSSEC signing.
Why this answer
DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.
An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?
This enables testing and tuning before full-scale enforcement.
Why this answer
Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.
A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?
Validating the structure and parameters helps prevent malicious object ID manipulation.
Why this answer
BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.
You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?
OIDC provides a standardized and secure way to exchange identity claims.
Why this answer
Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.
You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?
Uses attributes for fine-grained authorization decisions.
Why this answer
Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.
Which THREE of the following are risks associated with using shared cloud storage buckets?
A leading cause of data breaches.
Why this answer
Public access, lack of encryption, and missing object versioning are common risks.
A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?
This policy prevents specific users or groups from using RDP to access the target machine.
Why this answer
Restricted Groups or the newer 'Group Policy Preferences > Local Users and Groups' can be used, but specifically, to mitigate lateral movement, 'Deny log on through Remote Desktop Services' is the standard hardening control for local admins.
A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?
AppArmor uses profiles to restrict programs to a limited set of resources.
Why this answer
SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).
You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?
These are essential for hardening cookies against interception and XSS.
Why this answer
The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.
NSX Groups allow for dynamic membership based on tags or attributes, enabling policy application regardless of host location.
Why this answer
NSX-T uses 'Groups' based on dynamic criteria (tags, VM names, etc.) to apply DFW rules consistently across the infrastructure.
A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?
Managed services provide auditability, rotation, and lifecycle management.
Why this answer
Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.
You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?
Explicit Deny statements always override Allow statements.
Why this answer
Block Public Access settings at the account level, using Bucket Policies with Deny statements, and enforcing S3 Block Public Access at the bucket level are the primary defense-in-depth measures.
Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?
MFA is the standard defense against stolen credentials.
Why this answer
Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.
Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?
This enforces segmentation within the cluster.
Why this answer
Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.
When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?
The failover link specifically synchronizes firewall connection state tables.
Why this answer
The Cisco Failover Link is used to synchronize the state table, session information, and configuration between the active and standby units.
A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?
This enforces mTLS for all services within the mesh automatically.
Why this answer
A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.
You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?
Vulnerability protection profiles include signature-based matching to detect and block exploits such as SQL injection.
Why this answer
Vulnerability protection profiles allow for specific signatures to be applied to block SQL injection attempts at the application layer.
When designing a secure API, which protocol is recommended for authorization?
OAuth 2.0 is designed specifically for API authorization delegation.
Why this answer
OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.
AES-GCM is a modern, authenticated encryption standard.
Why this answer
AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.
You need to protect a legacy web application that cannot be patched. What is the best strategy?
Virtual patching through a WAF is the standard defense for unpatchable legacy apps.
Why this answer
Placing a Web Application Firewall (WAF) or an RASP solution in front of the application can filter malicious traffic before it reaches the vulnerable application.
You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?
Remote attestation is the mechanism to verify code integrity in a TEE.
Why this answer
Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.
An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?
This acts as an admission controller to block non-compliant deployments.
Why this answer
Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.
An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?
This provides early, consistent, and scalable security validation.
Why this answer
Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.
Which THREE of the following are critical for a secure identity architecture?
Standard for securing identities.
Why this answer
Multi-factor authentication, least privilege, and robust auditing are required for identity security.
Which THREE of the following are valid security controls for a database?
Essential for monitoring and accountability.
Why this answer
Encryption, auditing, and access control are fundamental database security controls.
You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?
A NAT Gateway is specifically designed to allow private instances to initiate outbound traffic while blocking inbound requests.
Strong encryption is required to protect the confidentiality of the transit traffic.
Why this answer
A secure design requires robust authentication (MFA), transport security (encryption), and granular authorization (least privilege).
When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?
The DMZ is the classic architectural pattern for isolating public-facing services.
Why this answer
The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.
Which THREE of the following are best practices for securing a remote worker's endpoint?
Essential for detecting threats.
Why this answer
Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.
A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?
SSH CAs allow for identity-based, short-lived certificate issuance.
Why this answer
Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.
Which TWO of the following are key benefits of 'Immutable Infrastructure'?
Ensures consistent state.
Why this answer
Immutability prevents configuration drift and allows for rapid recovery.
You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?
This algorithm splits the master key into shares, requiring a defined threshold to reconstitute the key.
Why this answer
Vault utilizes Shamir's Secret Sharing to split the unseal key into multiple shares, requiring a quorum to unseal the vault.
You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?
App Mesh uses Envoy proxies to manage traffic, providing identity-based security rather than network-layer security.
Why this answer
AWS App Mesh provides application-level networking, allowing for service-to-service communication control using mutual TLS (mTLS) and fine-grained traffic routing independent of IP addresses.
You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?
This prevents a process from gaining more privileges than its parent process.
Why this answer
To prevent escalation, you must restrict the container's ability to run as root and prevent it from gaining additional privileges that were not granted at start-up.
Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?
Tenants represent the highest level of logical separation in the ACI fabric for security and administration.
Why this answer
In Cisco ACI, the EPG, Contract, and Tenant are the fundamental building blocks for security policy definition and isolation.
You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?
Using default accounts leads to privilege escalation risks and visibility issues.
Why this answer
The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.
Which TWO of the following are common methods to protect data during transit?
Standard for secure network-to-network traffic.
To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?
These are specific defenses against side-channel analysis.
Why this answer
Constant Time (CT) instructions and hardware-based mitigations like Intel SGX or isolation features prevent information leakage through timing side-channels.
Which TWO of the following are essential for a secure Cloud CI/CD pipeline?
This finds vulnerabilities early.
Why this answer
Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.
A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?
This service includes the agent-based FIM and vulnerability assessment capabilities required.
Why this answer
Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.
Which TWO of the following are fundamental pillars of information security (CIA triad)?
One of the three pillars.
Why this answer
The CIA triad consists of Confidentiality, Integrity, and Availability.
A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?
This is the secure standard for multi-tier application architecture.
Why this answer
Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.
Which TWO of the following are best practices for securing API endpoints?
Industry-standard authentication.
Why this answer
Rate limiting and strong authentication are foundational API security practices.
A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?
Conditional Access policies evaluate signals, including device compliance, to permit or deny access.
Why this answer
Microsoft Entra ID (formerly Azure AD) Conditional Access policies are used to evaluate device compliance status before granting access to M365 resources.
What is the primary purpose of a TPM chip in a laptop?
TPM is a hardware root of trust for identity and boot integrity.
Why this answer
The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.
What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?
EDR provides behavioral analysis and response capabilities.
Why this answer
EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.
Which of the following is the most effective way to secure a remote access connection for employees?
This is the industry standard for secure remote access.
A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?
GWLB is the standard architectural pattern for centralized inspection in AWS.
Why this answer
Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.
An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?
SCPs provide a preventative guardrail that cannot be bypassed by IAM users.
Why this answer
Service Control Policies (SCPs) applied at the OU level can explicitly deny the 's3:PutBucketPolicy' action if the bucket is public, overriding any IAM user permissions.
Ready to test yourself?
Try a timed practice session using only Infrastructure And System Security questions.