CCNA Security Planning And Engineering Questions

When mapping security requirements from ISO/IEC 27001 to a cloud-native architecture, you are configuring Azure Policy to ensure all newly created storage accounts have 'Secure transfer required' enabled. What is the most efficient way to achieve this enforcement?

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

An ISSEP is conducting a gap analysis between a legacy system and ISO/IEC 27001 requirements. The system lacks automated audit logging. Which control implementation is most effective for meeting the 'Logging and Monitoring' requirements?

Which THREE of the following are recognized categories of security controls in NIST SP 800-53?

Which TWO items should be included in a system's security architecture documentation?

Which THREE items should be included in an Incident Response (IR) plan for an information system?

During a system migration, you need to ensure integrity of transferred data. What is the best cryptographic method?

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

When architecting a system to meet ISO 27001 requirements for secure system engineering, which TWO of the following design principles should be prioritized for protecting sensitive data at rest?

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

An ISSEP is configuring an AWS S3 bucket. What policy setting best prevents public access while allowing access from a specific VPC?

You are designing an incident response architecture for a cloud environment. Which TWO of the following configurations are critical for ensuring effective forensic readiness according to NIST SP 800-61?

An ISSEP architect is designing a system under NIST SP 800-53 controls and needs to implement an automated mechanism to enforce the principle of least privilege for non-privileged accounts. Which configuration in an AWS environment best aligns with the 'AC-6' control requirement?

An ISSEP is designing a secure storage solution for a database. To ensure data integrity, which mechanism is most reliable?

You are conducting a threat modeling exercise using the STRIDE methodology. A specific service-to-service communication path lacks mutual TLS. Which STRIDE category does this vulnerability primarily fall under?

Which TWO of the following are considered critical components of a Secure Software Development Life Cycle (SDLC)?

What is the correct order of operations when handling a vulnerability in a production system according to the RMF?

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

In a cloud environment, you must ensure that VM snapshots are encrypted. What is the most effective approach?

An ISSEP needs to secure inter-process communication (IPC) on a Linux host. Which feature should be configured to prevent unauthorized processes from accessing sensitive memory space?

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

Which THREE items are required to verify the integrity of a downloaded software package?

You are designing a secure microservices architecture. To meet the 'Data at Rest' security requirements, you decide to use envelope encryption. Which sequence correctly describes the flow of managing the Data Encryption Key (DEK)?

An organization is migrating to a Zero Trust architecture as defined in NIST SP 800-207. Which component is responsible for evaluating the context of a request, such as device health and location, before granting access?

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

When designing an information system architecture, what is the primary role of a System Security Plan (SSP)?

An ISSEP must secure a server-to-server connection that currently uses plaintext LDAP. What is the recommended secure alternative?

Which TWO methods are effective for managing cryptographic keys in a cloud architecture?

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

What is the primary objective of the 'Assessment' phase in the NIST RMF?

Which THREE elements are required in a high-security access control policy?

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

An ISSEP professional is reviewing an architecture for compliance with NIST SP 800-160, Systems Security Engineering. Which THREE of the following activities are core to the 'Trustworthiness' objective for an engineered system?

What is the primary goal of the 'Authorization' phase in the NIST RMF?

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Which THREE methods can be used to ensure high availability for a database in a secure architecture?

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Which THREE of the following are necessary to successfully implement Zero Trust in an existing enterprise environment?

You are assessing a system for compliance with FIPS 140-3. You need to ensure that the cryptographic module being used for TLS termination on a load balancer meets specific physical security requirements. Where should you look for the validation status of the cryptographic module?

In the context of the NIST Risk Management Framework (RMF), which step involves the initial identification of security controls based on the system's impact level?