Security Planning And Engineering practice questions

Expose the Root CA via a restricted management port in the firewall.

Why wrong: Exposing management ports increases the risk of unauthorized access to the Root key.

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Why wrong: A VPN tunnel implies the Root CA is online, which defeats the purpose of an offline Root.

Use an HSM to automatically sign the request from the Subordinate CA.

Why wrong: Automatic signing requires an online connection.

Client Credentials Flow.

Why wrong: Client Credentials are for machine-to-machine communication, not user-facing apps.

Resource Owner Password Credentials Flow.

Why wrong: This flow is insecure as it requires the user to share credentials directly with the client app.

Implicit Flow.

Why wrong: The Implicit flow is deprecated and considered insecure for modern applications.

Implement a full database mirror in the cloud without encryption.

Why wrong: Lack of encryption and data sovereignty controls creates significant regulatory risk.

Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.

Why wrong: This does not guarantee sovereignty or control over the encryption keys.

Use public cloud object storage and rely on IP whitelisting.

Why wrong: IP whitelisting is not a substitute for data sovereignty and encryption.

Use the default ClusterRoleBinding for all pods.

Why wrong: Default bindings grant excessive permissions, violating least privilege.

Deploy all microservices into a single flat network segment.

Why wrong: Flat network segments lack the isolation required for secure architectural design.

Enable Kubernetes NetworkPolicies only at the namespace level.

Why wrong: Namespace-level policies are too coarse to enforce service-to-service least privilege.

Implement security and privacy controls.

Why wrong: Implementation happens after the controls have been selected.

Monitor security and privacy controls.

Why wrong: Monitoring is the final, ongoing step in the RMF.

Assess security and privacy controls.

Why wrong: Assessment happens after implementation.

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Why wrong: Allowing 0.0.0.0/0 exposes the application tier to the public internet.

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Why wrong: IP addresses in AWS are ephemeral; this rule would break during auto-scaling events.

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.

Why wrong: Allowing the entire VPC CIDR is too permissive and does not restrict traffic to the web tier.

Enable 'TLS Termination' to offload encryption.

Why wrong: TLS termination is for performance, not injection prevention.

Enable 'Geo-blocking' to restrict access to local users only.

Why wrong: Geo-blocking does not prevent injection attacks from authorized locations.

Enable 'Rate Limiting' on all incoming traffic.

Why wrong: Rate limiting mitigates DoS, not injection attacks.

Redirect all logs to a local write-only file system on each server.

Why wrong: Local logs are vulnerable to tampering and do not support centralized analysis.

Disable unnecessary services to reduce the attack surface.

Why wrong: Hardening is a valid security practice, but it does not satisfy the requirement for audit logging.

Require manual review of system event logs by administrators weekly.

Why wrong: Manual processes are prone to error and do not meet the timeliness requirements for monitoring.

Use LDAP with Kerberos binding only.

Why wrong: Kerberos provides authentication, but not necessarily transport encryption.

Use IPsec to encrypt traffic between servers.

Why wrong: While IPsec works, it is an infrastructure-level fix, not an application-specific configuration.

Use a VPN tunnel.

Why wrong: A VPN adds unnecessary complexity and overhead compared to native LDAPS.

Enforce the access decision on the network resource.

Why wrong: The Policy Enforcement Point (PEP) enforces the decision, not the PDP.

Monitor network traffic for anomalous behavior.

Why wrong: Monitoring is typically handled by SIEM or IDS/IPS solutions.

Store user authentication credentials.

Why wrong: Credential storage is the function of an Identity Provider (IdP).

Record the results of security control assessments.

Why wrong: Assessment results belong in the SAR (Security Assessment Report).

List the vulnerabilities found during a scan.

Why wrong: Vulnerabilities are tracked in a POA&M.

Define the business strategy for the organization.

Why wrong: Business strategy is defined in organizational documentation, not the SSP.

Rotate all secrets after every deployment.

Why wrong: Rotation is a reactive control, not a preventive one.

Use environment variables for all configuration.

Why wrong: While environment variables are good, they don't prevent hardcoded secrets in the code itself.

Delete the repository history periodically.

Why wrong: This is a poor practice and does not prevent the initial commit.

Ensure the vendor claims the product is FIPS compliant.

Why wrong: Vendor claims are insufficient; independent validation is required.

Ensure the product is open source.

Why wrong: Open source status is irrelevant to FIPS validation.

Verify the algorithms are AES-256.

Why wrong: Algorithm choice is important, but validation of the module is mandatory.

Risk Assessment Report (RAR).

Why wrong: The RAR informs the SoA, but it is not the SoA itself.

System Security Plan (SSP).

Why wrong: The SSP is a NIST RMF artifact, not an ISO 27001 requirement.

Business Impact Analysis (BIA).

Why wrong: A BIA is used for BCP/DR, not primarily for control selection in ISO 27001.

Shared storage with ACLs.

Why wrong: Shared storage is the least secure option for high-sensitivity data.

VLAN tagging and firewall rules.

Why wrong: VLANs are logical, not physical, and can be bypassed.

Container isolation with restricted network access.

Why wrong: Container isolation is insufficient for high-security research data.

Document the risk acceptance by the authorizing official.

Why wrong: Risk acceptance occurs in the Authorization phase.

Define the system's security impact level.

Why wrong: Categorization defines the impact level.

Deploy security software to endpoints.

Why wrong: Deployment happens during the Implementation phase.

Use a shared secret between the IdP and SP.

Why wrong: SAML uses PKI/certificates, not shared secrets.

Use HTTPS with TLS 1.3 for transport.

Why wrong: TLS protects the channel, but signing protects the assertion itself.

The Service Provider must encrypt the assertion.

Why wrong: Encryption ensures confidentiality, not integrity against tampering.

Set file permissions to 600.

Why wrong: File permissions do not control memory access between processes.

Use a rootkit scanner.

Why wrong: A rootkit scanner is for detection, not prevention of IPC access.

Update the host kernel.

Why wrong: Kernel updates improve stability/security, but don't define IPC access rules.

Risk Management Framework (RMF) Guide.

Why wrong: The RMF Guide is a reference document, not an artifact.

System Security Plan (SSP).

Why wrong: The SSP documents the baseline, not remediation progress.

Security Assessment Report (SAR).

Why wrong: The SAR documents the findings, not the remediation plan.

Use RAID 10 for storage redundancy.

Why wrong: RAID 10 provides hardware availability, not integrity.

Require multi-factor authentication for database access.

Why wrong: MFA protects access, not the integrity of existing data.

Perform daily backups to an offsite location.

Why wrong: Backups are for availability/recovery, not integrity monitoring.