Architecture and Design Flashcards
What architecture is designed to protect against distributed denial-of-service (DDoS) attacks by routing traffic through a filtering service to scrub malicious traffic before it reaches the target network?
A) DMZ (demilitarized zone)
B) proxy server
C) intrusion detection system (IDS)
D) reverse proxy
Reverse proxy
A reverse proxy architecture routes incoming traffic through a filtering service to scrub malicious traffic before it reaches the target network, providing protection against DDoS attacks.
In the context of architecture and design, which principle advocates the use of multiple security layers to protect against a variety of threats and vulnerabilities?
A) single sign-on
B) least privilege
C) defense in depth
D) role-based access control
Defense in depth
The principle of defense in depth involves implementing multiple security layers, each providing a unique line of defense, to protect against a wide range of threats and vulnerabilities.
What architectural principle suggests that an organization should employ multiple, diverse security solutions rather than relying on a single security measure to protect against threats?
A) security through obscurity
B) vendor diversity
C) vendor reliance
D) security by design
Vendor Diversity
Vendor diversity suggests that an organization should use security solutions from different vendors to reduce reliance on a single vendor and enhance security resilience.
What architectural component is responsible for maintaining a list of authorized devices on a network and ensuring that only authorized devices can access network resources?
A) firewall
B) intrusion detection system (IDS)
C) network access control (NAC)
D) router
Network access control (NAC)
is responsible for maintaining a list of authorized devices and enforcing network access policies to ensure only authorized devices can access network resources.
In the context of network architecture, what is the purpose of a demilitarized zone (DMZ)?
A) to host sensitive data and internal applications
B) to isolate internal networks from external networks
C) to provide a buffer zone between the internet and an internal network
D) to secure the network perimeter through strong encryption
To provide buffer zone between the internet and an internal network
A DMZ is a network segment that acts as a buffer zone between the internet and an internal network, hosting resources that need to be accessible from the internet while keeping the internal network protected.
Which architectural component plays a critical role in enforcing security policies by examining and filtering network traffic based on predefined rules and policies?
A) intrusion detection system (IDS)
B) router
C) proxy server
D) firewall
Firewall
A firewall is an architectural component responsible for examining and filtering network traffic based on predefined rules and policies to enforce security.
What component is responsible for directing traffic between different network segments and enforcing access controls based on network policies?
A) intrusion detection system (IDS)
B) network access control (NAC)
C) router
D) proxy server
Router
Routers are responsible for directing traffic between different network segments and enforcing access controls based on network policies.
An organization is designing a system that will allow users to access multiple applications and resources using a single set of credentials. Which architectural concept is being implemented in this scenario?
A) single sign-on (SSO)
B) role-based access control (RBAC)
C) least privilege
D) security by design
Single sign-on
Single sign-on (SSO) is an architectural concept that allows users to access multiple applications and resources with a single set of credentials.
In a cloud-based architecture, what security principle ensures that data remains confidential and protected even if it is stored in a shared, multi-tenant environment?
A) data isolation
B) data integrity
C) least privilege
D) security by design
Data isolation
Data isolation is a security principle in a shared, multi-tenant cloud environment that ensures data from one tenant is kept separate and inaccessible to other tenants, maintaining data confidentiality.
An organization is designing its network architecture with the goal of ensuring that critical systems are protected and available even during a cyberattack. Which architectural principle is the organization primarily focused on?
A) availability
B) authentication
C) authorization
D) accountability
Availability
Ensuring that critical systems are protected and available even during a cyberattack is primarily a focus on the architectural principle of availability.
In a cloud-based infrastructure, which architectural component is responsible for scaling resources automatically based on demand and optimizing costs by only using resources when necessary?
A) load balancer
B) virtual private network (VPN)
C) elastic load balancing (ELB)
D) autoscaler
Autoscaler
Autoscaler is a cloud architecture component that scales resources automatically based on demand, optimizing costs by using resources only when needed.
What architectural design principle emphasizes designing and implementing security measures as an integral part of a system or application rather than as an afterthought?
A) VPN gateway
B) firewall
C) load balancer
D) proxy server
VPN gateway
A VPN gateway allows external users to securely access internal resources while hiding the internal network structure from external view.
An organization is implementing a network architecture that requires users to provide multiple authentication factors to access sensitive systems. Which architectural principle does this represent?
A) least privilege
B) authentication
C) authorization
D) multifactor authentication
Multi-factor authentication
Requiring users to provide multiple authentication factors is a security architecture principle known as multifactor authentication (MFA).
An organization is planning to implement a secure architecture that minimizes the attack surface and allows only necessary services and ports to be accessible. Which architectural principle does this strategy align with?
A) network segmentation
B) least privilege
C) service-oriented architecture (SOA)
D) principle of least common mechanism
Principle of least common mechanism
The principle of least common mechanism emphasizes minimizing the attack surface by providing only the necessary services and ports, reducing potential vulnerabilities.
An organization is designing a network architecture that incorporates redundancy to ensure high availability. Which is the primarily responsible for providing redundancy?
A) intrusion detection system (IDS)
B) load balancer
C) failover cluster
D) proxy server
Failover cluster
A failover cluster is a component responsible for providing redundancy and high availability in a network architecture by allowing for seamless service migration in the event of a failure.
An organization is planning to implement a network architecture that uses encryption to protect data in transit. Which architectural principle does this align with?
A) data isolation
B) data integrity
C) data classification
D) data confidentiality
Data Confidentiality
Using encryption to protect data in transit is aligned with the architectural principle of data confidentiality, which ensures that data is kept confidential and protected from unauthorized access during transmission.
A large healthcare organization is planning to implement a new network architecture to ensure the security and privacy of patient records. Which architectural component is crucial for this scenario, providing secure and audited access to patient data for authorized healthcare professionals while protecting against unauthorized access?
A) single sign-on (SSO)
B) role-based access control (RBAC)
C) intrusion prevention system (IPS)
D) data encryption
Role-based access control (RBAC)
In a healthcare organization, RBAC is crucial for ensuring secure and audited access to patient data by assigning permissions based on user roles, allowing authorized healthcare professionals access while protecting against unauthorized access.
A financial institution is designing its network architecture to ensure that customer data is securely transmitted and stored. The design must address encryption for data in transit and at rest, robust authentication, and access control. Which architectural component is essential for this scenario?
A) intrusion prevention system (IPS)
B) firewall
C) data encryption
D)network segmentation
Data encryption
Data encryption is essential for ensuring the secure transmission and storage of customer data, addressing the requirements for encryption for data in transit and at rest, and providing confidentiality and data protection.
An e-commerce company is planning to implement a highly available architecture for its online store. The design should ensure minimal downtime, even during system maintenance and updates. What architectural component is crucial for this scenario?
A) load balancer
B) disaster recovery plan
C) intrusion prevention system (IPS)
D) single sign-on
Load balancer
In this scenario, a load balancer is crucial for ensuring high availability by distributing incoming traffic across multiple servers and reducing downtime during maintenance and updates.
What is a characteristic of cloud computing that enables users to access computing resources on-demand and from anywhere with an internet connection?
A) network segmentation
B) scalability
C) geofencing
D) redundancy
Scalability
Scalability is a characteristic of cloud computing that enables users to access computing resources on-demand and from anywhere with an internet connection, allowing for the easy expansion or reduction of resources as needed.
