Practice Test SYO-701 Security Architecture Flashcards
Enrique is concerned about backup data being infected by malware. The company backs up key servers to digital storage on a backup server. Which of the following would be most effective in preventing the backup data being infected by malware?
Place the backup server on a separate VLAN.
Air gap the backup server.
Place the backup server on a different network segment.
Use a honeynet.
B. Air gapping refers to the server not being on a network. This means literally that there is “air” between the server and the network. This prevents malware from infecting the backup server. A separate virtual local area network (VLAN) or physical network segment can enhance security but is not as effective as air gapping. A honeynet is used to detect attacks against a network, but it doesn’t provide effective defense against malware in this scenario.
Which of the following is not an advantage of a serverless architecture?
It does not require a system administrator.
It can scale as function call frequency increases.
It can scale as function call frequency decreases.
It is ideal for complex applications.
D. Serverless architectures do not require a system administrator because the provider manages the underlying function‐as‐a‐service (FaaS) capability. It can also scale up or scale down as needed, allowing it to be very flexible. Serverless architectures are typically not ideal for complex applications and instead tend to work better for microservices.
Derek has been asked to implement his organization’s service‐oriented architecture as a set of microservices. What does he need to implement?
A set of loosely coupled services with specific purposes
A set of services that run on very small systems
A set of tightly coupled services with custom‐designed protocols to ensure continuous operation
A set of services using third‐party applications in a connected network enabled with industry standard protocols
A. A microservice architecture builds applications as a set of loosely coupled services that provide specific functions using lightweight protocols. It doesn’t specifically define the size of the systems, but it is not a tightly coupled environment. Protocol choice is often open standards–based, but the emphasis is on lightweight protocols. There is not a requirement that services be in‐house or third party exclusively.
Ben has been asked to explain the security implications for an embedded system that his organization is considering building and selling. Which of the following is not a typical concern for embedded systems?
Limited processor power
An inability to patch
Lack of authentication capabilities
Lack of bulk storage
D. Embedded systems can bring a broad range of security implications, many of which are driven by the limited capabilities of the processors and hardware they are frequently built with. Low‐power consumption designs may lack computational power and thus have challenges implementing strong cryptography, network connectivity, and other similar problems. Patching embedded systems can be challenging both because of where they are deployed and because of a lack of connectivity for them—in fact, in many environments, you may not want the devices to be connected to your network. Since many don’t have a screen, keyboard, or a network connection, authentication is also a problem. Few embedded devices, however, need bulk storage, making the lack of bulk storage a problem that typically isn’t a major concern.
Madhuri has configured a backup that will back up all of the changes to a system since the last time that a full backup occurred. What type of backup has she set up?
A snapshot
A full backup
An incremental backup
A differential
D. Differential backups back up all of the changes since the last full backup. An incremental backup backs up all changes since the last incremental backup. A snapshot captures machine state and the full drive at a bitwise level, and full backups are a complete copy of a system but typically do not include the memory state.
Nathaniel wants to improve the fault tolerance of a server in his datacenter. If he wants to ensure that a power outage does not cause the server to lose power, what is the first control he should deploy from the following list?
A UPS
A generator
Dual power supplies
Managed power units (PDUs)
A. An uninterruptable power supply (UPS) should be Nathaniel’s first priority. Ensuring that power is not disrupted during an outage and can be maintained for a short period until alternate power like a generator can come online is critical, and a UPS can provide that capability. A generator alone will take longer to come online, resulting in an outage. Dual power supplies can help to build resilience by allowing multiple power sources and avoiding issues if a power supply does fail, but that is not the focus of the question. A managed power distribution unit (PDU) provides remote management and power monitoring but will not prevent power loss in an outage.
Mia is a network administrator for a bank. She is responsible for secure communications with her company’s customer website. Which of the following would be the best for her to implement?
SSL
PPTP
IPSec
TLS
D. Transport Layer Security (TLS) provides a reliable method of encrypting web traffic. It supports mutual authentication and is considered secure. Although Secure Sockets Layer (SSL) can encrypt web traffic, TLS was created in 1999 as its successor. Although many network administrators still use the term SSL, in most cases today what you are using is actually TLS, not the outdated SSL. Point‐to‐point Tunneling Protocol (PPTP) and Internet Protocol Security (IPSec) are protocols for establishing a VPN, not for encrypting web traffic.
Elaine wants to adopt appropriate response and recovery controls for natural disasters. What type of control should she use to prepare for a multi‐hour power outage caused by a tornado?
A hot site
A generator
A PDU
A UPS
B. A generator is the most appropriate answer to a multi‐hour outage. Although a hot site would allow her organization to stay online, the cost of a hot site is much higher than that of a generator. A PDU, or power distribution unit, is used to manage and distribute power, not to handle power outages. Finally, UPS systems are not typically designed to handle long outages. Instead, they condition power and ensure that systems remain online long enough for a generator to take over providing power.
Mark is responsible for managing his company’s load balancer and wants to use a load‐balancing scheduling technique that will take into account the current server load and active sessions. Which of the following techniques should he choose?
Round‐robin
Weighted response time
Least connection
Source IP hashing
C. Least connection–based load balancing takes load into consideration and sends the next request to the server with the least number of active sessions. Round‐robin simply distributes requests to each server in order, whereas weighted time uses health checks to determine which server responds the most quickly on an ongoing basis and then sends the traffic to that server. Finally, source IP hashing uses the source and destination IP addresses to generate a hash key and then uses that key to track sessions, allowing interrupted sessions to be reallocated to the same server, and thus allowing the sessions to continue.
Ramon is building a new web service and is considering which parts of the service should use Transport Layer Security (TLS). Components of the application include:
Authentication
A payment form
User data, including address and shopping cart
A user comments and reviews section
Where should he implement TLS?
At points 1 and 2, and 4
At points 2 and 3, and 4
At points 1, 2, and 3
At all points in the infrastructure
D. The safest and most secure answer is that Ramon should simply implement TLS for the entire site. Although TLS does introduce some overhead, modern systems can handle large numbers of simultaneous TLS connections, making a secure website an easy answer in almost all cases.
Charles wants to use IPSec and needs to be able to determine the IPSec policy for traffic based on the port it is being sent to on the remote system. Which IPSec mode should he use?
IPSec tunnel mode
IPSec PSK mode
IPSec IKE mode
IPSec transport mode
D. Unlike IPSec’s tunnel mode, IPSec transport mode allows different policies per port. The IP addresses in the outer header for transport mode packets are used to determine the policy applied to the packet. IPSec doesn’t have a PSK mode, but WPA2 does. IKE is used to set up security associations in IPSec but doesn’t allow this type of mode setting.
What two connection methods are used for most geofencing applications?
Cellular and GPS
USB and Bluetooth
GPS and Wi‐Fi
Cellular and Bluetooth
C. Global Positioning System (GPS) data and data about local Wi‐Fi networks are the two most commonly used protocols to help geofencing applications determine where they are. When a known Wi‐Fi signal is gained or lost, the geofencing application knows it is within range of that network. GPS data is even more useful because it can work in most locations and provide accurate location data. Although Bluetooth is sometimes used for geofencing, its limited range means that it is a third choice. Cellular information would require accurate tower‐based triangulation, which means it is not typically used for geofencing applications, and of course USB is a wired protocol.
Binary data is an example of what type of data?
Non‐human‐readable
Encrypted
Human‐readable
Masked
A. Binary data is a form of non‐human‐readable data. Encrypted data may be in binary format, but not all binary data is encrypted. Binary data is not human‐readable, nor is it masked, which hides elements of data to allow for it to be used without exposing the underlying data.
Tom is responsible for VPN connections in his company. His company uses IPSec for VPNs. What is the primary purpose of AH in IPSec?
Encrypt the entire packet.
Encrypt just the header.
Authenticate the entire packet.
Authenticate just the header.
C. Authentication headers (AHs) provide complete packet integrity, authenticating the packet and the header. Authentication headers do not provide any encryption at all, and authentication headers authenticate the entire packet, not just the header.
Abigail is responsible for setting up a network‐based intrusion prevention system (NIPS) on her network. The NIPS is located in one particular network segment. She is looking for a passive method to get a copy of all traffic to the NIPS network segment so that it can analyze the traffic. Which of the following would be her best choice?
Using a network tap
Using port mirroring
Setting the NIPS on a VLAN that is connected to all other segments
Setting up a NIPS on each segment
A. Network taps copy all traffic to another destination, allowing traffic visibility without a device inline. They are completely passive methods of getting network traffic to a central location. Port mirroring would get all the traffic to the network‐based intrusion prevention system (NIPS) but is not completely passive. It requires the use of resources on switches to route a copy of the traffic. Incorrect switch configurations can cause looping. Configuring loop detection can prevent looped ports. Putting a network NIPS on every segment can be very expensive and require extensive configuration work. Setting up a NIPS on each segment would also dramatically increase administrative efforts.
Janice is explaining how IPSec works to a new network administrator. She is trying to explain the role of IKE. Which of the following most closely matches the role of IKE in IPSec?
It encrypts the packet.
It establishes the SAs.
It authenticates the packet.
It establishes the tunnel.
B. Internet key exchange (IKE) is used to set up security associations (SAs) on each end of the tunnel. The security associations have all the settings (i.e., cryptographic algorithms, hashes) for the tunnel. IKE is not directly involved in encrypting or authenticating. IKE itself does not establish the tunnel—it establishes the SAs.
Emily manages the IDS/IPS for her network. She has a network‐based intrusion prevention system (NIPS) installed and properly configured. It is not detecting obvious attacks on one specific network segment. She has verified that the NIPS is properly configured and working properly. What would be the most efficient way for her to address this?
Implement port mirror/monitor mode for that segment.
Install a NIPS on that segment.
Upgrade to a more effective NIPS.
Isolate that segment on its own VLAN.
A. The NIPS is not seeing the traffic on that network segment. By implementing port mirroring, the traffic from that segment can be copied to the segment where the NIPS is installed. Installing a network IPS on the segment would require additional resources. This would work but is not the most efficient approach. Nothing in this scenario suggests that the NIPS is inadequate. It just is not seeing all the traffic. Finally, isolating the segment to its own VLAN would isolate that network segment but would still not allow the NIPS to analyze the traffic from that segment.
Claire has been notified of a zero‐day flaw in a web application. She has the exploit code, including a SQL injection attack that is being actively exploited. How can she quickly react to prevent this issue from impacting her environment if she needs the application to continue to function?
Deploy a detection rule to her IDS.
Manually update the application code after reverse‐engineering it.
Deploy a fix via her WAF.
Install the vendor‐provided patch.
C. Claire’s best option is to deploy a detection and fix via her web application firewall (WAF) that will detect the SQL injection (SQLi) attempt and prevent it. An intrusion detection system (IDS) only detects attacks and cannot stop them. Manually updating the application code after reverse‐engineering it will take time, and she may not even have the source code or the ability to modify it. Finally, vendor patches for zero days typically take some time to come out even in the best of circumstances, meaning that Claire could be waiting on a patch for quite a while if that is the option she chooses.
Next‐generation firewalls include many cutting‐edge features. Which of the following is not a common next‐generation firewall capability?
Geolocation
IPS and/or IDS
Sandboxing
SQL injection
D. Although next‐generation firewalls (NGFWs) provide may defensive capabilities, SQL injection (SQLi) is an attack instead of a defense. In addition to geolocation, intrusion detection system (IDS) and intrusion prevention system (IPS), and sandboxing capabilities, many next‐generation firewalls include web application firewalls, load balancing, IP reputation and URL filtering, and antimalware and antivirus features.
Jason is considering deploying a network intrusion prevention system (IPS) and wants to be able to detect advanced persistent threats (APTs). What type of IPS detection method is most likely to detect the behaviors of an APT after it has gathered baseline information about normal operations?
Signature‐based IPS detections
Heuristic‐based IPS detections
Malicious tool hash IPS detections
Anomaly‐based IPS detections
D. Anomaly‐based detection systems build a behavioral baseline for networks and then assess differences from those baselines. They may use heuristic capabilities on top of those, but the question specifically asks about baselined operations pointing to an anomaly‐based system. Heuristic‐based detections look for behaviors that are typically malicious, and signature‐based or hash‐based detections look for known malicious tools or files.
Jerome needs to explain the key difference between high availability and fault tolerance to his management. What is the major difference between the two?
High availability is designed to avoid service interruptions almost entirely, whereas fault‐tolerant environments have minimal service disruptions.
High availability provides services, whereas fault tolerance handles issues.
High availability focuses on data, whereas fault tolerance focuses on infrastructure.
High availability has minimal service interruptions, whereas fault‐tolerant environments are designed to avoid service interruptions almost entirely.
D. High‐availability designs are less expensive because they attempt to minimize service interruptions, whereas fault‐tolerant designs seek to avoid service interruptions almost entirely, and thus cost significantly more. Both focus on service availability and typically use both hardware and software tools to meet their goals.
Mateo wants to conduct a fail over test for his datacenter. What will he need to do to accomplish this?
Turn off all systems in his datacenter.
Simulate what would occur during a datacenter outage.
Force a fail over using his network or other systems.
Cause an outage of a critical system.
C. Datacenters should have a fail over process that can be manually executed in case of emergency. Mateo should use that process to fail over to his organization’s fail over site. Turning off every system in a datacenter is not recommended as this may lead to other unexpected failures. Simulation is not a fail over test, and creating an outage of a critical system typically will not cause an entire datacenter to fail over.
Brandon deploys a server in a VLAN used for IoT devices. He then creates firewall rules that allow users in a system administration network to SSH to that server so that they can manage systems in the protected network segment. What type of solution has Brandon deployed?
A UTM
A jump server
An ICS server
A VPN
B. Jump servers are used to access secured zones and are typically carefully controlled and monitored because they are the single point of entry from untrusted environments. A Unified Threat Management (UTM) is a security device that combines firewall features with a variety of other security functions. ICS stands for Industrial Control System. This is not an ICS, although the IoT devices it allows connections to may be a form of ICS. VPNs, or virtual private networks, encapsulate and protect network traffic as it moves through untrusted networks.
What key network technology is the core of an SASE implementation?
TLS
VLANs
IPSec
SD‐WAN
D. Software‐defined wide area networks (SD‐WANs) are the core component of secure access, secure edge technology. Additional tools like zero trust functionality, cloud access security brokers, and firewalls are all combined to build a complete SASE implementation.
