Random Question 61 - 80 Flashcards
Question 61:
A company wants to implement a secure file transfer protocol between its internal servers and remote offices while ensuring data confidentiality and integrity. Which of the following protocols should be used?
{
“protocol”: [
{
“name”: “SFP”,
“description”: “Secure File Transfer Protocol”
},
{
“name”: “FTP”,
“description”: “File Transfer Protocol”
}
]
}
Options:
A. SFTP.
B. FTP.
C. SCP.
D. HTTPS.
E. SMTP.
Correct Answer: A
Explanation: SFTP uses SSH for secure file transfers, ensuring both confidentiality and integrity of data.
Question 62:
You are tasked with configuring a network to ensure that sensitive data is protected from unauthorized access using IPsec tunnels. Which of the following steps should you take?
tunnel_config:
- protocol: ESP
encryption: AES-256-CBC
authentication: SHA384
Options:
A. Use TCP as the transport protocol.
B. Configure ESP with AES-128-CBC for encryption.
C. Use UDP as the transport protocol.
D. Configure ESP with AES-256-CBC and SHA384 for authentication.
E. Disable IPsec to allow free communication.
**Correct Answer: D **
Explanation: Using ESP (Encapsulating Security Payload) with AES-256-CBC encryption and SHA384 for authentication ensures secure data transfer over the IPsec.
Question 63:
Your organization is transitioning to a Zero Trust Architecture. You need to configure access control policies to ensure that only authorized users can access sensitive resources.
{
“access_control”: {
“application_id”: “app1”,
“permissions”: [
{“user _role”: “admin”, “allowed _actions”: [“read”,”write”] },
{“user _role”: “viewer”, “allowed _actions”: [“read”] }
]
}
}
Options:
A. Assign admin role to all users.
B. Restrict access based on user roles and necessary permissions.
C. Allow read/write actions for everyone.
D. Grant write-only permissions to users who need them.
E. Remove all permissions and re-evaluate every request.
Correct Answer: B, D
Explanation: Least privilege requires granting only the minimum necessary permissions; admin role should have both read and write access while viewers should have only read access. Write-only permissions can be granted as needed but must align with the principle of least privilege.
Question 64:
You are configuring a network security policy for a hybrid cloud environment that requires strict data governance and compliance adherence. You need to ensure that all communications between on-premises resources and cloud services use secure channels.
{
“security_policy”: {
“cloud_provider”: “AWS”,
“encryption_method”: “TLS1.2”,
“communication_type”: [“data_transfer”, “API_calls”]
}
}
Options:
A. Use TLS1.0 for on-premises to cloud communications.
B. Enable data transfer and API calls encryption.
C. Configure no specific security measures.
D. Limit cloud provider to a single vendor only.
E. Disable all network traffic between on-premises and cloud.
Correct Answer: B
Explanation: Using TLS1.2 ensures secure communication, and enabling both data transfer and API calls encryption is necessary for compliance.
Question 65:
Your organization wants to implement a password policy that aligns with industry best practices to enhance account security. Which of the following steps should be included in your policy?
{
“password_policy”: {
“min_length”: 12,
“require_special _characters”: true,
“expire_after _days”: 90
}
}
Options:
A. Set minimum password length to 8 characters.
B. Require special characters in passwords.
C. Disable password expiration for all users.
D. Allow passwords to contain common words only.
E. Enforce a 12-character minimum length.
Correct Answer: B, E
Explanation: Requiring special characters and setting a minimum password length of 12 characters are key components of strong password policies.
Question 66:
You need to configure network security settings for an organization’s remote access solution to ensure that all user sessions are encrypted and secure. Which of the following actions should you take?
{
“remote_access”: {
“encryption_protocol”: “TLS1.3”,
“authentication_method”: [“two _factor_auth”
“certificates”]
}
}
Options:
A. Use TLS1.2 for encryption.
B. Enable two-factor authentication and certificate-based login.
C. Disable all remote access sessions.
D. Allow clear-text password transmission.
E. Configure a single-factor authentication method.
Correct Answer: B
Explanation: Using TLS1.3 for encryption and enabling both two-factor authentication and certificates provide robust security for remote access
Question 67:
You are tasked with securing a hybrid cloud environment that involves both on-premises infrastructure and AWS services. You need to ensure secure data transfer between these environments while adhering to compliance requirements.
{
“security_policy”: {
“cloud_provider”: “AWS”,
“data_transfer_encryption”: true,
“compliance_standards”: [“PCI-DSS”, “GDPR”]
}
}
Options:
A. Disable data transfer encryption.
B. Enable data transfer encryption using TLS1.2.
C. Exclude compliance standards for simplicity.
D. Use only AWS services without on-premises integration.
E. Implement no security measures.
**Correct Answer: B, E **
Explanation: Enabling data transfer encryption ensures secure communication, but implementing no security measures is not advisable for compliance.
Question 68:
Your organization needs to implement a strong password policy that aligns with industry best practices. Which of the following steps should be included in your policy?
{
“password_policy”: {
“min _length”: 12,
“require_special_characters”: true,
“expire_after _days”: 90
}
}
Options:
A. Set minimum password length to 8 characters.
B. Require special characters in passwords.
C. Disable password expiration for all users.
D. Allow common words and easily guessable phrases.
E. Enforce a 12-character minimum length.
Correct Answer: B, E
Explanation: Requiring special characters and setting a minimum password length of 12 characters are key components of strong password policies.
Question 9:
You are setting up a firewall rule to protect sensitive data from unauthorized access in a multi-tenant environment.
Which of the following rules should you implement?
{
“firewall _rules”: {
“protocol”: “TCP”,
“source_ip_range”: [“192.168.0.0/24”],
“destination_ip_range”: [“172.31.0.0/16”],
“port_range”: [80, 443]
}
}
Options:
A. Allow all IP ranges and protocols.
B. Block all traffic to the destination range.
C. Permit TCP protocol from a specific source IP range to a specific destination range on certain ports.
D. Disable firewall rules for simplicity.
E. Apply random port ranges.
Correct Answer: C
Explanation: Permitting TCP traffic from a specific source IP range to a specific destination range on specific ports is the correct approach for securing sensitive.
Question 70:
A company is migrating its critical applications to a cloud environment and needs to ensure high availability and disaster recovery. Which two strategies should be implemented?
Options:
A. Implementing cold storage for backups.
B. Utilizing multi-region deployments.
C. Configuring load balancers with health checks.
D. Enforcing strict access controls using IAM policies.
E. Deploying a single cloud instance for efficiency.
Correct Answer: B, C
Explanation: Multi-region deployments ensure high availability and disaster recovery by distributing resources across multiple geographic locations. Load balancers with health checks help maintain service continuity and monitor application.
Question 71:
An organization is facing frequent security incidents due to misconfigured network devices. Which two configuration steps should be prioritized to enhance network security?
Options:
A. Disabling unnecessary services on servers.
B. Regularly updating firmware and software on devices.
C. Configuring default deny firewall rules.
D. Implementing strong password policies for end-users.
E. Conducting bi-weekly security audits.
Correct Answer: B, C
Explanation: Regularly updating firmware and software ensures that network devices are protected against known vulnerabilities. Default deny firewall rules help prevent unauthorized access by blocking all traffic not explicitly allowed.
Question 72:
A security analyst is tasked with setting up a secure communication channel for internal messaging between departments. Which configuration should be used?
apiVersion: v1
kind: Secret
metadata:
name: internal-messaging-secret
type: Opaque
data:
password: cGFzc3dvcmQ=
Options:
A. Using an Ingress controller.
B. Creating a Kubernetes secret with encrypted data.
C. Implementing a DMZ for external communications.
D. Deploying a virtual private network (VPN) tunnel.
E. Enforcing strict email policies.
Correct Answer: B
Explanation:
A Kubernetes secret can be used to securely store and manage sensitive information such as passwords. The provided YAML snippet creates a secret with an encrypted password.
Question 73:
A network administrator needs to configure a firewall rule for a new service that requires both inbound and outbound traffic. Which configuration should be used?
- action: allow
ip_protocol: TCP
port_range_min: 80
port_range_max: 80 - action: deny
ip_protocol: TCP
port_range_min: 443
port_range_max: 443
Options:
A. Allow all inbound traffic.
B. Deny all outbound traffic.
C. Allow specific inbound and outbound ports.
D. Deny specific inbound and outbound ports.
E. Allow all traffic.
Correct Answer: C
Explanation:
The configuration should allow specific inbound (80) and outbound (443) TCP ports, ensuring that only necessary traffic is permitted while blocking others.
Question 74:
A company wants to implement a Zero Trust Architecture for its cloud services. Which two measures are essential in ZTA?
Options:
A. Multi-factor authentication (MFA)
B. Network segmentation
C. Regular security audits
D. Intrusion detection systems (IDS)
E. Strong password policies
Correct Answer: A, B
Explanation:
Multi-factor authentication and network segmentation are fundamental to Zero Trust Architecture, ensuring that only authorized entities can access resources while maintaining strict controls on internal traffic.
Question 75:
In implementing a Zero Trust architecture, which of the following best represents the fundamental principle of the Data Plane?
Options:
A. Manages authentication and authorization decisions.
B. Handles the actual movement of data packets.
C. Implements security policies and procedures.
D. Monitors user access patterns.
Correct Answer: B
Explanation:
The Data Plane in Zero Trust architecture is responsible for the actual movement and processing of data packets after access decisions have been made by the Control Plane.
