Q1. A multinational corporation has recently deployed a new cloud-based application that handles sensitive customer PII. During a penetration test, the testers discovered that the application logs contain cleartext credentials that are used for accessing backend databases. The CISO wants to ensure that these credentials are not exposed in future logs while maintaining auditability. Which of the following security controls is MOST appropriate to implement first?
-
Implement a Web Application Firewall (WAF) to filter log entries.
-
Deploy a Security Information and Event Management (SIEM) system for log aggregation and analysis.
-
Configure the application to encrypt or tokenize sensitive data before logging. ✓ Correct
-
Enforce stricter access controls on the log storage system.
Why: The most critical first step is to prevent the sensitive data from being logged in the first place. Encrypting or tokenizing credentials before they are written to logs directly addresses the root cause of the vulnerability. While a WAF could potentially filter logs, it's a reactive measure that might miss some entries and doesn't fix the application's insecure logging practice. A SIEM system is excellent for aggregating and analyzing logs, but it doesn't prevent the initial insecure logging of credentials. Stricter access controls on log storage are important for protecting the logs themselves but do not address the content of the logs.
Q2. A financial services company is undergoing a compliance audit and needs to demonstrate strong data protection for customer financial records stored on-premises. The auditors are particularly concerned about unauthorized access and modification of these records. The company wants to implement a control that provides data at rest encryption and integrity checks. Which of the following technologies BEST meets these requirements?
-
Transport Layer Security (TLS) with perfect forward secrecy.
-
Full-disk encryption (FDE) with hardware-based key management. ✓ Correct
-
Database Activity Monitoring (DAM).
-
Network Access Control (NAC) solutions.
Why: Full-disk encryption (FDE) provides data at rest encryption, ensuring that if the physical storage media is compromised, the data remains unreadable. Hardware-based key management enhances security by protecting the encryption keys. FDE also inherently helps maintain data integrity by making unauthorized modifications detectable if the disk is tampered with. TLS is primarily for data in transit, not at rest. Database Activity Monitoring focuses on detecting suspicious database operations, not encrypting the data itself. Network Access Control is about managing device access to the network, not protecting data stored on endpoints or servers.
Q3. A manufacturing firm has experienced several incidents where proprietary design files were leaked externally. An investigation revealed that an insider with legitimate access repeatedly copied sensitive files to an external USB drive. The security team needs to implement a control to prevent such data exfiltration while allowing necessary data transfers. What is the MOST effective solution?
-
Implement a Data Loss Prevention (DLP) solution. ✓ Correct
-
Deploy host-based intrusion detection systems (HIDS).
-
Increase the frequency of security awareness training.
-
Conduct more frequent security audits of user activity.
Why: A Data Loss Prevention (DLP) solution is specifically designed to monitor and control the flow of sensitive data, preventing it from leaving the organization's control through unauthorized channels like USB drives. It can identify sensitive data patterns and block or alert on exfiltration attempts. While HIDS can detect suspicious activity on a host, it's not as effective at proactively preventing data exfiltration. Increased training and audits are important supplementary measures but are reactive and less reliable than a technical control designed to block the action itself.
Q4. A cybersecurity team is reviewing the security architecture of a web application that handles online payment transactions. They are concerned about potential vulnerabilities that could allow attackers to intercept or modify payment data in transit. Which architectural security principle should be prioritized to mitigate this risk?
-
Least privilege.
-
Defense in depth.
-
Secure defaults.
-
Encryption in transit. ✓ Correct
Why: Encryption in transit, typically using protocols like TLS/SSL, is the primary method to protect sensitive data like payment information as it travels between the client and the web server, preventing interception and modification. While least privilege, defense in depth, and secure defaults are all critical security principles, they address different aspects of security and do not directly prevent the eavesdropping or tampering of data during transmission.
Q5. A company's internal development team is building a new customer-facing API. Security best practices dictate that the API should be designed to prevent common web vulnerabilities. Which of the following design considerations is MOST critical for mitigating risks like injection attacks (e.g., SQLi, XSS) and broken authentication?
-
Implementing rate limiting on all API endpoints.
-
Validating and sanitizing all user inputs. ✓ Correct
-
Using OAuth 2.0 for all authentication and authorization.
-
Deploying the API behind a reverse proxy.
Why: Validating and sanitizing all user inputs is the fundamental control for preventing injection attacks, as it ensures that malicious code or unexpected data cannot be executed or interpreted in unintended ways. While rate limiting, using OAuth 2.0, and deploying behind a reverse proxy are important security measures, they address different threat vectors (DoS, authentication/authorization respectively) and do not directly prevent the underlying vulnerability of unsanitized input, which is the direct cause of injection flaws.
Q6. A security architect is designing the network infrastructure for a new research facility that handles highly sensitive intellectual property. The facility has multiple departments with varying security needs and data access requirements. To minimize the blast radius of a potential security breach and enforce granular access controls between departments, which architectural approach is MOST recommended?
-
Implement a flat network with broad access.
-
Deploy a single, large subnet for the entire facility.
-
Implement micro-segmentation. ✓ Correct
-
Utilize a perimeter-based security model exclusively.
Why: Micro-segmentation divides the network into small, isolated security zones, down to the individual workload level. This drastically limits lateral movement by attackers if one segment is compromised, effectively minimizing the blast radius and allowing for granular policy enforcement between segments, aligning perfectly with the requirements for different departments with varying needs. A flat network or a single large subnet provides the opposite of the desired isolation. A perimeter-based model alone is insufficient for internal threats or breaches that bypass the perimeter.
Q7. A company is concerned about the security posture of its IoT devices deployed in various remote locations. These devices communicate with a central management server, and some of them have limited processing power and memory, making complex cryptographic operations challenging. Which security principle should be prioritized when selecting and configuring security controls for these devices?
-
Defense in depth.
-
Zero trust.
-
Resource optimization. ✓ Correct
-
Least privilege.
Why: Given the constraints of IoT devices (limited processing power and memory), resource optimization is the paramount principle. Security controls must be efficient enough to run on these devices without significantly impacting performance or battery life. While defense in depth, zero trust, and least privilege are essential security concepts, their implementation on resource-constrained IoT devices requires careful consideration of their computational overhead, making resource optimization the primary guiding principle for selecting appropriate controls.
Q8. A multinational corporation is deploying a new cloud-based application that will store sensitive customer PII. The company's security policy mandates that all data at rest must be encrypted using strong cryptographic algorithms and managed under a robust key management system. Which of the following architectural considerations is MOST critical for meeting these requirements while ensuring the application remains accessible to authorized users?
-
Implementing a hardware security module (HSM) for key generation and storage and integrating it with the cloud provider's encryption services. ✓ Correct
-
Deploying a virtual private network (VPN) for all access to the cloud environment to encrypt data in transit.
-
Configuring a demilitarized zone (DMZ) between the on-premises network and the cloud application for network segmentation.
-
Implementing regular vulnerability scans on the cloud infrastructure to identify and patch potential weaknesses.
Why: The question focuses on encrypting data at rest and managing keys in a cloud environment. An HSM provides a secure, dedicated hardware device for cryptographic operations, including secure key generation, storage, and management, which is critical for meeting stringent security policies regarding sensitive data. While a VPN encrypts data in transit and a DMZ provides network segmentation, neither directly addresses the security of data at rest or the management of encryption keys. Regular vulnerability scans are essential for security hygiene but do not fulfill the specific requirement of robust key management for encrypted data at rest.
Q9. A company is designing a secure network architecture for its branch offices, which will connect to the central data center over the public internet. The architecture must provide confidentiality, integrity, and authentication for all traffic between the branches and the data center. Which of the following solutions BEST addresses these requirements by creating a secure tunnel?
-
IPsec VPN ✓ Correct
-
SSL/TLS
-
SSH
-
WPA3
Why: An IPsec VPN is specifically designed to create secure tunnels over untrusted networks like the internet, providing confidentiality (encryption), integrity (hashing), and authentication for network traffic between sites. SSL/TLS is primarily used for securing application-layer traffic, such as web browsing, and while it provides similar security guarantees, it's not the primary solution for securing entire network connections between offices. SSH is used for secure remote command-line access and tunneling specific applications, not for site-to-site VPNs. WPA3 is a security protocol for wireless networks and is not applicable to securing connections over the public internet between branch offices and a data center.
Q10. A security architect is tasked with designing a system to prevent unauthorized users from escalating their privileges on critical servers. The system should monitor user activity, detect suspicious behavior, and automatically revoke privileges if policy violations are identified. Which of the following security controls is MOST appropriate for this scenario?
-
Privileged Access Management (PAM) solution ✓ Correct
-
Intrusion Detection System (IDS)
-
Data Loss Prevention (DLP) system
-
Security Information and Event Management (SIEM) system
Why: A Privileged Access Management (PAM) solution is specifically designed to control, monitor, and secure accounts with elevated privileges, including features for detecting suspicious behavior and revoking access when policy violations occur. An IDS focuses on detecting network intrusions and malicious activity but doesn't inherently manage or revoke privileged access. A DLP system is designed to prevent sensitive data from leaving the organization's control, which is a different security objective. While a SIEM system collects and analyzes logs from various sources, including privileged access attempts, it typically requires integration with other systems (like PAM) to automatically revoke privileges based on detected activity.