A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA to comply with internal security policies. Which of the following should the security team recommend?
IPSec with RADIUS is the best option because RADIUS is designed to provide Authentication, Authorization, and Accounting (AAA) services for network access. When combined with IPSec, it allows for secure remote connections that comply with internal security policies requiring AAA.
As part of new compliance audit requirements, multiple servers need to be segmented on different networks and should be reachable only from authorized internal systems. Which of the following would meet the requirements?
A jump server acts as a secure internal gateway to segmented servers, allowing access only from authorized internal systems. It meets compliance needs for access control and network segmentation.
Which of the following describes an agent-based application that detects and blocks malicious behavior on enterprise systems while disconnected from the corporate network?
Endpoint protection uses agents installed on devices to monitor and block malicious behavior locally, even when the system is not connected to the corporate network. Unlike NGFW or HIDS, it provides continuous protection on the endpoint itself.
A company evaluates several options that would allow employees to have remote access to the network. The security team wants to ensure the solution includes AAA to comply with internal security policies. Which of the following should the security team recommend?
IPsec with RADIUS provides a secure remote access solution with Authentication, Authorization, and Accounting (AAA) for compliance.
Which of the following data types relates to data sovereignty?
Data sovereignty refers to the laws and regulations governing where data is stored and which jurisdiction applies. Data at rest outside its country of origin may be subject to foreign legal requirements.
Which of the following is the greatest advantage that network segmentation provides?
Network segmentation creates security zones that help limit the impact of attacks and improve network security.
A security analyst notices unusual behavior on the network. The IDS on the network was not able to detect the activities. Which of the following should the security analyst use to help the IDS detect such attacks in the future?
Signature updates provide the IDS with patterns of known malicious activity, enabling it to detect similar attacks automatically. Regularly updating signatures ensures the IDS can recognize the latest threats. Without current signatures, detection relies on less precise anomaly methods.
Which of the following is the MOST effective control against DDoS attacks?
Content Delivery Networks (CDNs) provide distributed infrastructure that can absorb and mitigate DDoS attacks effectively.
A system administrator instructs the team to deploy a device that protects the host and network from potential attacks and forwards relevant data for further investigation. Which of the following devices meets this requirement?
An Intrusion Prevention System (IPS) is designed to actively protect both hosts and networks by preventing potential attacks. It also sends relevant data for further analysis, making it the most appropriate choice for this requirement.
The company only data center has undervoltage issues. What is the best way to mitigate this type of event?
A UPS (Uninterruptible Power Supply) provides backup power during undervoltage events and ensures that the equipment in the data center continues to function without interruption. It also helps to prevent damage to sensitive electronics from power fluctuations.
A SOC analyst establishes a remote control session on an end user's machine and discovers the following in a file: gmail.com[ENT]my.name@gmail.com[ENT]NoOneCanGuessThis123! [ENT]Hello Susan, it was great to see you the other day! Let's plan a followup[BACKSPACE]follow-up meeting soon. Here is the link to register. [RTN][CTRL]c [CTRL]v [RTN]after[BACKSPACE]After you register give me a call on my cellphone. Which of the following actions should the SOC analyst perform first?
The SOC analyst should advise the user to change passwords immediately, as the email address and password are exposed.
Which of the following options will provide the lowest RTO and RPO for a database?
A hot site provides real-time replication and immediate failover, minimizing both Recovery Time Objective (RTO) and Recovery Point Objective (RPO).
Which of the following would most likely be deployed to obtain and analyze attacker activity and techniques?
A honeypot is a security mechanism designed to attract and analyze attacker activity, allowing organizations to gather intelligence on attack techniques.
A company is in the process of migrating to cloud-based services. The company's IT team has limited experience with cloud security. Which of the following solutions would best meet the company's needs?
SASE (Secure Access Service Edge) integrates networking and security services, providing a comprehensive security solution for organizations adopting cloud services.
The security team has been asked to only enable host A (10.2.2.7) and host B (10.3.9.9) to communicate to the new isolated network segment (10.9.8.1-14) that provides access to legacy devices. Access from all other hosts should be blocked. Which of the following entries would need to be added on the firewall?
The rule should permit both hosts to communicate to the network segment, and deny access to all other hosts.
Quiz Complete!
Domain 3: Security Architecture