Objective 3.4 Protect Networks and Systems. CYBERSEC-FIRST-RESPONDER Practice Questions (Page 8)

Questions 36–38

1. 36foundation · easy

   What is the primary reason to apply software updates regularly?

   • ATo comply with user preferences
   • BTo mitigate known vulnerabilities that could be exploited by attackers
   • CTo add new features that users request
   • DTo increase the system's processing speed
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company's web application is hosted in a public cloud VNet with a public IP. The security team wants to restrict inbound traffic to only HTTPS (443) from the internet, while allowing the application tier to communicate with the database tier on a private subnet. They also want to hide the database server's existence from external scans. Which combination of controls should they implement?

   • APlace both web and database servers in the same subnet, and use an NSG on that subnet allowing only 443 from the internet and 1433 from the web server's private IP.
   • BApply a network security group (NSG) to the web subnet allowing only 443 from the internet, and place the database in a separate subnet with no public IP and an NSG allowing only 1433 from the web subnet.
   • CConfigure a host-based firewall on the web server to allow only 443, and give the database server a public IP with an NSG allowing only the web server's IP on 1433.
   • DApply an NSG to the database subnet allowing only 1433 from the internet, and place the web server in the same subnet to reduce complexity.
   Reveal Solution Discussion Select an answer first
3. 38expert · hard

   A security admin needs to apply a critical security patch to a production web server. The change management policy requires a rollback plan and a maintenance window. The patch is known to break a legacy authentication module, but the vendor has released a workaround. The admin has a 2-hour maintenance window. Which approach best balances security and operational stability?

   • AExtend the maintenance window indefinitely until the legacy module is fully rewritten to be compatible.
   • BSkip the patch and rely on the existing compensating controls until the legacy module is replaced.
   • CApply the patch without the workaround, and fix the authentication module after the maintenance window.
   • DApply the patch in the maintenance window, apply the vendor workaround, and have a tested rollback plan ready in case the workaround fails.
   Reveal Solution Discussion Select an answer first