Define Essential Security Principles 100-160 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security architect is designing a multi-layered defense for a web application. The architect implements a web application firewall (WAF), network segmentation, and database encryption. However, the application still has a critical vulnerability that could allow an attacker to bypass the WAF. Which additional control would most effectively complement the existing layers to protect the application?

   • ADeploy additional WAF instances in parallel.
   • BMove the application to a different network segment.
   • CIncrease the logging and monitoring of the WAF.
   • DImplement application-level input validation and parameterized queries.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company operates a legacy application that is critical to business operations. The application has a known vulnerability that cannot be patched because the vendor no longer supports it. The company has implemented network segmentation, strict access controls, and an intrusion detection system to protect the application. Which statement best describes the residual risk after these controls are implemented?

   • AThe risk is eliminated because the controls prevent all possible attacks.
   • BThe risk is unchanged because the vulnerability is still present.
   • CThe risk is transferred to the intrusion detection system.
   • DThe risk is reduced but not eliminated because the vulnerability remains exploitable.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company discovers that a competitor has been stealing its proprietary product designs. The investigation reveals that the attacker used spear-phishing emails to trick an engineer into revealing credentials, then accessed the design repository. What is the most likely primary motivation behind this attack?

   • AHacktivism
   • BRevenge
   • CCorporate espionage
   • DFinancial gain
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A hospital's patient portal is hit by a ransomware attack that encrypts all medical records. The IT team restores the data from backups, but the restoration process takes 12 hours, during which clinicians cannot access patient histories. Which part of the CIA triad is most directly impacted?

   • AAvailability
   • BNon-repudiation
   • CIntegrity
   • DConfidentiality
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which scenario best illustrates defense-in-depth?

   • AA company encrypts all data but has no other security measures
   • BA company relies solely on a strong password policy
   • CA company uses a firewall, antivirus software, and employee security training to protect its network
   • DA company uses only a firewall to protect its network
   Reveal Solution Discussion Select an answer first