1.5 Describe the Principles of the Defense-In-Depth Strategy 200-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is deploying a new web application that will be accessible from the internet. The security team wants to ensure that even if the web server is compromised, the attacker cannot easily pivot to the internal database. Which combination of controls best supports this defense-in-depth goal?

   • APlace the web server in a DMZ, apply a host firewall on the database server, and use network segmentation with ACLs that only allow the web server to reach the database on the required port.
   • BEnable TLS encryption between the web server and the database, and require strong passwords on both servers.
   • CUse a single firewall at the internet edge and place both the web server and database on the same internal subnet.
   • DInstall an antivirus on the web server and the database server, and ensure both are patched weekly.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which combination of network security controls is an example of applying defense-in-depth at the network layer?

   • ALocks, guards, and biometric scanners
   • BSecure coding, encryption, and access controls
   • CFirewall, IDS/IPS, network segmentation, and VPN
   • DAntivirus, patch management, and host-based firewall
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is considering implementing a defense-in-depth strategy. The security team has identified that the strategy will require significant investment in new tools and training. The management is asking for a clear justification. Which statement best describes the trade-off that the security team should present?

   • ADefense-in-depth is only beneficial for organizations that handle highly sensitive data.
   • BThe increased resilience from multiple layers reduces the likelihood of a successful attack, but the complexity and cost of managing many controls are higher.
   • CDefense-in-depth will eliminate the need for incident response because attacks will be prevented.
   • DThe cost of defense-in-depth is always lower than the cost of a single, comprehensive solution.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A small business has 50 Windows workstations and no dedicated security staff. They want to improve host security without adding significant administrative overhead. Which set of measures provides the most comprehensive host-level defense-in-depth?

   • AInstall a third-party antivirus product on each workstation and configure it to scan daily.
   • BDeploy a network-based intrusion prevention system at the internet gateway.
   • CDisable USB ports and restrict administrative access to the local console only.
   • DEnable the built-in Windows Firewall, turn on automatic updates, and enforce standard user accounts for daily work.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A software company develops a customer-facing web application. They want to reduce the risk of data breaches through application vulnerabilities. Which set of practices best applies defense-in-depth to application security?

   • ASecure coding standards, regular penetration testing, a web application firewall, and input validation.
   • BRequire all developers to use two-factor authentication for code commits.
   • CEncrypt all data in the database and use TLS for all connections.
   • DDeploy the application on a hardened operating system with minimal services.
   Reveal Solution Discussion Select an answer first