1.5 Describe the Principles of the Defense-In-Depth Strategy 200-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is reviewing the company's security architecture and notices that all network traffic is inspected by a single firewall, but there is no internal segmentation or host-based protection. Which principle of defense-in-depth is being violated?

   • AThe firewall is not configured to log all traffic.
   • BRedundancy and diversity of controls are missing, so a single point of failure exists.
   • CThe company is not using an intrusion prevention system (IPS).
   • DThe firewall is not placed at the network perimeter.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is considering implementing a defense-in-depth strategy. The security team is excited, but the operations team is concerned about the operational burden. Which limitation of defense-in-depth should the security team acknowledge?

   • ADefense-in-depth eliminates the need for security awareness training.
   • BDefense-in-depth is only effective for large enterprises with dedicated security teams.
   • CDefense-in-depth requires all controls to be from the same vendor to work together.
   • DMultiple layers increase complexity, which can lead to misconfigurations and higher management overhead.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a defense-in-depth strategy for a financial institution. The architect must balance the need for strong security with the operational cost of managing multiple controls. The institution has a limited security team and a tight budget. Which approach best balances security and operational efficiency?

   • ADeploy as many different security products as possible to maximize coverage, even if some are not fully integrated.
   • BOutsource all security monitoring to a managed security service provider to reduce the burden on the internal team.
   • CUse only open-source security tools to reduce costs, even if they require significant customization.
   • DImplement a few well-chosen controls that cover the most critical risks, and ensure they are properly configured and monitored.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company is experiencing an increase in phishing attacks that are bypassing the email gateway. The security team wants to apply defense-in-depth to reduce the impact of these attacks. Which combination of controls is most effective?

   • ADeploy endpoint detection and response (EDR) on all workstations, implement network segmentation to limit lateral movement, and provide security awareness training to employees.
   • BBlock all email attachments and links at the gateway.
   • CRequire all employees to use a VPN and access email only through a web portal.
   • DUpgrade the email gateway to a more advanced model that uses machine learning to detect phishing.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A development team is deploying a customer-facing web application that handles sensitive personal data. The security team wants to ensure that even if an attacker exploits a vulnerability in the application, the data remains protected. Which combination of application and data security controls best supports this goal?

   • AImplement secure coding practices, encrypt the data at rest and in transit, and enforce role-based access control (RBAC) on the database.
   • BRequire all users to use strong passwords and enable account lockout after five failed attempts.
   • CUse a web application firewall (WAF) and perform regular penetration testing.
   • DStore all data in an encrypted database and back it up daily to an offsite location.
   Reveal Solution Discussion Select an answer first