1.5 Describe the Principles of the Defense-In-Depth Strategy 200-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company is deploying a new application on a server. The security team wants to protect the host, but the application requires a large number of open ports and the server is managed by a separate team that is slow to apply patches. Which host-based defense-in-depth approach is most effective given these constraints?

   • ARequire all administrators to use a jump host and log all administrative sessions.
   • BInstall the latest antivirus and schedule a full scan every night.
   • CUse a host-based firewall that allows only the specific ports required by the application, and implement application whitelisting to prevent unauthorized executables.
   • DRely on the network firewall to protect the server and disable the host-based firewall to avoid conflicts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is deciding whether to implement a defense-in-depth strategy. The CFO is concerned about the budget. Which benefit of defense-in-depth should the security team highlight to justify the investment?

   • ADefense-in-depth guarantees that all attacks will be blocked.
   • BDefense-in-depth reduces the total cost of security by using fewer tools.
   • CIncreased resilience: if one control fails, other layers still provide protection, reducing the likelihood of a successful attack.
   • DDefense-in-depth eliminates the need for security monitoring.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A development team is building a new application that will handle sensitive customer data. The security team wants to ensure that the application is secure from the start. However, the development team is concerned that adding security measures will delay the release. Which approach best balances security and development speed?

   • ASkip security testing to meet the release deadline and address issues after launch.
   • BDevelop the application first and perform a security assessment just before release.
   • CIntegrate security into the development lifecycle, such as using secure coding standards, code reviews, and automated security testing.
   • DRely on a web application firewall to protect the application after deployment.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is designing a new network for a branch office. They want to protect against both external attacks and internal threats. Which set of network security controls best implements defense-in-depth?

   • APerimeter firewall, internal segmentation, an IPS, and VPN for remote access.
   • BA VPN concentrator for all remote users and a host-based firewall on every endpoint.
   • CNetwork segmentation with VLANs and strict ACLs between segments.
   • DA single next-generation firewall at the internet edge with all features enabled.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network administrator is configuring a new DMZ for public-facing web servers. The administrator wants to ensure that even if a web server is compromised, the internal corporate network remains protected. Which network design best supports this goal?

   • APut the web servers on the internal network and rely on host-based firewalls to protect them.
   • BConnect the web servers directly to the internet without any firewall, but use strong encryption.
   • CPlace the web servers in a DMZ with a firewall between the DMZ and the internal network, and restrict outbound traffic from the DMZ.
   • DUse a single firewall with the web servers on the same interface as internal users.
   Reveal Solution Discussion Select an answer first