1.5 Describe the Principles of the Defense-In-Depth Strategy 200-201 Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization has a fleet of laptops used by remote employees. The security team wants to ensure that a single compromised laptop does not lead to a full domain compromise. Which set of host-based controls best supports this defense-in-depth objective?

   • AApply a group policy that disables USB ports and restricts software installation to approved applications.
   • BEnsure the laptop is joined to the domain and use a centralized patch management solution to deploy updates weekly.
   • CEnable full-disk encryption, enforce a host-based firewall that blocks inbound connections, and require multi-factor authentication for all administrative access.
   • DInstall a single endpoint protection product and configure it to automatically quarantine any detected malware.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which set of controls is commonly used to apply defense-in-depth to host security?

   • AEndpoint protection, patch management, and host-based firewalls
   • BNetwork segmentation, VPN, and IDS/IPS
   • CSecure coding, encryption, and access controls
   • DLocks, guards, and biometric scanners
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is designing its network security architecture. The security team wants to ensure that if the perimeter firewall is bypassed, the internal network is still protected. Which approach best applies defense-in-depth to network security?

   • AEnable logging on all network devices and review logs monthly.
   • BDeploy an internal firewall between network segments, enable an IDS/IPS to monitor traffic, and use VLAN segmentation to isolate sensitive systems.
   • CUse a single next-generation firewall at the internet edge with all internal systems on the same flat network.
   • DImplement a VPN for remote access and require all employees to use it when working from home.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A security analyst is investigating a series of malware infections on employee laptops. The infections occur even though the company has a next-generation firewall, an email filter, and endpoint antivirus. The analyst suspects that the malware is being introduced via USB drives. Which additional control would best address this gap in the defense-in-depth strategy?

   • ARequire all employees to change their passwords every 30 days.
   • BDeploy a network-based intrusion prevention system to detect USB-borne malware.
   • CImplement endpoint device control to block or restrict the use of USB storage devices.
   • DIncrease the frequency of antivirus signature updates on all endpoints.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security architect is designing network security for a company that must balance strong security with operational simplicity. The company has a limited security team and cannot manage many complex tools. Which approach best applies defense-in-depth while respecting the constraint of limited operational resources?

   • AUse a variety of best-of-breed security products from different vendors, each with its own management console.
   • BImplement network segmentation with a few well-configured internal firewalls, enable a host-based firewall on critical servers, and use a single centralized logging solution.
   • CDeploy a next-generation firewall at the edge and rely on its advanced features to protect the entire network.
   • DOutsource all security monitoring to a managed security service provider (MSSP) and install no internal controls.
   Reveal Solution Discussion Select an answer first