2.5 Determine Resources for Industry Standards and Recommendations for Hardening of Systems 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security consultant is asked to harden a network of industrial control system (ICS) devices that cannot be patched frequently. Which standard is most appropriate to guide the hardening effort?

   • APCI DSS
   • BNIST SP 800-123
   • CISA/IEC 62443
   • DCIS Benchmarks for Windows Server
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which cloud hardening practice is most directly focused on ensuring that only authorized users can access cloud resources?

   • AImplementing strong identity and access management (IAM) policies
   • BEnabling encryption for data at rest
   • CUsing a virtual private cloud (VPC) for network isolation
   • DSetting up monitoring and logging
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is deploying a new Linux web server that will be publicly accessible. The security team wants to reduce the attack surface while maintaining functionality. Which hardening action should be prioritized?

   • AInstall a host-based intrusion detection system
   • BConfigure a centralized log server
   • CDisable all unused services and close unnecessary ports
   • DEnable SELinux in enforcing mode
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is migrating a legacy application to AWS. The security team wants to harden the cloud environment. Which combination of controls is most aligned with the principle of least privilege?

   • AUse the root account for all administrative tasks
   • BUse IAM roles with scoped permissions and enable MFA for all users
   • CGrant all users full access to all S3 buckets
   • DDisable CloudTrail to reduce costs
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A network team is hardening a set of Cisco switches that carry both production and management traffic. The team wants to ensure that management traffic is isolated and that the switches are resilient to unauthorized access. They have a limited number of available VLANs. Which approach best meets these requirements?

   • ACreate a dedicated management VLAN and restrict SSH access to that VLAN via ACLs
   • BUse the native VLAN for management traffic
   • CAllow management traffic on all VLANs
   • DDisable SSH and use Telnet for management
   Reveal Solution Discussion Select an answer first