2.5 Determine Resources for Industry Standards and Recommendations for Hardening of Systems 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which cloud environment hardening measure is primarily used to detect suspicious activities and potential security incidents?

   • AEnabling comprehensive logging and monitoring
   • BEncrypting data in transit using TLS
   • CApplying security groups to restrict network traffic
   • DUsing multi-factor authentication (MFA)
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A network engineer is configuring a new Cisco IOS router that will be deployed at a branch office. The router will be managed remotely. Which set of configuration practices aligns with industry hardening recommendations?

   • AEnable SSH, disable Telnet, and use role-based access control for administrative accounts
   • BDisable all management protocols and rely on console access only
   • CUse HTTP for management and allow all IP addresses to access the router
   • DEnable Telnet for legacy support and use a simple community string for SNMP
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security consultant is asked to create a hardening plan for a small organization that has a mix of Windows and Linux servers, a few Cisco switches, and a web application. The organization has no dedicated security staff and a limited budget. The consultant must prioritize actions that provide the greatest risk reduction with the least operational overhead. Which approach is most appropriate?

   • APurchase an expensive SIEM solution and deploy agents everywhere
   • BApply full CIS Benchmarks to every system immediately
   • CImplement a patch management process and enforce strong authentication (MFA) for all administrative access
   • DDisable all inbound firewall rules on every device
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A network administrator is hardening a switch that connects to multiple VLANs. Which configuration is most important to prevent unauthorized VLAN hopping?

   • ASet all ports to trunk mode
   • BDisable DTP and set all access ports to static access mode
   • CUse the default VLAN for all access ports
   • DEnable CDP on all ports
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security architect is hardening a mixed environment of Windows servers, Linux servers, and Cisco network devices. The organization must comply with a regulatory framework that requires baseline configurations to be reviewed and approved by a change advisory board (CAB) before implementation. The architect has limited staff and must choose a single framework to use as the primary source for all baselines. Which framework is the most appropriate choice?

   • AMicrosoft Security Baselines
   • BCisco SAFE Reference Guide
   • CDISA STIGs
   • DCIS Benchmarks
   Reveal Solution Discussion Select an answer first