2.4 Evaluate the Security Controls of an Environment, Diagnose Gaps, and Recommend Improvement 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A company's security policy requires that all external access to internal applications go through a VPN. A review finds that a new web application is directly accessible from the internet without VPN. The application is hosted on a public cloud and is protected by a web application firewall (WAF). What is the most accurate assessment of the control gap?

   • AThe public cloud hosting is the gap, not the access method.
   • BThe WAF provides sufficient protection, so no gap exists.
   • CThe application is exposed to the internet, violating the VPN requirement.
   • DThe application should be moved to on-premises to meet the policy.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   After identifying a gap in security controls, what should be the primary factor in prioritizing the recommended improvements?

   • AThe cost of the control
   • BThe risk and impact of the gap on the organization
   • CThe preference of the security team
   • DThe ease of implementation of the control
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a gap analysis, a security team finds that the organization's SIEM is not receiving logs from a critical database server because the database server's logging is disabled. The team must recommend a control improvement. Which action is the most appropriate?

   • AEnable audit logging on the database server and configure log forwarding to the SIEM.
   • BInstall an agent on the database server to collect logs from the operating system.
   • CConfigure the SIEM to generate alerts when no logs are received.
   • DDeploy a network tap to capture database traffic.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When recommending improvements to security controls, what should the recommendation be based on?

   • AThe budget available for security improvements
   • BThe personal experience of the security analyst
   • CThe identified gaps and their potential risk to the organization
   • DThe latest security trends in the industry
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company is required to comply with PCI DSS, which mandates that cardholder data be encrypted in transit. The security team finds that internal database replication traffic is not encrypted because the database servers are on a private network. The team must recommend a control improvement while minimizing performance impact. What is the best approach?

   • ADeploy a network-based IPS to monitor the replication traffic.
   • BEnable encryption on the database replication channel, such as TLS or native database encryption.
   • CUse a VPN tunnel between the database servers.
   • DMove the database servers to a separate VLAN to isolate the traffic.
   Reveal Solution Discussion Select an answer first