3.6 Describe Application and Workload Security Concepts Including eBPF 350-701 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team wants to gain visibility into network traffic between workloads in a cloud environment without deploying additional agents on each workload. They want to use a technology that can inspect traffic at the kernel level. Which technology should they consider?

   • AA web application firewall (WAF) that inspects HTTP traffic.
   • BeBPF-based network observability tools that run on the host.
   • CA network tap that mirrors traffic to an external analyzer.
   • DA cloud provider's flow logs that capture metadata about network traffic.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is deploying a new application that consists of multiple microservices. The security team wants to ensure that each microservice can only communicate with the services it needs, and that any compromise of one service does not expose the others. They also want to enforce this policy without relying on IP addresses, which can change. Which solution is most appropriate?

   • AUse network security groups with source and destination IP ranges.
   • BUse a service mesh with identity-based authorization policies.
   • CPlace all microservices in a single subnet and rely on host firewalls.
   • DEncrypt all traffic between microservices using mutual TLS.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security analyst needs to detect if a process is making DNS queries to known malicious domains. The solution should be able to see the DNS requests at the kernel level and alert in real time. Which technology is most appropriate?

   • AA host-based firewall that blocks all DNS traffic.
   • BA log analysis tool that reviews DNS server logs after the fact.
   • CeBPF-based monitoring that hooks into DNS resolution functions.
   • DA network intrusion detection system (NIDS) that inspects DNS traffic on the network.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is deploying a containerized application in a cloud environment. The security team wants to ensure that containers are isolated from each other and that any malicious activity inside a container is detected. Which two controls should they implement?

   • AUse a network policy that blocks all traffic between containers.
   • BUse Kubernetes namespaces and an eBPF-based runtime security tool.
   • CUse a vulnerability scanner to scan container images before deployment.
   • DUse a single container runtime and rely on the host OS to isolate containers.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security team is evaluating tools for runtime protection on Linux servers. They need to detect and block zero-day exploits that attempt to use previously unknown attack vectors. The tool must have a minimal performance impact and be able to enforce policies dynamically. Which technology is best suited?

   • AA file integrity monitoring (FIM) tool that alerts on changes to critical files.
   • BeBPF-based runtime security tools that can monitor and block suspicious system calls.
   • CA network intrusion prevention system (IPS) that blocks known attack patterns.
   • DA signature-based antivirus solution that relies on known malware signatures.
   Reveal Solution Discussion Select an answer first