Security Technologies CNX-001 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A hospital wants to ensure that only authorized devices can connect to its internal network. They have a mix of company-owned laptops and personal smartphones used by staff. The network team needs to enforce a policy that checks device compliance before granting access. Which approach should they implement?

   • AImplement a VPN that requires a username and password for all users.
   • BConfigure the firewall to allow all traffic from internal IP addresses.
   • CUse MAC address filtering on the switches to allow only known devices.
   • DDeploy a Network Access Control (NAC) solution that authenticates devices and checks compliance before allowing network access.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which firewall log event would most likely indicate a potential port scan?

   • AA log entry showing a firewall reboot
   • BA single denied packet from a known internal IP
   • CMultiple denied packets to various ports from the same source IP
   • DAn allowed connection to a web server on port 443
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company needs to secure communication between its web server and clients. The web server hosts a public website that must be accessible to all users. The company also wants to ensure that the encryption keys are not stored on the web server itself. Which solution should they implement?

   • AUse SSL with a self-signed certificate stored on the web server.
   • BUse SSH tunneling to encrypt web traffic.
   • CUse TLS with a certificate stored in a hardware security module (HSM) or a cloud-based key management service.
   • DUse IPsec to encrypt all traffic to the web server.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company uses a cloud-based key management service (KMS) to store encryption keys for its data. The security team wants to ensure that keys are rotated automatically every 90 days and that access to the keys is audited. The KMS supports these features. What should the team configure?

   • AStore keys in a local file and rotate them using a script.
   • BManually rotate keys every 90 days and rely on the KMS's default logging.
   • CUse a single key for all data and rotate it only when a security incident occurs.
   • DSet up automatic key rotation with a 90-day period and enable audit logging for all key access.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization stores patient data in an encrypted database. The encryption keys are stored on the same server as the database. The security team is concerned that if the server is compromised, the keys could be stolen. What should they do to improve key security?

   • AChange the encryption algorithm to a stronger one.
   • BEncrypt the keys with a password and store them in a file on the same server.
   • CMove the encryption keys to a hardware security module (HSM) or a dedicated key management service.
   • DBack up the keys to a USB drive and keep it in a safe.
   Reveal Solution Discussion Select an answer first