System and Network Architecture CS0-003 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In network architecture, what is the primary purpose of a demilitarized zone (DMZ)?

   • ATo monitor and block malicious traffic on the internal network
   • BTo provide a high-speed backbone for internal network traffic
   • CTo host public-facing services while isolating them from the internal network
   • DTo connect remote offices over a wide area network
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security analyst notices that a Windows server is running an unknown process that periodically writes to the registry and creates scheduled tasks. The analyst needs to determine if this behavior is malicious and gather evidence for further investigation. Which approach is most effective?

   • ADelete the scheduled tasks and registry keys associated with the process to prevent recurrence.
   • BCapture a memory dump of the process and analyze it for indicators of compromise, then correlate with system logs.
   • CDisable the process in Task Manager and observe if the server performance improves.
   • DRun a full antivirus scan on the server and quarantine any detected files.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which IAM principle ensures that users are granted only the permissions necessary to perform their job functions?

   • ASeparation of duties
   • BDefense in depth
   • CPrinciple of least privilege
   • DRole-based access control (RBAC)
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which IAM process verifies the identity of a user before granting access to a system?

   • AAuthentication
   • BAuthorization
   • CProvisioning
   • DAccounting
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is deploying a new web application in a public cloud VPC. The security team requires that all inbound HTTPS traffic be inspected for malicious payloads before reaching the web servers. They also need to capture and analyze all traffic logs centrally. Which architecture should they implement?

   • AConfigure the web servers to send their application logs directly to a central log server, and rely on the cloud provider's built-in DDoS protection.
   • BEnable TLS termination on the load balancer and configure the web servers to accept only HTTP traffic from the load balancer.
   • CDeploy a network tap that mirrors all traffic to a security analytics platform, but do not place any inline security device.
   • DPlace a network-based intrusion prevention system (IPS) inline in front of the web servers and configure it to forward logs to a central SIEM.
   Reveal Solution Discussion Select an answer first