Learn About the Processes and Controls Involved in Data and Platform Security. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services firm runs a web application on a fleet of virtual servers. The security team wants to reduce the attack surface and ensure that all servers are configured consistently and securely. Which approach best aligns with platform security controls under the NIST CSF PROTECT function?

   • AUse a configuration management tool to enforce a hardened baseline image, and apply security patches on a regular schedule.
   • BEnable automatic updates for the operating system, and rely on the cloud provider's default security groups for protection.
   • CManually configure each server during deployment, and apply patches only when a vulnerability is publicly disclosed.
   • DDeploy a web application firewall in front of the servers, and disable all unnecessary services on the servers.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university stores research data that is subject to export control regulations. The data must be encrypted, and access must be restricted to authorized researchers. Which control is most critical to implement?

   • ADeploy a firewall to isolate the research data, and rely on the network perimeter for access control.
   • BImplement a data classification scheme and apply access controls that restrict access to authorized researchers only.
   • CEncrypt all data with a strong encryption algorithm, and store the keys on the same server as the data.
   • DUse a data loss prevention tool to monitor all data transfers, and allow all researchers to access the data.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is migrating its customer database to a cloud platform. The database contains sensitive personal information. The security team must ensure that data is encrypted at rest and that access is tightly controlled. However, the team is concerned about the performance impact of encryption on database queries. Which approach best addresses both security and performance?

   • AUse a hardware security module (HSM) to encrypt all data, and accept the performance overhead.
   • BEncrypt the entire database with application-level encryption, and decrypt data on every query.
   • CEncrypt only the backups and rely on network security to protect the live database.
   • DEnable transparent data encryption (TDE) on the database, and use column-level encryption only for the most sensitive fields.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A technology startup deploys its application using containers on a managed Kubernetes service. The security team wants to ensure that container images are secure and that the platform is configured according to best practices. Which set of actions is most aligned with platform security controls?

   • AScan container images for vulnerabilities, enforce a policy to run containers as non-root, and use a hardened node image.
   • BDeploy a network policy to restrict pod-to-pod communication, and disable all container updates.
   • CEnable audit logging for the Kubernetes API server, and grant all developers cluster-admin access.
   • DUse the latest container images from the public registry, and rely on the Kubernetes default settings.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which platform security control is used to reduce the attack surface by disabling unnecessary services, closing unused ports, and applying secure configuration baselines?

   • ALog management
   • BIntrusion detection
   • CSystem hardening
   • DPatch management
   Reveal Solution Discussion Select an answer first