Encryption at Rest and in Transit CSE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company runs a web application behind a load balancer. The load balancer terminates TLS and forwards traffic to backend servers over HTTP. A security audit flags that data is exposed between the load balancer and backend servers. The company wants to encrypt the entire path without changing the application code. Which solution should they implement?

   • AMove the backend servers to a private subnet and rely on network isolation
   • BUse application-level encryption in the HTTP headers
   • CConfigure TLS on the backend servers and use HTTPS between the load balancer and backend
   • DUse a VPN between the load balancer and backend servers
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is migrating a legacy application to the cloud. The application currently uses a custom protocol that does not support TLS. The security team must ensure that data is encrypted in transit between the application and the cloud database, but they cannot modify the application code. Which solution should they choose?

   • ADeploy a sidecar proxy or gateway that terminates the legacy protocol and establishes a TLS connection to the database.
   • BUse a VPN between the application and the database.
   • CUse IPsec to encrypt all traffic between the application host and the database host.
   • DChange the application to use TLS by modifying the source code.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the role of certificates in TLS/SSL?

   • ATo authenticate the server and establish trust
   • BTo compress the data before transmission
   • CTo encrypt the data payload
   • DTo store the encryption keys for the session
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A multinational company has offices in multiple regions and uses a cloud provider. They need to securely connect all office networks to the cloud and also ensure that traffic between offices is encrypted. They want a solution that is scalable and does not require dedicated hardware. Which approach should they use?

   • AUse TLS for all inter-office traffic over the internet
   • BUse a single VPN tunnel from one office to the cloud and route all traffic through it
   • CUse a dedicated physical connection from each office to the cloud
   • DUse cloud VPN gateways with IPsec tunnels from each office to the cloud
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What does Bring Your Own Key (BYOK) allow a customer to do?

   • AImport their own encryption keys into a cloud provider's key management service
   • BShare keys with other customers
   • CEncrypt data without using any keys
   • DUse the provider's default keys without any control
   Reveal Solution Discussion Select an answer first