2.03 Determine the Appropriate Security Framework for an Application 401 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization is deploying a patient portal that allows users to view medical records and schedule appointments. The portal must comply with HIPAA, requiring encryption of data in transit and at rest, and strong user authentication. The application is hosted on-premises behind an F5 BIG-IP device. Which combination of security framework components should the architect select to meet these requirements?

   • AA WAF with SQL injection rules and a database encryption key stored on the same server
   • BTLS termination on BIG-IP, AES-256 encryption for the database, and integration with an identity provider for SAML-based SSO
   • CIPsec VPN for all client connections and a simple username/password login form
   • DClient-side encryption of all data before it reaches the server and no TLS
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An application requires that only authenticated users be able to access its administrative interface. Which security framework component should be mapped to this requirement?

   • AEncryption
   • BWeb application firewall (WAF)
   • CDDoS protection
   • DAccess control
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   An application processes credit card payments and must comply with PCI DSS. Which security framework component is most directly required by PCI DSS?

   • AA web application firewall (WAF)
   • BEncryption of cardholder data in transit and at rest
   • CAccess control for all employees
   • DDDoS protection
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A financial services company is deploying a customer-facing web application that handles account transfers. The application is built as a set of REST APIs served from a Kubernetes cluster, with a JavaScript single-page application (SPA) delivered from a CDN. The security team requires protection against OWASP Top 10 web attacks, including SQL injection and cross-site scripting, with minimal added latency for API responses. Which security framework component should be placed in front of the API endpoints?

   • AAn API gateway with rate limiting only
   • BA network access control list (ACL) restricting source IP ranges
   • CA transport layer security (TLS) termination proxy with mutual authentication
   • DA web application firewall (WAF) configured with a positive security model
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A multinational company is deploying a web application that processes credit card payments. The application must comply with PCI DSS. The architecture includes an F5 BIG-IP with ASM and an application server. Which configuration is required to meet PCI DSS requirements for the web application layer?

   • AEncrypt all data in the database with AES-256
   • BImplement two-factor authentication for all users
   • CEnable ASM with a policy that includes OWASP Top 10 protections and ensure it is actively monitoring traffic
   • DUse only network-level firewalls and IP restrictions
   Reveal Solution Discussion Select an answer first