Fundamental Security Architecture Concepts GDSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During a threat modeling session for a new online ordering system, the team identifies that an attacker could exploit a vulnerability in the web server to read the database credentials stored in a configuration file. The team decides to move the credentials to a hardware security module (HSM) and enforce network segmentation between the web and database tiers. Which threat modeling concept does this decision represent?

   • ADecomposing the application into trust boundaries and data flows.
   • BDocumenting the threat model in a formal diagram and presenting it to management.
   • CIdentifying assets and entry points before the threat modeling session begins.
   • DMitigating identified threats by applying multiple controls that reduce the likelihood and impact of the attack.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During a threat modeling session for a new online payment system, the team identifies that an attacker could exploit a vulnerability in the web server to read the database credentials stored in a configuration file. The team is considering two mitigations: (A) move the credentials to a hardware security module (HSM) and enforce network segmentation between the web and database tiers, or (B) implement a web application firewall (WAF) and rely on the database's built-in encryption. The team has a limited budget and must choose the most effective mitigation. Which choice is better and why?

   • ANeither mitigation is effective because the threat is too difficult to mitigate.
   • BMitigation B, because a WAF blocks the initial exploit and encryption protects the data at rest.
   • CMitigation A, because it directly addresses the threat of credential theft and limits the impact of a web compromise by preventing direct database access.
   • DBoth mitigations are equally effective because they both add layers of security.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company is connecting its corporate network to a third-party partner network via a VPN. The security architect is defining the trust relationship between the two networks. Which action best establishes a clear trust boundary?

   • ARely on the partner's security posture and do not implement any additional controls.
   • BUse the same IP addressing scheme for both networks to simplify routing.
   • CAllow the partner network to access internal resources directly without any filtering.
   • DPlace a firewall between the VPN gateway and the internal network, and treat the partner network as an untrusted zone.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A system administrator is configuring a new file server. The security policy states that all access should be denied by default and only explicitly permitted access should be allowed. Which configuration aligns with this policy?

   • AEnable the guest account and set the share permissions to 'Authenticated Users: Read'.
   • BCreate a share with 'Everyone: Full Control' and rely on the network perimeter firewall for protection.
   • CConfigure the file server's firewall to block all inbound traffic, and then add rules to allow specific IP addresses and ports.
   • DSet the file server's firewall to allow all traffic, and rely on user training to prevent unauthorized access.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security architect is designing a new e-commerce platform. The architecture includes a web application firewall (WAF), network segmentation, and host-based intrusion detection. The architect wants to ensure that if an attacker exploits a vulnerability in the web application, the attacker cannot easily move laterally to the payment processing systems. Which combination of controls best supports this goal?

   • ASegment the application and payment systems into separate zones, and enforce strict firewall rules between them.
   • BRely solely on host-based intrusion detection on the payment systems to detect lateral movement.
   • CDeploy the WAF, but keep all application components in a single flat network to simplify management.
   • DUse a single firewall to protect the entire network, but do not create internal zones.
   Reveal Solution Discussion Select an answer first