Fundamental Security Architecture Concepts GDSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In risk management, what does the term 'residual risk' refer to?

   • AThe risk that remains after security controls have been applied
   • BThe risk that is identified but not assessed
   • CThe risk that is completely eliminated by security controls
   • DThe risk that is transferred to a third party
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security architect is designing a system where a third-party contractor must be able to upload files to a server, but must not be able to read files uploaded by other contractors. The architect is considering using separate folders for each contractor and setting permissions accordingly. Which additional principle must be applied to ensure that the contractor cannot access other contractors' files through a misconfigured application?

   • ASeparation of duties, by requiring two administrators to manage the file server.
   • BDefense in depth, by adding a second firewall in front of the server.
   • CLeast privilege, by giving the contractor read access to all folders but write access only to their own.
   • DFail-safe defaults, by ensuring that the application denies access to any file not explicitly associated with the authenticated contractor.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is integrating a new acquisition's network with its own. The acquired company has a flat network and no internal segmentation. The security architect must integrate the two networks while maintaining a strong security posture. The architect proposes placing a firewall between the two networks and treating the acquired network as a lower-trust zone. Which additional action is most important to ensure the trust boundary is effective?

   • ADeploying an intrusion detection system (IDS) on the acquired network to monitor for threats.
   • BConfiguring the firewall to allow only specific protocols and ports required for business operations.
   • CImplementing network address translation (NAT) on the firewall to hide internal IP addresses.
   • DUsing the same Active Directory domain to simplify user management.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is evaluating whether to add a web application firewall (WAF) in front of its public website. The risk assessment shows that the website has a high likelihood of being attacked, but the impact of a successful attack is moderate. The security team has a limited budget and must choose between the WAF and additional security awareness training for developers. Which decision best reflects risk management principles?

   • AImplement the WAF because it directly reduces the likelihood of a successful web attack, which is the highest risk factor.
   • BImplement both the WAF and the training program, regardless of the budget.
   • CInvest in developer training because it addresses the root cause of vulnerabilities, even though it takes longer to show results.
   • DDo nothing because the impact is only moderate and the website is not critical.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A hospital is segmenting its network to protect patient records. The IT team wants to ensure that a compromised workstation in the general office zone cannot directly access the electronic health record (EHR) system. They also want to allow only authorized clinical devices to communicate with the EHR. Which security zone design best meets these requirements?

   • APut the EHR system in the DMZ and allow all internal users to access it.
   • BCreate a separate EHR zone with a firewall that allows traffic only from the clinical device zone and denies all other traffic by default.
   • CPlace the EHR system in the same zone as the office workstations and rely on the EHR application's password policy.
   • DUse a flat network with a network access control (NAC) system that authenticates devices before allowing them on the network.
   Reveal Solution Discussion Select an answer first