Network, Endpoint, and Data Security CISA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary purpose of network segmentation in a security architecture?

   • ATo replace the need for encryption of data in transit
   • BTo increase available bandwidth by reducing broadcast traffic
   • CTo isolate sensitive systems and limit lateral movement if a breach occurs
   • DTo provide a single point of failure for easier troubleshooting
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A hospital has a wireless network for staff and a separate network for patient monitoring devices (IoT). The IoT devices are outdated and cannot support WPA3. The security team wants to ensure that a compromised IoT device cannot be used to access the staff network or the internet. Which control is most effective?

   • AUse a single WPA2 network for both staff and IoT devices, but enable MAC filtering.
   • BUse WPA2 on the IoT network and place it on a separate VLAN with a firewall that blocks outbound internet access.
   • CUse WPA3 on the staff network and leave the IoT network on WEP.
   • DDisable the IoT devices' wireless capability and connect them via Ethernet.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is migrating its on-premises data center to a public cloud IaaS. The compliance team requires that all data be encrypted at rest and that access to the encryption keys be logged and audited. The company also wants to minimize the administrative overhead of managing keys. Which solution should they choose?

   • AUse client-side encryption with keys stored in the application.
   • BUse customer-managed keys (BYOK) stored in the provider's KMS.
   • CUse server-side encryption with provider-managed keys (SSE-S3 style).
   • DUse cloud provider-managed keys (CMK) with the provider's key management service (KMS).
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary security purpose of isolating virtual networks within a hypervisor?

   • ATo simplify the process of backing up virtual machines
   • BTo reduce the storage space required for VM images
   • CTo prevent unauthorized traffic between virtual machines
   • DTo increase the processing speed of the hypervisor
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A financial services firm uses a cloud-based email service. The compliance team wants to prevent employees from accidentally sending emails that contain credit card numbers to external recipients. Which control should the firm implement?

   • AConfigure a data loss prevention (DLP) policy that scans email content and blocks messages containing credit card numbers.
   • BRestrict external email recipients to a pre-approved list.
   • CRequire employees to manually encrypt any email that contains sensitive data.
   • DEnable encryption for all outbound email messages.
   Reveal Solution Discussion Select an answer first