3.4 - Understand Security Capabilities of Information Systems (IS) (e.g., Memory Protection, Trusted Platform Module (TPM), Encryption/decryption) CISSP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A financial services firm runs a high-frequency trading application on a shared cloud host. The application processes sensitive order data in memory, and the security team is concerned about a malicious co-tenant process using speculative execution or memory-scraping attacks to read that data. The application cannot be re-architected to use a separate physical host. Which control would BEST protect the confidentiality of the in-memory data while the application is executing?

   • ADeploy a host-based intrusion detection system (HIDS) that monitors for unusual memory access patterns.
   • BRun the sensitive computation inside a hardware-based secure enclave, such as Intel SGX or AMD SEV.
   • CEncrypt the application's data files on the cloud provider's managed disk service.
   • DEnable Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) on the host operating system.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of a cryptographic hash function?

   • ATo encrypt data so that it can be decrypted later
   • BTo compress data for storage efficiency
   • CTo provide a fixed-size output that can be used to verify data integrity
   • DTo provide non-repudiation by encrypting data with a private key
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which memory protection mechanism is specifically designed to prevent the exploitation of buffer overflow vulnerabilities by making the memory addresses of code and data unpredictable?

   • APaging
   • BAddress Space Layout Randomization (ASLR)
   • CSegmentation
   • DData Execution Prevention (DEP)
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is a key advantage of application-level encryption over storage-level encryption?

   • AIt protects data even if the underlying storage is compromised
   • BIt encrypts data in transit automatically
   • CIt requires no key management
   • DIt is easier to implement than storage-level encryption
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A healthcare organization is deploying new laptops to remote clinicians. The security policy requires that the devices be verified as booting only trusted, unmodified operating system components before they are allowed to connect to the corporate VPN. The organization uses a centralized management console to enforce this policy. Which combination of technologies should the security architect specify?

   • ATPM-based measured boot that records boot measurements in platform configuration registers (PCRs) and sends them to the management console for attestation.
   • BFull disk encryption with BitLocker using a TPM as the key protector.
   • CA software-based antivirus scanner configured to run at startup.
   • DA hardware token that generates a one-time password for VPN authentication.
   Reveal Solution Discussion Select an answer first