3.4 - Understand Security Capabilities of Information Systems (IS) (e.g., Memory Protection, Trusted Platform Module (TPM), Encryption/decryption) CISSP Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A company's web application sends sensitive customer data from a load balancer to a backend application server over an internal network. The network team has confirmed that the internal network is already isolated from the internet. The security team wants to protect the data from potential eavesdropping by other internal systems. What is the MOST appropriate control to protect this data?

   • AEncrypt the traffic between the load balancer and the backend server using TLS.
   • BEncrypt the database where the data is stored at rest.
   • CHash the data before sending it to the backend server.
   • DUse a network access control list (ACL) to restrict which systems can reach the backend server.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A cloud provider offers Infrastructure-as-a-Service (IaaS) with a shared hypervisor. A customer is concerned about a malicious co-tenant VM using a hypervisor escape vulnerability to read the memory of the customer's VM. The customer also needs to protect the confidentiality of the VM's disk data from the cloud provider's administrators. Which combination of controls BEST addresses both concerns?

   • AImplement a host-based firewall on the VM to block network traffic from other tenants.
   • BUse a confidential computing solution that encrypts the VM's memory in use, and enable VM disk encryption.
   • CUse a hardware security module (HSM) to store the VM's disk encryption keys.
   • DEnable VM encryption for the virtual disk and rely on the hypervisor's built-in isolation.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the purpose of key escrow?

   • ATo destroy keys after use
   • BTo store a copy of a cryptographic key with a trusted third party for recovery in case the original key is lost
   • CTo generate new keys periodically
   • DTo encrypt data with multiple keys
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Which statement correctly differentiates symmetric and asymmetric encryption?

   • AAsymmetric encryption is faster than symmetric encryption for bulk data encryption.
   • BSymmetric encryption uses a public key for encryption and a private key for decryption, while asymmetric encryption uses a single shared key.
   • CSymmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses a pair of keys (public and private).
   • DSymmetric encryption is always more secure than asymmetric encryption.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   What is a key characteristic of a Hardware Security Module (HSM) that distinguishes it from software-based key storage?

   • AIt is primarily used for encrypting data in transit
   • BTamper-resistant hardware that protects cryptographic keys
   • CIt can be easily replicated and shared across multiple systems
   • DIt is a software application that runs on a standard server
   Reveal Solution Discussion Select an answer first