Evaluate and Select Reusable Technologies CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security architect is designing a data flow for a payment processing system. The system must prevent SQL injection attacks, block outbound data exfiltration of cardholder data, and ensure that database connections are encrypted. The architect can only add one new component to the existing architecture. Which component should be added to address the most critical risk?

   • AA data loss prevention (DLP) solution that monitors outbound traffic for cardholder data
   • BA database proxy that enforces TLS for all database connections
   • CA web application firewall (WAF) that inspects inbound HTTP requests for SQL injection patterns
   • DA network firewall that blocks all outbound traffic except to known IP addresses
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary security benefit of using containers compared to traditional virtual machines?

   • AContainers provide stronger isolation than virtual machines.
   • BContainers are always more secure than virtual machines.
   • CContainers share the host OS kernel, reducing the attack surface of a full OS per application.
   • DContainers eliminate the need for security patching.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An organization is deploying a new application on Windows servers. The security policy requires that only signed and approved executables can run, and that the boot process is verified against tampering. Which combination of operating system controls should be enabled?

   • AWindows Defender Application Control (WDAC) and Secure Boot
   • BWindows Firewall and Windows Defender Antivirus
   • CBitLocker Drive Encryption and User Account Control (UAC)
   • DAppLocker and Encrypting File System (EFS)
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security architect is designing a disaster recovery plan for a system that processes highly sensitive data. The plan must ensure that the system can be restored to a known-good state after a compromise, and that the restoration process itself is protected from tampering. The architect has access to TPM-enabled hardware. Which strategy should be used?

   • ARestore the system from the latest backup without any integrity verification
   • BUse TPM-based attestation to verify the integrity of the backup server and the backup images before restoration
   • CEncrypt the backups with a key stored on the backup server
   • DStore backups on a network share with write permissions for all administrators
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A retail company stores customer credit card numbers in a database. The security team wants to prevent sensitive data from being transmitted outside the corporate network via email or web uploads, while still allowing authorized applications to read the data for transaction processing. Which control should be implemented?

   • AA trigger that encrypts credit card numbers before any SELECT statement
   • BA firewall rule that blocks all outbound traffic on port 443
   • CA data loss prevention (DLP) solution that monitors outbound traffic for patterns matching credit card numbers
   • DA database view that masks credit card numbers for all users
   Reveal Solution Discussion Select an answer first