All practice questions

A security architect is updating an enterprise data protection framework to address regulatory compliance and storage security requirements across cloud and on-premises infrastructure. Match each data protection technology to the enterprise operational requirement it primarily fulfills.

A fintech enterprise is redesigning its cloud-native payment gateway architecture to achieve PCI-DSS compliance. The security architecture must restrict lateral movement between individual microservices inside the cardholder data environment (CDE), enforce strict inline policy inspection for outbound internet-bound management connections, and eliminate reliance on internal network location trust. Which of the following network architecture controls should the security team implement to satisfy these requirements? (Select TWO.)

A healthcare technology organization is designing a data protection architecture to archive multi-terabyte patient records in a cloud-based storage repository. Regulatory mandates require that the enterprise security team maintain exclusive physical control over key generation, rotation, and revocation lifecycle operations. Additionally, the bulk encryption mechanism must support high-throughput processing for mass ingestion without delegating root key custody to the cloud service provider. Which of the following storage security architecture configurations best satisfies both performance requirements and regulatory key ownership constraints?

An organization is configuring a shared Linux host operating system to execute unmanaged containerized microservices for multiple untrusted third parties. The security team must minimize the attack surface of the shared host kernel and prevent one tenant's containerized process from inspecting or interacting with processes of another tenant. Which TWO of the following mechanisms directly accomplish these security goals?

Match each virtualization and containerization security mechanism on the left with its primary operational function on the right.

A security architect is designing a high-availability infrastructure across two geographically separated cloud regions for a critical financial transactions platform. The business impact analysis specifies a Recovery Point Objective ($RPO$) of near-zero ($RPO < 1\text{ second}$) and a Recovery Time Objective ($RTO$) of less than $30\text{ seconds}$. The design must prevent split-brain condition states during network partitions and ensure continuous operation during full regional outage scenarios. Which TWO of the following architecture controls or configurations must be combined to meet these strict availability, consistency, and resilience requirements? (Select TWO.)

A system administrator is evaluating deployment options for an enterprise workload. Which of the following fundamental architectural characteristics distinguishes application containers from virtual machines?

An enterprise health technology organization is deploying a high-throughput centralized database storage system processing millions of protected health information (PHI) records daily. Compliance standards mandate hardware-level protection for cryptographic key management where master keys are non-exportable and tamper-resistant. Additionally, data-at-rest bulk block encryption performance overhead must be offloaded directly to dedicated disk hardware, preventing media encryption keys from residing in host operating system memory. Which of the following storage security architectures satisfies both the performance and key isolation requirements?

An enterprise security architect is establishing operational boundaries across a multi-cloud enterprise ecosystem. Match each cloud security implementation task on the left with the corresponding cloud service model on the right.

An organization is deploying new laptop computers to remote workers and wants to store full-disk encryption keys securely within dedicated microcontrollers soldered directly onto each computer motherboard. Which hardware security component provides this local cryptoprocessor functionality for device integrity verification and key storage?

Match each hardware security mechanism to its primary security function.

A security analyst at a global hospitality enterprise discovers an unauthorized remote access tool installed on point-of-sale systems across multiple properties. Investigation reveals that an external adversary gained initial access using compromised credentials from a third-party vendor to deploy custom malware specifically designed to harvest credit card data for long-term monetary profit. Based on these observed attributes, which threat actor type and primary motivation best describe this adversary?

A cloud-native financial services company is updating the security architecture of its containerized microservices platform, which handles real-time payment transactions. The security team must limit lateral movement across internal workloads, enforce zero trust principles for internal service communication, and ensure continuous traffic inspection. Which of the following technical controls should the security team implement to achieve this network segmentation design? (Select TWO).

During a technical security assessment of an enterprise cloud environment, a security engineer discovers that a process running within a containerized workload executed a host kernel exploit to access memory allocated to neighboring containers on the same host. To mitigate this risk, the organization must implement an architecture that prevents shared-kernel vulnerability exploitation by providing an independent kernel and hardware-enforced separation for each workload. Which of the following solutions should the engineer recommend?

A security engineer auditing an enterprise cloud microservices environment identifies two specific architectural design choices: internal microservice-to-microservice traffic relies solely on network IP address allowlists without identity verification, and database backup files are encrypted using AES operating in Electronic Codebook (ECB) mode. Which of the following statements correctly describe the cryptographic and security control weaknesses present in this environment? (Select TWO.)

A security analyst reviews the following web server access log entry:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 4523

Which of the following attack types is indicated by this log entry?

An enterprise organization is deploying a centralized storage architecture hosting high-value transactional databases. Compliance regulations require that all storage volumes maintain encryption at rest, and master cryptographic keys must be generated, safeguarded, and offloaded to dedicated hardware isolated from host OS administrators to prevent unauthorized key extraction. Which of the following solutions should the security architect integrate into the storage architecture to fulfill this key management requirement?

A regional financial institution migrates its customer ticketing platform to a public cloud provider under a Software as a Service (SaaS) model. During an architectural security review, the team evaluates operational duties under the cloud shared responsibility model. Which of the following security controls remains the sole responsibility of the financial institution?

A system administrator notices that several virtualized database servers are experiencing sustained 100% CPU utilization during off-peak hours. Outbound network logs show persistent, encrypted connections on TCP port 3333 transmitting data structured with the Stratum communication protocol. An endpoint inspection reveals an unauthorized process masquerading as a system executable (`svchost.exe`) running under a compromised service account. Which of the following malware types is most likely responsible for this activity?

A regional health insurance organization is migrating its claims processing engine to a cloud provider using a Serverless Function-as-a-Service (FaaS) execution model connected to a managed Database-as-a-Service (DBaaS) backend. During a compliance audit, the security team is asked to document control ownership across the deployment layers. Which of the following statements correctly identifies the customer's operational responsibility in this deployment architecture?