General Security Concepts

A financial institution upgraded its treasury management software to require biometric verification prior to executing wire transfers, while enforcing role-based policies that constrain transfer limits according to employee job titles. During a post-transaction audit, security analysts confirmed that user identities were successfully verified and authorization boundaries were strictly enforced, but noted that no timestamped system logs were generated to record the specific destination account numbers or transfer amounts modified during sessions. Which pillar of the AAA framework is incomplete in this system design?

A security administrator needs to obtain and deploy a new TLS server certificate signed by a public Certificate Authority (CA). What is the correct sequence of administrative steps to accomplish this task?

An organization wants to optimize web traffic performance and protect user privacy by reducing client requests to external Certificate Authorities for certificate status verification. Which of the following PKI mechanisms allows the web server itself to fetch and present a signed, timestamped certificate status directly to the client during the TLS handshake?

An organization is updating its enterprise access management architecture to align with security frameworks. Match each operational capability on the left to the corresponding pillar or sub-component of the Authentication, Authorization, and Accounting (AAA) framework on the right.

A healthcare organization's cloud operations team plans to update the TLS configuration on its primary API gateways by disabling TLS 1.0 and 1.1 to comply with updated security baselines. Before the Change Advisory Board (CAB) approves this modification, which action should the security team mandate to evaluate the potential security and functional impact of the proposed change?

A security administrator is configuring a new high-security internal microservice that requires a valid server TLS certificate. Enterprise policy mandates hardware key protection, accurate Subject Alternative Name (SAN) extension mapping, intermediate CA trust anchoring, and OCSP stapling to eliminate direct client queries to the Certificate Authority. In what order should the administrator perform the following steps to deploy the certificate and enable OCSP stapling?

A security analyst is selecting a key exchange mechanism for lightweight microservices communicating over an untrusted enterprise network. The solution must allow the services to negotiate shared symmetric session keys, ensure that compromise of a long-term private key does not expose past session traffic (perfect forward secrecy), and minimize CPU computational overhead on the constrained nodes. Which of the following algorithms or protocols best fulfills these requirements?

An enterprise security operations team needs to update core firewall access control lists (ACLs) to accommodate a new external application service. Place the standard security change management workflow steps in the correct chronological order from first to last.

A security administrator is evaluating mechanisms to verify whether a digital certificate has been invalidated before its natural expiration date. Which of the following methods can be used to check the revocation status of an enterprise TLS certificate? (Select TWO.)

An enterprise security engineer configures a centralized TACACS+ server to manage administrative access to core switches. A network technician successfully enters their credentials and time-based one-time password (TOTP) to establish an interactive console session. However, when attempting to execute interface configuration commands, the router rejects the command with a privilege denial message. Which pillar of the AAA framework is responsible for determining whether the technician can execute these specific commands?

A security administrator is deploying a centralized access management solution for enterprise network infrastructure. Which of the following technical configurations directly represent the Authorization pillar of the AAA framework? (Select TWO.)

A DevOps engineering team plans to deploy an automated continuous integration and continuous deployment (CI/CD) pipeline update that alters how production application secrets are fetched and stored. To minimize potential security impacts and align with enterprise change management governance, which of the following procedures should be completed before deploying this change to production? (Select TWO.)

An organization is preparing to decommission a legacy Lightweight Directory Access Protocol (LDAP) directory server following a enterprise-wide migration to a cloud identity provider. To ensure business continuity and prevent unexpected service disruptions during the shutdown, which of the following actions should the security team perform FIRST to evaluate the security impact of this change?

A security administrator is configuring a secure transmission channel for automated database synchronization between two enterprise data centers. The organization requires a cryptographic configuration that guarantees mutual identity authentication of both endpoint servers, session confidentiality with perfect forward secrecy (PFS), and payload integrity. Which of the following cryptographic mechanisms or protocols should the administrator select? (Select TWO.)

An enterprise security team is upgrading its internal 802.1X EAP-TLS network authentication infrastructure. During validation testing, corporate endpoints fail to establish a TLS tunnel with the RADIUS server, returning certificate trust and capability errors. Further inspection confirms that the root and subordinate Intermediate CA certificates are properly installed in the endpoint trust stores. Which of the following certificate misconfigurations would cause endpoints to reject the RADIUS server certificate? (Select TWO.)

A security administrator is setting up an automated deployment server that requires an enterprise-issued code-signing certificate from an internal Certificate Authority (CA). Which of the following procedures correctly follows Public Key Infrastructure (PKI) standards for generating and submitting a Certificate Signing Request (CSR)?

A DevOps security engineer configures a CI/CD build pipeline to publish container images to a private registry. The registry uses mutual TLS (mTLS) to verify the build agent's identity and evaluates microservice access control lists (ACLs) to ensure the agent holds write permissions. However, an internal audit reveals that detailed logs of image tag modifications and timestamped service upload events are not being recorded or stored centrally. Which pillar of the AAA security framework is absent in this implementation?

An enterprise security architect is reviewing access control operations across different corporate infrastructure components. Match each operational scenario on the left with its corresponding Authentication, Authorization, or Accounting (AAA) functional role on the right.

An enterprise security team needs to deploy an urgent software patch to core payment gateways to remediate an actively exploited remote code execution vulnerability. To balance immediate threat mitigation with enterprise governance and risk management requirements, which of the following actions should the team take FIRST according to formal change management principles?

An enterprise security architect is establishing a two-tier internal Public Key Infrastructure (PKI) hierarchy. The Root CA will remain air-gapped to maintain security, while a new Intermediate CA will issue operational certificates to web servers. Place the administrative steps for provisioning and activating the Intermediate CA into the correct chronological order from first to last.