Examkin

Security Architecture

405 questions

All types405Multiple choice207Multiple select87Matching93Ordering18
Question 141Question →

A network administrator needs to host a publicly accessible web server while protecting internal enterprise databases from direct internet exposure. Which network design topology should the administrator implement to place the web server in an isolated perimeter zone between the external internet and the internal private network?

Show answer & explanation

Answer: Demilitarized zone (DMZ)

Answer

Demilitarized zone (DMZ)
A demilitarized zone (DMZ) functions as a physical or logical perimeter subnetwork that houses external-facing services such as web, DNS, or mail servers. Placing public resources within a DMZ ensures that internet users can communicate with the web server without gaining direct routing access to sensitive internal servers located behind internal firewalls.

Step-by-Step Solution

1
Identify the requirement to host an internet-facing application while shielding private database infrastructure.
Determine that a boundary network is needed between untrusted external traffic and trusted internal resources.
Public-facing hosts have a higher risk of attack and must be separated from sensitive internal servers.
2
Select the appropriate network isolation architecture.
Choose a Demilitarized Zone (DMZ) topology.
A DMZ enforces traffic boundaries via firewalls so that external requests reach the web server without direct network access to the internal network.

Key Concept

Demilitarized Zone (DMZ) and Perimeter Isolation
Question 142Question →

An enterprise security architect is designing a network architecture for a hybrid micro-datacenter that hosts PCI-DSS scoped payment processing workloads alongside unmanaged IoT environmental sensors on shared physical network switches. The design must prevent direct Layer 2 or Layer 3 lateral movement between any endpoints located within the same IP subnet, without requiring dedicated physical switches or administrative overhead from managing hundreds of individual VLAN subnets and IP pools. Which of the following secure network design strategies best meets these requirements?

Show answer & explanation

Answer: Configure Private VLANs (PVLANs) on the access switches using isolated secondary VLANs to restrict port-to-port communication within the shared subnet.

Answer

Configuring Private VLANs (PVLANs) using isolated secondary VLANs provides Layer 2 microsegmentation within a single IP subnet, blocking port-to-port East-West traffic without allocating extra IP subnets or physical switch hardware.
Private VLANs (PVLANs) extend standard VLAN capabilities by subdividing a single broadcast domain into secondary isolation zones. Endpoints connected to isolated ports can only communicate with designated promiscuous ports (such as the default gateway router), preventing lateral movement and frame forwarding between peers on the same subnet without allocating new IP subnets.

Step-by-Step Solution

1
Analyze the scenario constraints and security objectives.
Identified the need to block lateral movement (East-West traffic) between endpoints residing on the exact same IP subnet and physical switch without creating multiple subnets or buying dedicated hardware.
Standard IP routing controls operate at Layer 3 between subnets, whereas endpoints on the same subnet communicate directly at Layer 2 through switch MAC address tables.
2
Evaluate network isolation technologies against Layer 2 constraints.
Private VLANs (PVLANs) split a primary VLAN into secondary sub-domains (isolated, community, promiscuous). Isolated ports cannot communicate with any other isolated or community port on the same switch.
PVLAN technology enforces Layer 2 port isolation while preserving a single IP subnet boundary, avoiding routing complexity and extra VLAN/subnet overhead.
3
Eliminate ineffective perimeter or sub-interface architecture proposals.
Options relying on standard 802.1Q inter-VLAN routing, perimeter firewalls, or passive NIPS taps fail to restrict intra-subnet Layer 2 frame forwarding.
Traffic between endpoints in the same subnet never traverses a router or perimeter firewall unless Layer 2 port isolation is enforced at the access layer.

Key Concept

Private VLAN (PVLAN) Microsegmentation
Estimated Time:3m 0s
Question 143Question →

A regional utility provider migrates its customer telemetry analytics application to a cloud provider's Platform as a Service (PaaS) solution. During a routine vulnerability scan, an auditor discovers an unpatched kernel vulnerability in the underlying host operating system powering the database runtime. Under the cloud shared responsibility model, which of the following parties is responsible for patching this host operating system vulnerability?

Show answer & explanation

Answer: The Cloud Service Provider, because PaaS abstracts host infrastructure and operating systems, placing host management solely under provider responsibility.

Answer

The Cloud Service Provider is responsible because PaaS abstracts host infrastructure and operating systems, placing host management solely under provider responsibility.
In Platform as a Service (PaaS), the Cloud Service Provider (CSP) manages the infrastructure layer including physical facilities, server hardware, virtualization, and host operating system maintenance. Tenants in PaaS environments are responsible for application code, user permissions, and customer data configuration.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The organization is utilizing a Platform as a Service (PaaS) architecture.
Responsibilities vary significantly depending on whether the service model is IaaS, PaaS, or SaaS.
2
Determine the boundary of responsibility for host operating system management in PaaS.
In PaaS, the provider manages physical hardware, network infrastructure, hypervisors, OS patching, and middleware runtimes.
The customer is only responsible for managing application code, data, and access configurations.
3
Assign patch management duty for the host OS kernel vulnerability.
Remediating the host OS vulnerability falls strictly on the Cloud Service Provider.
Customers do not have direct root or admin access to host operating systems supporting PaaS platforms.

Key Concept

Shared Responsibility Model in Platform as a Service (PaaS)
Question 144Question →

A security engineer is designing network controls for a cloud-hosted e-commerce application processing payment transactions. The architecture requires granular security controls to prevent lateral movement (east-west traffic) between individual cloud workload instances within the cardholder data environment. Which network design strategy best provides granular isolation and controls east-west traffic between individual cloud workloads?

Show answer & explanation

Answer: Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.

Answer

Implementing workload-level microsegmentation using software-defined policies and host-based firewall agents.
Microsegmentation isolates workloads granularly down to the host or container level by enforcing security policies directly on workload instances (via software agents or cloud security groups). This approach restricts lateral (east-west) traffic movement regardless of subnet boundaries, directly satisfying the requirement for workload isolation in a cloud environment.

Step-by-Step Solution

1
Analyze the core security requirement.
The scenario requires preventing lateral movement (east-west traffic) between individual workload instances operating in a shared cloud environment.
Traditional perimeter security controls North-South (boundary) traffic, whereas internal instance-to-instance traffic requires granular isolation rules.
2
Evaluate microsegmentation versus traditional network zoning.
Microsegmentation creates micro-perimeters around individual instances using software agents, security groups, or hypervisor/cloud API controls.
This enforces granular access policies at Layer 7 or Layer 4 for east-west traffic directly on workloads.
3
Identify why alternative options are unsuitable.
Single perimeter subnets rely on implicit internal trust; physical air gaps break cloud application connectivity; and passive NIDS sensors detect but do not block traffic.
Only workload-level microsegmentation satisfies both connectivity and preventive east-west containment requirements.

Key Concept

Microsegmentation for East-West Cloud Traffic Isolation
Question 145Question →

A financial services organization operates a microservices-based payment engine within a container orchestration cluster. Public API proxies, payment verification services, and sensitive database connectors execute across shared worker nodes. To mitigate lateral movement risks between workloads running on identical physical hosts while satisfying strict audit compliance, which of the following network architecture controls should the security team implement?

Show answer & explanation

Answer: Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.

Answer

Microsegmentation using network policies and software-defined granular controls to inspect and filter east-west container traffic.
Microsegmentation uses software-defined network (SDN) rules and container network policy plugins to enforce granular isolation at the individual workload layer (Layer 7 / host network layer). This enables strict control over east-west traffic between microservices, preventing unauthorized lateral movement even when services execute on the exact same worker host node.

Step-by-Step Solution

1
Analyze the architectural requirements and environment constraints.
Identified a container cluster environment sharing physical worker nodes with a requirement to prevent lateral movement between pods on the same host.
Containerized workloads sharing worker node operating system kernels require logical isolation controls below the physical network switch layer.
2
Evaluate traffic patterns requiring control.
Recognized that inter-service communication within a host cluster represents internal east-west network traffic.
Standard perimeter firewalls only filter north-south incoming and outgoing boundary traffic.
3
Select the appropriate network isolation security control.
Determined that microsegmentation utilizing software-defined networking rules enforces pod-level access controls.
Microsegmentation creates fine-grained security zones at the workload level, isolating containerized services regardless of physical placement.

Key Concept

Microsegmentation for East-West Container Traffic Isolation
Estimated Time:2m 0s
Question 146Question →

A network administrator needs to establish a remote management session to perform critical database maintenance from an untrusted external network. Arrange the following network boundary transit steps and control points in the correct order, starting from the external connection initiation to the final session establishment on the internal database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with external session initiation, passes North-South inspection at the perimeter firewall into the DMZ, authenticates at the bastion host, undergoes East-West firewall rule evaluation, and terminates at the isolated database server.
In a secure multi-tiered network design, incoming external administrative traffic must first cross the perimeter firewall into a screened network segment (DMZ). The session is authenticated and proxied by a DMZ bastion host before initiating a separate internal connection. This East-West transit from the DMZ to the internal database zone is separately controlled and filtered by an internal firewall before reaching the destination database server.

Step-by-Step Solution

1
Identify the entry point of external network traffic.
The initial step is the remote administrator workstation sending traffic across the Internet toward the enterprise network edge.
Traffic originates at the remote client before reaching internal enterprise security controls.
2
Evaluate perimeter access control and DMZ redirection.
The perimeter firewall processes North-South ingress traffic and restricts access directly to the DMZ bastion host.
Secure network design prohibits direct external access to internal subnets; all management traffic must terminate in a screened zone first.
3
Enforce identity verification and administrative proxy controls.
The DMZ bastion host authenticates the administrator via MFA and establishes a proxy channel.
Jump servers/bastion hosts act as intermediate staging points to validate identity before granting access to internal zones.
4
Inspect inter-zone East-West network traffic.
The internal firewall evaluates rule sets governing traffic moving between the DMZ subnet and the internal database subnet.
Internal segment isolation ensures that only explicitly permitted source IP addresses (the bastion host) can connect across internal zone boundaries.
5
Complete session establishment on the internal target endpoint.
The database server receives and accepts the management session request.
The destination endpoint processes the connection request after all perimeter and internal segmentation controls have validated the flow.

Key Concept

Multi-Tier Network Boundary Segmentation and Jump Server Session Transit Controls
Estimated Time:1m 30s
Question 147Question →

An organization is updating its enterprise security strategy to align with Zero Trust Architecture (ZTA) principles. Which of the following implementations best demonstrates the core Zero Trust tenet of "assume breach"?

Show answer & explanation

Answer: Encrypting all network communications and enforcing microsegmentation regardless of user or device location

Answer

Encrypting all network communications and enforcing microsegmentation regardless of user or device location
The core Zero Trust tenet of 'assume breach' requires organizations to plan defenses as if attackers already have access to the internal network. Encrypting internal communications and implementing microsegmentation ensures that even if an internal host is compromised, lateral movement and unauthorized data interception are strictly controlled.

Step-by-Step Solution

1
Identify the key tenet being evaluated
The core tenet is 'assume breach', which presumes attackers may already be inside the network environment.
Zero Trust assumes no implicit trust based solely on physical or network location.
2
Evaluate the architectural control that minimizes blast radius during a compromise
Microsegmentation and end-to-end encryption ensure lateral movement is prevented and data remains protected even if an internal host is compromised.
This continuously enforces strict access boundaries and limits exposure during an incident.

Key Concept

Assume Breach in Zero Trust Architecture
Estimated Time:45s
Question 148Question →

A system administrator is updating an enterprise security policy to align with core Zero Trust Architecture (ZTA) principles. Which of the following practices represent core tenets of Zero Trust? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Explicitly verify identity, device health, and context for every access request; Enforce least privilege access by restricting user permissions to only what is necessary for specific tasks

Answer

The core tenets of Zero Trust Architecture include explicitly verifying every access request and enforcing least privilege access controls.
Zero Trust Architecture enforces continuous explicit verification for all access requests and limits user rights through least privilege access policies to minimize risk.

Step-by-Step Solution

1
Identify core Zero Trust Architecture tenets
Zero Trust is built on the philosophy of 'never trust, always verify', assuming that threats exist both outside and inside the network.
Traditional perimeter defenses rely on implicit trust, which Zero Trust explicitly replaces with continuous verification.
2
Evaluate the requirement for verification
Explicit verification mandates that all requests are authenticated, authorized, and validated based on user identity, location, device health, and data classification.
This prevents unauthorized movement even if an attacker gains entry to the network.
3
Evaluate the requirement for access restriction
Least privilege access limits user access with Just-In-Time (JIT) and Just-Enough-Access (JEA) policies.
Restricting access reduces the blast radius in the event of a credential compromise.

Key Concept

Zero Trust Architecture Principles
Question 149Question →

During a post-incident investigation of a cloud-native microservices environment, a security analyst determines that an attacker exploited a kernel vulnerability within an application container to break out of the container runtime environment and execute code directly on the host operating system. The application was running as a standard non-root service within an OCI-compliant container ecosystem. Which of the following root causes best explains why containerization failed to isolate the workload compared to a traditional hardware-enforced virtual machine architecture?

Show answer & explanation

Answer: Containers share the host OS kernel and rely on software-based logical abstractions such as namespaces and control groups, allowing kernel-level exploits to compromise the underlying host.

Answer

Containers share the host OS kernel and rely on software-based logical abstractions such as namespaces and control groups, allowing kernel-level exploits to compromise the underlying host.
Containers provide OS-level virtualization by sharing the host operating system kernel while using logical constraints like namespaces (to isolate process trees, mounts, and network interfaces) and control groups (cgroups, to throttle resources). If an application container exploits a vulnerability in the underlying host kernel, the attacker escapes the logical container sandbox and executes code in the context of the host kernel. Virtual machines avoid this specific failure mode because each VM runs its own independent guest kernel managed by a Type-1 or Type-2 hypervisor.

Step-by-Step Solution

1
Analyze the architecture differences between Virtual Machines (VMs) and Containers.
VMs utilize hypervisors to abstract hardware and run full separate guest operating systems with hardware-enforced privilege boundaries. Containers share the host kernel and use OS-level isolation features like Linux namespaces and cgroups.
Understanding the isolation boundary is critical for security architecture analysis.
2
Evaluate the impact of a kernel privilege escalation exploit inside a container.
Because all containers on a host share the underlying operating system kernel, any unpatched kernel vulnerability exploited from within a container grants the attacker execution capabilities within host kernel space.
Logical boundary isolation (namespaces) cannot protect against flaws in the shared kernel executing those namespaces.
3
Select the option that correctly identifies shared kernel architecture as the primary isolation limitation.
The option stating that containers share the host operating system kernel and rely on software logical primitives accurately explains the vulnerability exposure.
This directly answers why container isolation failed where VM hypervisor isolation would have contained the kernel exploit within the guest OS.

Key Concept

Container vs. Virtual Machine Security Boundaries & Kernel Sharing Risk
Question 150Question →

A network security administrator is setting up access rules for an enterprise environment to ensure strict isolation between public web servers and internal databases, while also maintaining secure remote administrative access. Which TWO network architecture and segmentation practices should the administrator implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Place the public-facing web servers inside a Demilitarized Zone (DMZ) to restrict direct traffic to the internal network.; Deploy a jump box (bastion host) to proxy and audit administrative management traffic into sensitive network segments.

Answer

The network security administrator should deploy public web servers inside a Demilitarized Zone (DMZ) and use a jump box (bastion host) to proxy administrative traffic.
Placing public web servers within a DMZ ensures inbound internet traffic is isolated from the private internal network. Using a jump box secures management sessions by funneling administrator access through a single hardened access control point.

Step-by-Step Solution

1
Evaluate perimeter and public service isolation needs.
Identify that public-facing servers should reside in a DMZ so that compromise of a web server does not grant direct access to internal assets.
Segmenting untrusted public traffic prevents direct lateral penetration into internal enterprise networks.
2
Evaluate secure administrative access requirements.
Identify that administrative access should be routed through a dedicated jump box (bastion host).
A jump box provides an isolated gateway for administrative sessions, enforcing MFA, monitoring, and precise access control across network boundaries.

Key Concept

Demilitarized Zone (DMZ) isolation and Jump Box access control in secure network design
Question 151Question →

A security analyst is reviewing the security architecture for a hybrid cloud deployment containing both virtual machines and containerized applications. Match each security mechanism on the left with its primary isolation property on the right.

Click a left item, then click its matching right item

Items

Kernel Namespaces
Control Groups (cgroups)
Type 1 Hypervisor
Microsegmentation

Matches

Show answer & explanation

Answer

Kernel Namespaces match process-level visibility segregation within a shared OS kernel. Control Groups (cgroups) match restricting hardware resource consumption. Type 1 Hypervisor matches abstracting physical hardware for strong VM isolation. Microsegmentation matches enforcing granular network traffic control and boundaries.
Kernel namespaces isolate what processes can see (PIDs, network adapters, filesystems). Control groups (cgroups) control how much host hardware resources a container can use. Type 1 hypervisors run directly on hardware to deliver rigid virtual machine isolation. Microsegmentation creates micro-perimeters around workloads to control east-west network traffic.

Step-by-Step Solution

1
Analyze container OS kernel isolation constructs.
Linux kernel namespaces isolate process visibility (e.g., PID space, mount points), while control groups (cgroups) govern resource usage constraints like CPU and memory limits.
Distinguishing between resource visibility isolation and resource consumption limiting is fundamental to container host hardening.
2
Evaluate hypervisor virtual machine abstraction capabilities.
A Type 1 bare-metal hypervisor mediates guest operating system interactions directly on hardware, creating strong isolation boundaries that prevent inter-VM compromises.
Virtual machines run discrete guest kernels, providing stronger containment than shared-kernel container architectures.
3
Identify network security mechanisms for virtualized environments.
Microsegmentation implements policy-driven network access controls around individual microservices or VMs to restrict east-west lateral traffic.
Network-level isolation complements host-level container and hypervisor execution boundaries.

Key Concept

Virtualization and Container Isolation Mechanisms
Question 152Question →

An organization is transitioning several legacy applications to a containerized deployment. A security administrator is explaining to the development team why container security boundaries differ from traditional virtual machine (VM) security boundaries. Which of the following statements accurately describes a fundamental isolation difference between containers and VMs?

Show answer & explanation

Answer: Containers share the host operating system kernel, whereas virtual machines utilize a hypervisor to isolate independent operating systems with dedicated kernels.

Answer

Containers share the host operating system kernel, whereas virtual machines utilize a hypervisor to isolate independent operating systems with dedicated kernels.
Containers operate via OS-level virtualization, sharing the host system's kernel to run application processes in isolated user spaces. In contrast, virtual machines utilize a hypervisor to abstract physical hardware, running separate guest operating systems each with their own dedicated kernel. Understanding this kernel-sharing model is critical because a vulnerability in the shared host kernel can compromise all containers on that system.

Step-by-Step Solution

1
Analyze the architectural boundary of application containers.
Containers run as isolated user-space processes that share the underlying host operating system kernel.
Containerization relies on OS-level virtualization (such as Linux namespaces and cgroups) rather than full hardware emulation.
2
Analyze the architectural boundary of virtual machines.
Virtual machines run complete guest operating systems managed by a hypervisor.
Hypervisors abstract physical hardware, providing hardware-level isolation where each guest VM operates with its own kernel.
3
Select the statement that correctly contrasts container and VM isolation mechanisms.
The statement highlighting host kernel sharing for containers versus hypervisor-based OS isolation for VMs is correct.
This captures the primary security boundary distinction between OS-level containerization and hardware-level virtualization.

Key Concept

Container versus Virtual Machine Isolation Boundaries
Estimated Time:45s
Question 153Question →

A global retail organization is transitioning its legacy transaction processing platform to a hybrid cloud deployment model. The architecture uses Infrastructure as a Service (IaaS) to host legacy relational database instances and Platform as a Service (PaaS) to host modern containerized web frontends. During a cloud architecture security review, the lead security engineer must define operational boundaries under the Shared Responsibility Model for both service types. Which of the following security management tasks remain the exclusive responsibility of the organization across BOTH the IaaS database instances and PaaS web frontends? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Classifying application-layer data assets and configuring data access authorization controls; Configuring Identity and Access Management (IAM) role permissions and API access credentials for application users

Answer

Classifying application-layer data assets and configuring data access authorization controls, along with configuring Identity and Access Management (IAM) role permissions and API access credentials for application users, are tasks exclusively retained by the cloud customer in both IaaS and PaaS environments.
In the cloud Shared Responsibility Model, data management (including data classification, payload security, and access rules) and Identity and Access Management (IAM identity lifecycle and privilege assignment) are customer responsibilities regardless of whether the model is IaaS, PaaS, or SaaS. Therefore, classifying application data assets and configuring IAM permissions for API endpoints are customer-managed duties across both environments.

Step-by-Step Solution

1
Analyze the IaaS responsibility scope
In IaaS, the cloud customer manages the operating system, runtime, middleware, data, and access configurations, while the provider manages physical facilities, hardware, and hypervisors.
Establishing customer baseline responsibilities for the database instances.
2
Analyze the PaaS responsibility scope
In PaaS, the provider assumes responsibility for the underlying operating system, middleware, and database engines/runtimes, leaving the customer responsible for application code, data classification, and IAM policies.
Identifying which tasks shift to the cloud provider when moving from IaaS to PaaS.
3
Determine overlapping customer responsibilities across both models
Data governance/classification and Identity and Access Management (IAM) permissions remain customer duties in both service models, whereas OS kernel patching shifts to the provider in PaaS.
Selecting the two options that are exclusively customer-managed in both IaaS and PaaS.

Key Concept

Shared Responsibility Model boundaries across IaaS and PaaS cloud service models
Estimated Time:2m 0s
Question 154Question →

An enterprise financial organization is redesigning its Storage Area Network (SAN) security architecture to comply with data-at-rest encryption requirements for bulk database backups. The design must eliminate host server CPU overhead during cryptographic operations and safeguard encryption keys against physical tampering or theft from the data center. Which of the following storage security solutions best meets these requirements?

Show answer & explanation

Answer: Implementation of Self-Encrypting Drives (SEDs) backed by an enterprise Hardware Security Module (HSM) for key management

Answer

Deploying Self-Encrypting Drives (SEDs) coupled with an enterprise Hardware Security Module (HSM) for cryptographic key management.
Self-Encrypting Drives (SEDs) offload cryptographic processing to dedicated drive hardware, executing symmetric encryption at full bus speed without host OS performance overhead. Utilizing a Hardware Security Module (HSM) ensures secure, centralized management of the key encryption keys within a physical and logical tamper-evident security boundary, satisfying all performance and security architecture requirements.

Step-by-Step Solution

1
Analyze the performance requirement for bulk storage encryption at rest.
Hardware-based encryption offloaded to drive hardware prevents host server performance degradation.
Self-Encrypting Drives (SEDs) utilize dedicated AES coprocessors on the disk controller to encrypt and decrypt data at line speed without consuming host CPU cycles.
2
Evaluate key protection against physical data center theft.
Centralized key protection requires a tamper-resistant hardware security boundary.
Integrating SEDs with an external Hardware Security Module (HSM) protects Key Encryption Keys (KEKs) and prevents unauthorized access to encrypted drives if physically removed.

Key Concept

Data Protection at Rest & Storage Key Security (SED and HSM)
Question 155Question →

A DevOps team is deploying microservices within a containerized environment on Linux host servers. The system administrator needs to enforce hard limits on CPU usage and memory consumption for individual containers to prevent a single compromised or misconfigured container from exhausting shared host system resources. Which Linux kernel mechanism should be configured to directly enforce these resource limits?

Show answer & explanation

Answer: Control groups (cgroups)

Answer

Control groups (cgroups) are used to limit and isolate physical resource consumption such as CPU and RAM for container processes.
Control groups (cgroups) are the Linux kernel feature designed specifically to restrict, allocate, and measure hardware resources (CPU, RAM, block I/O) assigned to containerized process hierarchies.

Step-by-Step Solution

1
Identify the goal of the control
The requirement is host-level CPU and memory resource governance for containerized applications.
Preventing a single container from starving host resources requires kernel-level resource allocation constraints.
2
Differentiate container kernel mechanisms
Linux namespaces provide visibility isolation (viewing processes, network cards, IPC), whereas control groups (cgroups) regulate hardware resource consumption boundaries.
cgroups explicitly handle resource metering and throttling for process collections.

Key Concept

Resource isolation and constraint mechanisms in container security (cgroups vs namespaces)
Question 156Question →

An enterprise security architect is refining the workload protection matrix for a multi-tenant cloud environment hosting both legacy virtualized infrastructure and microservice containers. Match each virtualization or containerization security control on the left to its corresponding isolation property or policy enforcement mechanism on the right.

Click a left item, then click its matching right item

Items

Control Groups (cgroups)
Linux Namespaces
Type-1 Hypervisor Isolation
CNI Microsegmentation

Matches

Show answer & explanation

Answer

Control Groups (cgroups) matches with enforcing resource utilization quotas; Linux Namespaces matches with providing segregated operational views of system resources; Type-1 Hypervisor Isolation matches with providing dedicated hardware-enforced abstraction directly on physical host processors; CNI Microsegmentation matches with implementing granular packet filtering rules at the virtual network layer.
Each security control aligns directly with its primary system level: cgroups manage hardware resource quotas (CPU/RAM/IO), namespaces isolate kernel object visibility (PID/NET/MNT), Type-1 hypervisors manage bare-metal hardware abstraction for full VM execution isolation, and CNI microsegmentation manages granular software-defined network traffic controls across pods.

Step-by-Step Solution

1
Analyze resource governing mechanisms for OS-level virtualization.
Control Groups (cgroups) strictly manage resource boundaries such as CPU limits, memory quotas, and block I/O rates to stop noisy-neighbor resource exhaustion.
cgroups provide hardware resource allocation control rather than structural visibility isolation.
2
Evaluate process and environment isolation primitives in container engines.
Linux Namespaces provide discrete visibility domains (PID, NET, IPC, MNT, UTS, USER) preventing one container from inspecting or interacting with system objects of another.
Namespaces abstract what a process can see rather than limiting how much CPU or RAM it consumes.
3
Examine hypervisor architectural models and hardware separation boundaries.
Type-1 (bare-metal) hypervisors run directly on underlying physical hardware host chips to enforce VM memory and CPU execution isolation without depending on a general-purpose host OS.
This establishes hardware ring isolation distinct from container kernel-sharing.
4
Determine modern network isolation methods within container orchestration systems.
CNI Microsegmentation utilizes eBPF or iptables at the virtual interface layer to enforce Zero Trust security rules on East-West traffic between container endpoints.
Microsegmentation protects pod-to-pod network pathways rather than host compute resources.

Key Concept

Virtualization and Containerization Security Mechanisms
Question 157Question →

A fleet logistics company transitions its core routing engine to an Infrastructure as a Service (IaaS) environment provided by a public cloud vendor. The IT team deploys multiple virtual machines to host the application software. Which of the following operational security responsibilities remains exclusively with the logistics company?

Show answer & explanation

Answer: Configuring guest operating system firewall rules and applying system patches to the virtual machines

Answer

Configuring guest operating system firewall rules and applying system patches to the virtual machines
Under the Cloud Shared Responsibility Model for Infrastructure as a Service (IaaS), the cloud service provider manages the physical infrastructure, storage hardware, physical data center security, and the hypervisor layer. The subscriber retains full administrative control and operational responsibility for the guest operating systems, including patching, local host firewall configurations, installed software packages, and data governance.

Step-by-Step Solution

1
Identify the cloud service model referenced in the scenario.
The scenario specifies an Infrastructure as a Service (IaaS) deployment model.
Responsibilities in cloud computing depend directly on whether the service model is IaaS, PaaS, or SaaS.
2
Apply the Shared Responsibility Model to IaaS.
The cloud service provider (CSP) manages the physical facilities, host hardware, and virtualization hypervisor. The customer manages the guest operating system, network firewalls on instances, middleware, applications, and customer data.
IaaS provides maximum customer control over the virtualized operating environment, shifting OS and network control duties to the customer.
3
Evaluate the choices to determine which task belongs strictly to the customer.
Managing guest OS patches and host-based firewalls on virtual machines is a customer responsibility under IaaS.
The CSP cannot access or manage the internal guest OS configuration without customer authorization and access provision.

Key Concept

Cloud Shared Responsibility Model in IaaS Deployments
Question 158Question →

Match each storage security mechanism or state to its corresponding enterprise data protection objective.

Click a left item, then click its matching right item

Items

Data Masking
Data in Transit Protection
Cryptographic Erasure
SAN Isolation

Matches

Show answer & explanation

Answer

Data Masking pairs with replacing sensitive dataset values with realistic structural proxies for development environments; Data in Transit Protection pairs with securing data traversing network links between host servers and storage arrays using TLS or IPSec; Cryptographic Erasure pairs with sanitizing retired media by destroying encryption keys; SAN Isolation pairs with restricting logical storage volume access using Fibre Channel zoning and LUN masking.
The correct matches align each security mechanism with its explicit implementation objective: Data Masking replaces sensitive values for test environments; Data in Transit Protection encrypts network pathways between hosts and arrays using protocols like TLS/IPSec; Cryptographic Erasure sanitizes media by destroying encryption keys; SAN Isolation isolates storage volumes to authorized host systems using LUN masking and Fibre Channel zoning.

Step-by-Step Solution

1
Analyze each storage security concept listed on the left.
Identified four key concepts: Data Masking (obfuscation), Data in Transit Protection (network transport security), Cryptographic Erasure (media sanitization), and SAN Isolation (storage network access control).
Understanding the core functional domain of each storage security control is required to pair it correctly.
2
Correlate each control with its technical implementation objective listed on the right.
Data Masking correlates to proxy values for testing; Data in Transit to TLS/IPSec network encryption; Cryptographic Erasure to key destruction; SAN Isolation to Fibre Channel zoning and LUN masking.
These associations accurately reflect standard enterprise storage security architecture practices.

Key Concept

Data Protection and Storage Security Architecture Controls
Question 159Question →

A security architect is reviewing the access control path for remote administrators connecting from an untrusted management subnet to a high-security internal database zone holding regulated financial records. To enforce defense-in-depth and zero-trust principles, traffic must traverse multiple inspection boundaries and transit controls in a precise order. Sequence the security controls and transit points in the correct order that administrative network traffic must navigate from the originating management workstation to the target database server.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts at the perimeter firewall filtering incoming management traffic, proceeds to session establishment on the Jump Server in the DMZ, moves through the internal NGFW performing East-West inspection, and finishes at the microsegmented target switch port and host boundary.
In secure network architecture, traffic moving from an outer management zone to an inner critical zone follows a strict transit path: 1) Initial perimeter firewall filtering, 2) Intermediate bastion/jump box session proxying in a DMZ, 3) Internal NGFW microsegmentation and East-West inspection, and 4) Final Layer 2 PVLAN and host-level enforcement.

Step-by-Step Solution

1
Filter ingress connection attempts at the perimeter boundary.
Unsanctioned external traffic is blocked before entering management proxies.
Perimeter firewalls filter initial traffic entering from outer or untrusted administrative networks.
2
Terminate administrative credentials and session handling on a dedicated Jump Server within the DMZ.
Direct connections between management workstations and internal databases are prevented.
Bastion hosts act as authorized intermediate transit points for administrative commands.
3
Inspect inter-zone (East-West) traffic leaving the Jump Server using an internal NGFW.
Application-layer protocols and microsegmentation rules are verified before traffic crosses into internal zones.
Internal firewalls enforce granular policy barriers between DMZ transit hosts and restricted database tiers.
4
Deliver traffic to the destination database server host across Private VLAN (PVLAN) isolated switch ports.
Target server accepts traffic exclusively from the authorized NGFW gateway IP.
Layer 2 PVLAN isolation and endpoint firewalls ensure lateral isolation within the database subnet itself.

Key Concept

Zone Traversal and Network Segmentation Order
Question 160Question →

An enterprise facility contains legacy operational technology (OT) devices that cannot receive security updates or support modern encryption protocols. Which network design approach provides the most complete protection by physically isolating these critical devices from all untrusted and corporate network traffic?

Show answer & explanation

Answer: Establishing an air-gapped network segment that has no physical or logical interface connections to external networks

Answer

Establishing an air-gapped network segment that has no physical or logical interface connections to external networks is the correct choice.
Air-gapping ensures that a network segment is physically and logically disconnected from all other networks, including internal corporate networks and the internet. For legacy OT equipment that cannot be patched or secured via software, air-gapping provides the strongest possible boundary control.

Step-by-Step Solution

1
Identify the risk and constraint presented in the scenario
The legacy OT systems cannot be patched or upgraded with modern encryption, making them extremely vulnerable to network-based attacks.
Vulnerable systems must be protected using compensating architectural controls when system-level hardening is impossible.
2
Evaluate network isolation techniques for maximum protection
An air gap provides absolute physical and logical separation from internet-connected networks, eliminating direct electronic attack vectors.
Without any physical or logical network interface connecting the networks, remote network exploitation is prevented.

Key Concept

Air-gapping and Network Isolation
PreviousPage 8 / 21Next
Security Architecture Practice Questions — CompTIA Security+ — Page 8 | Examkin