Examkin

Soru

Zorluk: OrtaCryptographic and Security Control Weaknesses

During a security assessment of a healthcare organization's cloud microservices, security engineers observe two critical design choices: internal microservices grant unrestricted access to API endpoints based strictly on whether incoming requests originate from internal IP address ranges, and large patient diagnostic image files stored at rest are encrypted individually using asymmetric RSA keys. Which of the following statements correctly identifies the primary architectural and cryptographic weaknesses in this design?

  1. Implicitly trusting internal IP addresses fails to enforce continuous authentication, while encrypting bulk files with asymmetric algorithms creates severe performance inefficiencies.Cevap
  2. B
    Using asymmetric encryption for bulk data storage is a corrective control misclassification, while internal IP allowlisting provides sufficient perimeter defense under Zero Trust frameworks.
  3. C
    Asymmetric algorithms should be selected for high-speed bulk data encryption instead of symmetric algorithms, while the internal IP allowlist should be replaced by submitting a Certificate Signing Request to a public Certificate Authority.
  4. D
    The primary weakness is a failure of technical control selection that requires deploying network firewalls at the host level rather than correcting the algorithm choice or access validation model.

Cevap

Implicitly trusting internal IP addresses fails to enforce continuous authentication, while encrypting bulk files with asymmetric algorithms creates severe performance inefficiencies.
The correct answer accurately identifies two fundamental weaknesses: granting access based on network location assumes implicit perimeter trust, violating Zero Trust principles; and encrypting large bulk data files directly with asymmetric ciphers causes extreme performance bottlenecks, whereas high-speed symmetric ciphers should be used for bulk data encryption.

Adım Adım Çözüm

1
Analyze the access control weakness in the scenario.
Relying strictly on internal IP addresses assumes that all internal network traffic is inherently safe, violating Zero Trust principles which demand explicit verification regardless of network location.
Perimeter-based IP trust allows an attacker who gains internal network access to move laterally without authentication checks.
2
Analyze the cryptographic weakness in the scenario.
Asymmetric algorithms (like RSA) involve heavy mathematical operations and are intended for key exchange, digital signatures, or small data envelopes—not for direct bulk data file encryption.
Symmetric encryption (such as AES) should be used for bulk data due to its high computational efficiency.
3
Synthesize findings to identify the matching architectural statement.
The correct evaluation couples the failure of implicit network trust with the performance bottleneck of bulk asymmetric encryption.
Hybrid encryption (using symmetric keys for data and asymmetric keys to wrap symmetric keys) combined with continuous microservice authentication solves both flaws.

Anahtar Kavram

Zero Trust network verification and symmetric versus asymmetric cryptographic application bounds
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Cryptographic and Security Control Weaknesses

Bu konudan daha fazla soru