Security Architecture

Match each Identity and Access Management (IAM) protocol to its primary architectural function in enterprise security environments.

A pharmaceutical enterprise has implemented a Zero Trust Architecture (ZTA) to secure access to proprietary clinical research data. During an active database session initiated via multi-factor authentication, the remote endpoint's client security agent reports that host firewall services were unexpectedly disabled. Which of the following actions best reflects the core tenets of Zero Trust in this scenario?

A security architect for an enterprise organization is designing network isolation controls across various operational environments. Match each security design requirement on the left to the network segmentation mechanism on the right that best satisfies it.

A DevSecOps engineer is configuring a shared Linux compute host that executes untrusted CI/CD pipeline container images. To minimize the risk of a container process exploiting kernel vulnerabilities or escalating privileges on the underlying host operating system, which of the following controls should be implemented? (Select TWO.)

A international maritime logistics enterprise operates edge storage appliances at remote port facilities to handle offline container manifest data. The security architecture team must ensure that if storage drives are physically stolen from an unattended facility, the data at rest cannot be extracted. Additionally, key lifecycle management must be centralized without relying on local site administrators to manually unlock storage volumes after a system reboot. Which of the following storage security architectures best meets these requirements?

A cloud security engineering team is designing an Identity and Access Management (IAM) architecture for microservices operating across multi-cloud Kubernetes environments. The architecture must enforce Zero Trust principles by replacing static API keys and long-lived service account tokens with short-lived X.509 certificates issued automatically through platform attestation rather than user credentials. Which of the following identity architecture solutions best satisfies these requirements?

An enterprise wants to allow its employees to securely sign in to multiple external cloud-based vendor applications using their central corporate identity provider, ensuring that user passwords are never transmitted to or stored by the external vendors. Which Identity and Access Management (IAM) architectural solution best fulfills this requirement?

A telemedicine organization is updating its infrastructure to align with Zero Trust Architecture (ZTA) principles for remote radiologists querying patient imaging databases hosted across hybrid cloud environments. The lead security architect mandates that access decisions must continuously evaluate user identity, device compliance, and real-time risk context, while separate proxy gateways enforce those authorization decisions at the resource boundary. Which of the following architectural implementations best satisfies this requirement?

A municipal transit authority is deploying connected physical traffic signal controllers deployed across city intersections. The controllers transmit real-time telemetry to a central management server and receive timing synchronization updates. If an attacker gains physical access to a single controller on a street pole, the security team must prevent the attacker from moving laterally to other signal controllers on the network. Which of the following network design strategies best achieves this objective?

A system administrator is tasked with improving server network availability for a critical database host. The host currently has a single network cable connected to a core switch, creating a single point of failure if the switch port or cable fails. The administrator installs a second network interface card (NIC) and connects it to a separate switch. Which of the following should the administrator configure on the server operating system to combine these adapters into a fault-tolerant network connection?

A security engineer is redesigning the network architecture for an automated logistics center. The facility incorporates smart building controllers (HVAC, environmental sensors, and smart lighting) that must continuously transmit status metrics outbound to a cloud management service. However, corporate compliance requires that these controllers must be strictly prohibited from initiating connection requests to the internal database servers or corporate workstations hosting sensitive supply chain data. Which of the following network architecture strategies best fulfills these requirements while reducing lateral movement risk?

A security architect is updating the enterprise storage protection strategy to safeguard sensitive data at rest and during access operations. Match each storage security control on the left with its primary operational mechanism on the right.

A security architect is designing a jump box administrative access path for a high-security internal database zone. Arrange the sequence of network traffic flows and security enforcement controls in the correct order, starting from the administrator's initial remote connection attempt and ending at the destination database server.

An enterprise organization is deploying IoT-enabled environmental monitoring sensors throughout its server infrastructure rooms. The sensors require outbound HTTPS communication to a third-party vendor's cloud telemetry platform for automated threshold alerting. However, security policy mandates that these IoT devices must be strictly restricted to prevent lateral movement toward core internal network assets in the event a sensor is compromised. Which of the following network architecture designs best meets these security requirements while enforcing least privilege?

An enterprise security architect is reviewing infrastructure resilience mechanisms to ensure continuous availability and disaster recovery readiness. Match each high-availability control on the left with the operational failover behavior or risk mitigation on the right.

An e-commerce platform requires local disk storage resilience for its transaction database host. The requirement states that if a single physical drive experiences a total hardware failure, the database must remain fully operational without service disruption or data loss while the failed hardware is replaced. Which of the following resilience controls best satisfies this requirement?

In a Zero Trust Architecture (ZTA) implementation following NIST SP 800-207, distinct logical components handle policy decisions, enforcement, and data boundaries. Match each Zero Trust functional component on the left with its core operational responsibility on the right.

An online education platform stores terabytes of static video assets on a high-throughput network-attached storage (NAS) array. To comply with data privacy standards, the organization must protect the stored media files against physical drive theft from the data center without creating CPU bottlenecks on the storage array controllers. The development team initially suggested using asymmetric RSA-4096 encryption for every file written to disk. Which storage security architecture should the security engineer recommend to meet both performance and data-at-rest confidentiality requirements?

An enterprise security architecture team is designing an automated identity mechanism to allow microservices running on an Amazon Web Services (AWS) Kubernetes cluster to securely request data from resources hosted on Google Cloud Platform (GCP). The solution must eliminate static, long-lived service account access keys, provide automated credential rotation, and cryptographically establish workload identity trust across cloud providers. Which of the following Identity and Access Management (IAM) architectural solutions best meets these requirements?

A cloud-native software enterprise is implementing Zero Trust Architecture (ZTA) principles across its microservices platform to prevent lateral movement following a potential system compromise. Which of the following implementation strategies best adheres to Zero Trust principles for service-to-service communication within the internal cluster?