Security Architecture practice questions

Answer: A) Scalability

• AScalability lets capacity grow and shrink with demand, maintaining availability under load.
• BData sovereignty concerns where data is stored legally.
• CPlatform diversity uses varied technologies to avoid common weaknesses.
• DPhysical isolation separates systems with no connection.

Answer: A) Place the pump on an isolated network segment with tightly restricted access rules

A device that can't be patched or modified needs compensating controls. Isolating it on a restricted network segment is the main way to cut its exposure without changing the device itself.

• ACorrect. When a device can't be patched or changed, isolating it on its own segment, with firewall rules that allow only the communication it needs, limits who can reach it and how far an attack could spread. Microsoft's OT/IoT guidance calls for segmenting and isolating these devices before applying other controls.
• BIncorrect. The pump is certified only as a complete unit, so adding agent software isn't allowed and could void the certification. Embedded devices also usually can't run third-party agents.
• CIncorrect. The stem says no updates can be applied on site, so a patching schedule isn't an option. Compensating controls are needed when patching isn't possible.
• DIncorrect. Scanning finds weaknesses but doesn't reduce exposure, and the device couldn't be fixed anyway. Microsoft also warns that active scanning can crash fragile OT/IoT devices and recommends passive monitoring instead.

Answer: A) Restricted

• ARestricted data carries the strictest handling and access controls in many classification schemes.
• BPublic data can be shared freely with no harm.
• CInternal data is for employees generally, and its disclosure causes limited harm.
• D"Open" isn't a protective classification level.

Answer: A) East-west traffic is limited to explicitly allowed flows per workload, containing lateral movement after a compromise

Microsegmentation enforces least-privilege east-west policy for each workload, so a breached host's lateral movement is contained. It adds rule complexity, does not encrypt traffic, and is not mainly an edge control.

• AMicrosegmentation applies least-privilege filtering at the workload level. A compromised host can reach only the peers and ports its policy allows, so the attacker cannot move freely inside a broad VLAN.
• BPer-workload policies usually increase the number of rules and the management overhead. Microsoft calls out this complexity as a tradeoff and a risk of over-segmentation.
• CSegmentation filters which flows are allowed; it does not encrypt them. Protecting data in transit still requires something like TLS or IPsec.
• DMicrosegmentation mainly controls east-west traffic between internal workloads. Edge firewalls still handle north-south traffic.

Answer: A) Out-of-band, via a switch SPAN/mirror port or a passive network tap (as an IDS)

• AA tap or mirror port feeds the sensor a copy of traffic without being in the forwarding path, so a sensor failure or overload can't drop production traffic. Inline placement (IPS) can block but becomes a potential point of failure/latency.
• BInline placement can block traffic and, if the device fails, can break connectivity — contrary to the requirement.
• CWith no traffic mirrored to it, the sensor can't detect anything.
• DThat puts it directly in the data path as a single point of failure — the opposite of passive monitoring.

Answer: A) Tunnel mode

• ATunnel mode encapsulates the whole original packet, which suits gateway-to-gateway VPNs.
• BTransport mode protects only the payload, keeping the original IP header; it's typical for host-to-host links.
• CAggressive mode is an IKE negotiation option, not a packet-handling mode.
• DSplit tunneling decides which traffic uses the VPN; it isn't an IPsec packet mode.

Answer: A) Geographic restrictions

• AGeolocation-based rules limit access to approved regions, reducing exposure to foreign attackers.
• BTokenization replaces sensitive values with tokens.
• CMasking hides parts of data values in displays or copies.
• DHashing produces one-way digests; it doesn't restrict where sign-ins come from.

Answer: A) Recovery Point Objective (RPO) = 15 minutes; Recovery Time Objective (RTO) = 2 hours

• ARPO is the maximum acceptable data loss measured back in time from the incident; RTO is the maximum acceptable time to restore service. They drive backup frequency and DR site design respectively.
• BThe values are reversed — data loss tolerance is the RPO, restoration time is the RTO.
• CMTBF/MTTR describe hardware reliability and repair time, not the disaster-recovery data-loss and downtime objectives stated here.
• DMTD is a single overall limit; the scenario clearly distinguishes acceptable data loss from acceptable outage duration.

Answer: A) Geographic restrictions that limit storage and processing to approved regions

A requirement about where data is stored and processed calls for geographic restrictions (data residency or localization). Masking, encryption, and hashing protect data but do not control its location.

• ACorrect. Geographic restrictions (data residency or localization controls) decide where data may be stored and processed. Examples include choosing a cloud region and limiting replication to locations inside the required country.
• BIncorrect. Masking hides sensitive fields from people who should not see them. It has no effect on the physical or legal location where the records are stored or processed.
• CIncorrect. Encryption protects confidentiality, but encrypted records can still be stored or processed in another country. That would still break a requirement that the data never leave the country.
• DIncorrect. Hashing is used for integrity checks and for storing values such as passwords. It does not control where data lives, and hashed records could not be processed normally anyway.

Answer: A) An out-of-band management network

• AOut-of-band management uses a dedicated, isolated path (separate interfaces/console servers/VLAN) for administration, improving both security and recoverability during incidents.
• BThat's the very coupling out-of-band management avoids.
• CGuest Wi-Fi is for untrusted visitor devices, not device administration.
• DA CDN caches and delivers content to users; unrelated to device management paths.