Question 1

Sansa has moved the only Linux server within VPC1 to the Linux-only VPC15. The remaining servers in VPC1 all run Windows Server. Which of the following should she do on the firewall for VPC1?
A) Disable port 22
B) Disable port 3389
C) Disable port 53
D) Disable port 443

Accepted Answer

Port 22 is used for SSH, which is commonly used to connect to Linux servers. Since the only Linux server has been moved out of VPC1, disabling port 22 can enhance security by closing an unnecessary port. Ports 3389, 53, and 443 are used for RDP (commonly used for Windows servers), DNS, and HTTPS respectively, and may still be needed for the remaining Windows servers and other services.

Question 2

Samwell wants to create a lightly protected subnet within the VNet that acts as a filter between the Internet and the other internal network resources. Which of the following describes the type of subnet that he is looking to deploy?
A) ACL
B) GCP
C) STP
D) DMZ

Accepted Answer

A DMZ, or Demilitarized Zone, is a subnet that acts as a secure buffer between the internal network and untrusted external networks such as the internet. It is designed to provide an additional layer of security.

Question 3

Podrick wants to implement a technology on the company's servers that will detect any intrusions as well as implement rules or other methods to immediately stop traffic that appears to be an intrusion. Which of the following is he looking to install?
A) HIDS
B) HIPS
C) NIDS
D) NIPS

Accepted Answer

B

Question 4

Tormund has created a set of firewall rules and has noticed that when there is traffic that matches a rule, the traffic allowed in one direction automatically allows traffic in the other direction for an active connection as long as there is at least one message going in either direction within 10 minutes. What is the name of that type of firewall?
A) Stateless
B) Stateful
C) Status-monitoring
D) Active-analysis

Accepted Answer

Stateful firewalls keep track of the state of active connections and make decisions based on the context of the traffic, allowing return traffic for established connections.

Question 5

Eddard wants to install a VM running in the perimeter network that provides antivirus/anti-malware capabilities for the rest of the network. Which of the following describes the type of VM that he wants to install?
A) NSG
B) NVA
C) ASG
D) NTP

Accepted Answer

NVA stands for Network Virtual Appliance, which is a VM that runs in the cloud to provide network and security functions to other VMs or systems. In this context, an NVA providing antivirus/anti-malware capabilities fits the description.

Question 6

Hodor has a VPC that is only accessed by IP address and does not do any DNS lookups for any of the applications that it runs. Which of the following rules should he add to the firewall?
A) Deny port 53
B) Deny port 1433
C) Deny port 23
D) Deny port 69

Accepted Answer

Port 53 is used for DNS lookups. Since Hodor's VPC does not do any DNS lookups, denying port 53 on the firewall would not affect the operation of his applications and would enhance security by blocking unnecessary traffic.

Question 7

Missandei's manager has asked her to implement microsegmentation for her company's cloud deployment. She wasn't overly familiar with this term and upon researching came across the reasoning to implement this as being that nothing should be trusted in a cloud environment and every system, communication, and user is considered a threat until proven otherwise. Which of the following concepts does this describe?
A) Zero-trust security model
B) Proof positive security model
C) ID only security model
D) Assurance security model

Accepted Answer

The concept described is the Zero-trust security model, which operates on the principle that nothing inside or outside the network is trusted and verification is required from everyone trying to access resources in the network.

Question 8

Jon recently returned from an IT conference where he learned about a technology that could alert the administrators to any intrusions that may occur by installing software on each of the servers within the cloud deployment. Unfortunately, this particular system wouldn't stop the intrusion automatically. Which of the following technologies did he learn about?
A) HIPS
B) HIDS
C) NIPS
D) NIDS

Accepted Answer

HIDS (Host Intrusion Detection System) is designed to monitor and analyze the internals of a computing system as well as the network packets on its network interfaces. It does not prevent intrusions but can alert administrators to suspicious activities.

Question 9

Tyrion wants to use a virtual firewall to filter the types of traffic that are allowed or not allowed into a virtual private cloud instance he has created on the cloud service provider his company uses. Which of the following can he use to accomplish this goal?
A) VNC
B) NACL
C) NAT
D) VLAN

Accepted Answer

NACL, or Network Access Control List, is a feature used in cloud environments to control the traffic that is allowed or not allowed into a virtual private cloud (VPC) instance. It acts as a virtual firewall for controlling access at the subnet level.

Question 10

Joffrey is about to deploy a new web server. He wants to ensure that when a user accesses the server, that their web browsing session is encrypted between the browser and the server. Which of the following should he use with the web server to provide this functionality?
A) SSH
B) SSL
C) TLS
D) ACL

Accepted Answer

The answer of Joffrey is about to deploy a new...

Question 11

Khal has set up a new web server on the company's private cloud. He has installed the security certificate necessary so that the application can be accessed by HTTPS. He isn't overly familiar with how these certificates work, so he decides to read up on the details. He learns that there is a pair of keys used to encrypt and decrypt the initial communications. Which of the following is the key that does not get sent to the browser?
A) public key
B) private key
C) secret key
D) asymmetric key

Accepted Answer

The private key is the key that does not get sent to the browser in an HTTPS setup. It remains securely stored on the server and is used to decrypt information that was encrypted with the corresponding public key.

Question 12

Theon wants to transfer some files to one of the Linux servers that he manages. Which of the following would ensure that the transmissions are secure while not relying on SSL/TLS for the encryption?
A) FTP
B) FTPS
C) SFTP
D) TFTP

Accepted Answer

SFTP (SSH File Transfer Protocol) ensures secure file transfer by utilizing SSH (Secure Shell) for encryption, which does not rely on SSL/TLS.

Question 13

Stannis wants to block any traffic that uses insecure protocols from entering his VPC. Which of the following might he use to accomplish that goal?
A) Firewall
B) HIPS
C) HIDS
D) Anti-malware

Accepted Answer

Firewalls are designed to block unauthorized access while permitting authorized communications, which includes the capability to block traffic based on protocols, making it suitable for blocking insecure protocols from entering a VPC.

Question 14

Tommen is doing an audit and finds that the firewall still includes some rules for some Windows servers that no longer exist in a VPC. The remaining servers all run a variant of Linux. Which of the following rules should he delete from the firewall?
A) Allow port 3389
B) Allow port 53
C) Allow port 443
D) Allow port 80

Accepted Answer

Port 3389 is used for Remote Desktop Protocol (RDP), which is primarily used by Windows systems for remote management. Since the Windows servers no longer exist and the remaining servers run Linux, this rule is unnecessary. Ports 53, 443, and 80 are commonly used for DNS, HTTPS, and HTTP respectively, which are protocol services likely still needed by the Linux servers.

Question 15

Shae wants to implement antivirus in her cloud environments. Where should she look at installing this protection to be most effective?
A) Inside the DMZ
B) On each host of the network
C) On the e-mail servers
D) All of the other options are correct

Accepted Answer

Antivirus protection is most effective when implemented comprehensively across various components of the network, including the DMZ (to protect against external threats), on each host (to protect against threats that bypass perimeter defenses), and on email servers (to filter out malicious email content), ensuring a multi-layered defense strategy.

Question 16

Gendry has been learning more about security within the cloud after hearing that it is a hot topic within the IT industry. He starts reading up on SHA-3 being used for hashing. Which of the following best describes SHA-3?
A) Firewall
B) Key
C) ACL
D) Cipher

Accepted Answer

SHA-3 (Secure Hash Algorithm 3) is a cryptographic hash function, making it a type of cipher, not a firewall, key, or access control list (ACL).

Question 17

Davos has been reading about encryption recently. He begins to wonder how anything can be secure if everyone is using the same set of algorithms. After all, anyone using the same algorithm would be able to decrypt anything that had been encrypted using that algorithm. Which of the following helps make the data unusable by anyone else using that same encryption scheme without having this information?
A) Algorithm
B) Cipher
C) Key
D) Block

Accepted Answer

The key is what makes the data encrypted with a particular algorithm secure and unusable by anyone else without having the key. Even though the algorithm is known and can be used by anyone, the key is what differentiates one user's encrypted data from another's. It's the secret component that is needed to decrypt the data.

Question 18

Cersei wants to protect the application servers within her cloud deployment by implementing granular control of the traffic and workflows in the deployment. Which of the following would she implement?
A) Microsegmentation
B) Shadow IT
C) DDoS
D) Dos

Accepted Answer

Microsegmentation is a security technique that enables fine-grained security policies to be assigned to data center applications, down to the workload level. This approach allows for more secure separation of workloads in cloud and data center environments, helping to prevent unauthorized access and lateral movement within the network.

Question 19

Bran has recently learned about the CIA triad. He knows that encryption is important to a variety of things within his organization's infrastructure. One of those is the ability to ensure that data being transmitted across the network cannot be modified undetected. Which of the following tenets of the CIA triad supports this idea?
A) Confidentiality
B) Intrusion detection
C) Covert
D) Integrity

Accepted Answer

Integrity, one of the core principles of the CIA triad, ensures that data is not altered or tampered with during transmission or storage. Encryption helps in maintaining integrity by making it difficult for unauthorized parties to modify the data without detection.

Question 20

Arya is looking to install a security appliance that is designed to detect applications and other resources running within the domain and monitor them according to her organization's policies. Which of the following would she want to implement?
A) CASB
B) CIFS
C) CMDB
D) CAB

Accepted Answer

A CASB (Cloud Access Security Broker) is designed to monitor and enforce security policies for applications and resources in the cloud, making it the correct choice for Arya's needs.

Quiz 6: Securing Cloud Resources

Sansa has moved the only Linux server within VPC1 to the Linux-only VPC15. The remaining servers in VPC1 all run Windows Server. Which of the following should she do on the firewall for VPC1?

Samwell wants to create a lightly protected subnet within the VNet that acts as a filter between the Internet and the other internal network resources. Which of the following describes the type of subnet that he is looking to deploy?

Podrick wants to implement a technology on the company's servers that will detect any intrusions as well as implement rules or other methods to immediately stop traffic that appears to be an intrusion. Which of the following is he looking to install?

Eddard wants to install a VM running in the perimeter network that provides antivirus/anti-malware capabilities for the rest of the network. Which of the following describes the type of VM that he wants to install?

Hodor has a VPC that is only accessed by IP address and does not do any DNS lookups for any of the applications that it runs. Which of the following rules should he add to the firewall?

Tyrion wants to use a virtual firewall to filter the types of traffic that are allowed or not allowed into a virtual private cloud instance he has created on the cloud service provider his company uses. Which of the following can he use to accomplish this goal?

Joffrey is about to deploy a new web server. He wants to ensure that when a user accesses the server, that their web browsing session is encrypted between the browser and the server. Which of the following should he use with the web server to provide this functionality?

Theon wants to transfer some files to one of the Linux servers that he manages. Which of the following would ensure that the transmissions are secure while not relying on SSL/TLS for the encryption?

Stannis wants to block any traffic that uses insecure protocols from entering his VPC. Which of the following might he use to accomplish that goal?

Tommen is doing an audit and finds that the firewall still includes some rules for some Windows servers that no longer exist in a VPC. The remaining servers all run a variant of Linux. Which of the following rules should he delete from the firewall?

Shae wants to implement antivirus in her cloud environments. Where should she look at installing this protection to be most effective?

Gendry has been learning more about security within the cloud after hearing that it is a hot topic within the IT industry. He starts reading up on SHA-3 being used for hashing. Which of the following best describes SHA-3?

Cersei wants to protect the application servers within her cloud deployment by implementing granular control of the traffic and workflows in the deployment. Which of the following would she implement?

Arya is looking to install a security appliance that is designed to detect applications and other resources running within the domain and monitor them according to her organization's policies. Which of the following would she want to implement?