Software and Systems Security

Question 1 of 60

1. Question

A company is considering moving its IT infrastructure to the cloud to improve flexibility and scalability. Which of the following security solutions should they consider to address the risks of cloud infrastructure management compared to on-premises?

Implementing a robust Identity and Access Management (IAM) solution
Regularly patching and updating software and firmware
Implementing a physical security perimeter around the cloud data center
Restricting all access to the cloud to trusted internal employees only

Question 2 of 60

2. Question

A small business is concerned about the risk of asset theft and wants to implement a security solution that can help identify stolen assets. Which security solution would be MOST effective for this purpose?

Encryption
Asset tagging
Access control
Intrusion detection

Question 3 of 60

3. Question

In a large data center, a security administrator wants to reduce the risk of unauthorized access to sensitive data by implementing physical segmentation. Which of the following would be the most effective solution?

Deploying virtual firewalls to restrict traffic between different virtual machines
Using VLANs to logically separate network traffic from different departments
Separating servers that process sensitive data from other servers using different physical switches
Creating a separate administrative network to control access to management interfaces.

Question 4 of 60

4. Question

A company wants to limit the impact of a security breach in the event that an attacker gains access to their network. Which of the following physical segmentation techniques would be the MOST appropriate?

Using VPNs to securely connect remote workers to the company network
Deploying a DMZ to separate external-facing servers from internal servers
Implementing VLANs to separate network traffic from different departments
Setting up an air gap between sensitive servers and the public network

Question 5 of 60

5. Question

A company wants to improve the security of its cloud-based infrastructure. They currently have multiple departments that use the same cloud environment, and they want to make sure that each department can only access the resources that they are authorized to use. Which of the following solutions would be the BEST to implement for this scenario?

VLANs
VPC
VPN
VRF

Question 6 of 60

6. Question

A company has a large number of virtual machines running on a single physical server. They are concerned about security risks associated with having all of the virtual machines on the same network segment. Which of the following solutions would be the BEST to implement for this scenario?

VLANs
VPN
VPC
VRF

Question 7 of 60

7. Question

In order to secure its network, a company has decided to implement a jumpbox. Which of the following is a benefit of using a jumpbox for segmentation?

It reduces the attack surface by limiting direct access to sensitive resources
It provides an additional layer of encryption for data transmission
It ensures that all network traffic passes through a single point of entry
It improves network performance by distributing processing power across multiple servers

Question 8 of 60

8. Question

A company wants to ensure the security of its network infrastructure. The company has multiple offices, and each office is connected to the internet through a dedicated leased line. The company’s IT team wants to implement security controls to protect against unauthorized access, network attacks, and other threats. Which of the following is the BEST solution to implement for physical network security?

Implement firewalls at each office location
Implement intrusion detection and prevention systems at each office location
Implement physical access controls at each office location
Implement virtual private networks (VPNs) at each office location

Question 9 of 60

9. Question

A company wants to implement a new network architecture that allows for greater agility and scalability, while also providing more robust security measures. The IT team has proposed a software-defined networking (SDN) solution. Which of the following is a security benefit of SDN?

Hardware-based firewalls can be more easily managed
Network traffic is better optimized for faster speeds
Security policies can be more easily enforced across the network
It is easier to detect and respond to security breaches

Question 10 of 60

10. Question

A company has decided to move its IT infrastructure to a virtual private cloud (VPC) to reduce costs and improve flexibility. As a security analyst, which of the following is the BEST control to implement to secure the VPC?

Configure network access control lists (ACLs) to restrict inbound and outbound traffic
Implement intrusion detection and prevention systems (IDPS) to monitor network traffic
Install antivirus software on all virtual machines (VMs) in the VPC
Require multi-factor authentication (MFA) for all users accessing the VPC

Question 11 of 60

11. Question

A company has recently adopted a serverless architecture for its applications. The company wants to ensure that it has visibility and control over its cloud resources. Which of the following tools can help achieve this goal?

Virtual private network (VPN)
Network intrusion detection system (NIDS)
Cloud access security broker (CASB)
Security information and event management (SIEM)

Question 12 of 60

12. Question

A company is planning to migrate its existing applications to a containerized environment to improve scalability and deployment speed. Which of the following security controls should be implemented to mitigate the risk of container breakout attacks?

Implement network segmentation between containers
Configure strong access control policies for container images
Enforce regular container image scanning for vulnerabilities
Implement secure communication between containers

Question 13 of 60

13. Question

A company has adopted a container orchestration tool for its application infrastructure. The security team is concerned about the risk of unauthorized access to sensitive data stored in the containers. Which of the following security controls should be implemented to mitigate this risk?

Implement data encryption for containers
Configure strict role-based access control policies for container orchestration
Enforce regular password rotation for container images
Implement container network segmentation

Question 14 of 60

14. Question

A company wants to implement stronger security measures to protect its sensitive data. The IT team has suggested implementing multifactor authentication (MFA) for all employees accessing company systems remotely. Which of the following is the BEST reason to implement MFA in this scenario?

MFA simplifies the login process for employees
MFA reduces the risk of unauthorized access
MFA increases the network speed and efficiency
MFA allows employees to use weak passwords

Question 15 of 60

15. Question

A company is implementing a new SaaS application that will be used by all employees. The IT team is concerned about the potential security risks of employees using weak passwords or sharing their credentials with others. What is the BEST solution to mitigate these risks?

Implement single sign-on (SSO) authentication for the SaaS application
Enforce password complexity rules for the SaaS application
Implement a password manager for employees to securely store their passwords
Use two-factor authentication for the SaaS application

Question 16 of 60

16. Question

A developer is coding a new application that requires a large amount of memory to store user input data. During testing, it is found that an attacker can overflow the heap and execute arbitrary code. Which of the following is the most effective control to mitigate this attack?

Implementing input validation to ensure that user input data does not exceed the available memory limit
Using a secure development framework to reduce the risk of coding errors and vulnerabilities
Enforcing stack canaries to prevent buffer overflows
Implementing Address Space Layout Randomization (ASLR) to make it difficult for attackers to find and exploit vulnerabilities

Question 17 of 60

17. Question

A company wants to implement a new security solution to detect and prevent attacks on its network. They are considering using a honeypot. Which of the following is the BEST explanation for a honeypot?

A honeypot is a network decoy that is set up to lure attackers away from the real network and detect and analyze their behavior
A honeypot is a tool that scans a network for vulnerabilities and reports them to the administrator
A honeypot is a type of intrusion detection system that actively monitors and blocks suspicious network traffic
A honeypot is a type of firewall that is designed to prevent unauthorized access to a network

Question 18 of 60

18. Question

A company is concerned about the increasing number of attacks on its network and wants to implement additional security measures. They are considering using a honeypot to detect and prevent attacks. Which of the following is a potential disadvantage of using a honeypot?

Honeypots can be expensive to set up and maintain
Honeypots can generate false positives, leading to wasted resources
Honeypots can slow down network performance
Honeypots can create a single point of failure in the network

Question 19 of 60

19. Question

A company’s web application is experiencing multiple unauthorized login attempts. The security team wants to implement a security solution to detect and prevent such attacks in the future. Which of the following security solutions should the security team implement?

Intrusion Prevention System (IPS)
Security Information and Event Management (SIEM)
Firewall
Data Loss Prevention (DLP)

Question 20 of 60

20. Question

A company is planning to send confidential information over a network that is shared with other organizations. Which of the following options should be used to protect the confidentiality of the information?

Symmetric encryption
Public key encryption
Hashing
Steganography

Question 21 of 60

21. Question

A company is concerned about the potential for insider threats and wants to implement active defense mechanisms to deter malicious actors. Which of the following is an example of an active defense mechanism?

A firewall that only allows traffic from whitelisted IP addresses
A honeypot server that simulates vulnerabilities to attract attackers
A SIEM tool that analyzes logs for suspicious activity
An IDS system that sends alerts when it detects anomalous behavior

Question 22 of 60

22. Question

A software development team is working on a mobile app for a company. The team wants to implement software assurance best practices to ensure the security of the app. Which of the following practices should they implement specifically for mobile platforms?

Use of a web application firewall (WAF)
Code obfuscation
Hardening the operating system
Testing for known vulnerabilities

Question 23 of 60

23. Question

A company has a bring-your-own-device (BYOD) policy in place. The IT department wants to ensure that employees can securely access company resources on their mobile devices. Which of the following software assurance best practices should they implement for mobile platforms?

Encryption of data in transit and at rest
Use of a containerization technology
Implementation of biometric authentication
Regular security updates

Question 24 of 60

24. Question

A company has developed a new web application that will allow customers to make purchases online. Which of the following is a software assurance best practice that should be implemented to ensure the security of the payment process?

Store customer payment information in plaintext
Use a secure SSL/TLS connection for all payment transactions
Allow customers to use weak passwords for their accounts
Store customer payment information on an unsecured server

Question 25 of 60

25. Question

A company is designing a new IoT device that will be powered by a System-on-chip (SoC) and will be connected to the internet. What is the BEST software assurance practice that should be implemented to ensure the security of the device?

Implement a secure boot process
Conduct penetration testing
Apply virtual patching
Perform static code analysis

Question 26 of 60

26. Question

A company is using embedded systems in their devices that require firmware updates. What is the best practice for ensuring the security of firmware updates?

Digitally sign the firmware update with a trusted certificate authority
Allow automatic firmware updates without user intervention
Store the firmware update on a public cloud server for easy access
Use a generic password for all firmware updates

Question 27 of 60

27. Question

A software development team is working on a new project and wants to ensure that security is integrated throughout the SDLC. Which of the following is an important step in integrating software assurance best practices into the SDLC?

Conducting a penetration test on the software after it has been deployed
Providing end-user training on how to use the software securely
Implementing a secure coding standard for the development team
Running antivirus software on the development environment

Question 28 of 60

28. Question

A company wants to implement a DevSecOps approach to its software development process. Which of the following best practices should the company follow to ensure that security is integrated into the entire development lifecycle?

Conducting a security assessment of the production environment after the software has been deployed
Implementing security controls only in the production environment
Integrating security into the design and architecture of the software from the beginning
Waiting until the end of the development process to perform security testing

Question 29 of 60

29. Question

A software development team has created a new application that they are about to release to users. To ensure that the application meets the needs and expectations of the users, what software assurance best practice should the team implement?

Static code analysis
Dynamic code analysis
User acceptance testing
Penetration testing

Question 30 of 60

30. Question

A company wants to ensure that its web application can handle high traffic and heavy loads without crashing or losing data. Which of the following software assessment methods should they use?

Penetration testing
User acceptance testing
Integration testing
Stress testing

Question 31 of 60

31. Question

A software development team wants to ensure that changes to their application’s code do not introduce new security vulnerabilities. Which software assessment method should they use?

Dynamic application security testing (DAST)
Static application security testing (SAST)
Penetration testing
Security regression testing

Question 32 of 60

32. Question

A software development team is conducting a code review for a new application. During the review, the team identifies a potential security vulnerability in the code. Which of the following is the BEST next step for the team?

Implement a patch to fix the vulnerability
Ignore the vulnerability and proceed with the application deployment
Report the vulnerability to the appropriate stakeholders
Conduct a penetration test to validate the vulnerability

Question 33 of 60

33. Question

A software development team is implementing a new feature that involves storing user data in a database. The team wants to ensure that the data is protected from injection attacks. Which of the following is a secure coding best practice for input validation?

Using dynamic SQL queries to handle input
Escaping user input before using it in a query
Storing user input as plain text in the database
Using server-side validation only

Question 34 of 60

34. Question

A web application developer is designing a new feature that requires user inputs to be displayed on the website. To ensure security, which secure coding best practice should the developer implement?

Input validation
Error handling
Session management
Access control

Question 35 of 60

35. Question

A web application developer is reviewing the code for an e-commerce platform. Which of the following BEST describes a secure coding best practice for output encoding?

Using dynamic queries to retrieve and display data
Using prepared statements to retrieve and display data
Using client-side scripts to encode output
Using server-side scripts to encode output

Question 36 of 60

36. Question

Which of the following is an important step in implementing secure session management in a web application?

Limiting the length of user sessions
Using predictable session IDs
Storing session IDs in a client-side cookie
Using HTTP instead of HTTPS to transmit session data

Question 37 of 60

37. Question

In a web application, which of the following is an example of a secure session management practice?

Storing session IDs in clear text
Allowing session IDs to remain valid indefinitely
Forcing users to reauthenticate after a certain period of inactivity
Allowing concurrent logins using the same session ID

Question 38 of 60

38. Question

In a software development project, the development team is implementing authentication mechanisms to secure user accounts. Which of the following is a secure coding best practice to follow when implementing authentication?

Storing user passwords in plain text
Using a weak encryption algorithm for password storage
Allowing the use of weak passwords
Using a strong hashing algorithm for password storage

Question 39 of 60

39. Question

A software development team is working on an e-commerce application. The team is implementing a feature that allows users to store their credit card information for future purchases. What is the best practice for data protection in this scenario?

Store the credit card information in plain text
Implement strong password policies for user accounts
Use encryption to store the credit card information
Use a third-party API to handle credit card information

Question 40 of 60

40. Question

A software development team is tasked with creating a new application that allows users to submit personal information such as names, addresses, and credit card details. The team is concerned about the risk of SQL injection attacks and wants to implement secure coding best practices. Which of the following options describes a recommended approach to prevent SQL injection attacks?

Use the same SQL query for all user input
Use parameterized queries with placeholders for user input
Validate user input client-side only
Implement encryption for all user input

Question 41 of 60

41. Question

A software development team is looking to implement a tool that can automatically scan their codebase for potential security vulnerabilities. Which of the following best describes the type of tool they should use?

Penetration testing tool
Vulnerability management tool
Static analysis tool
Dynamic analysis tool

Question 42 of 60

42. Question

In a company that develops mobile applications, the development team uses a dynamic analysis tool to test the application’s functionality and identify any vulnerabilities. Which of the following is the primary benefit of using dynamic analysis tools in this scenario?

Identifying vulnerabilities in the application's source code
Finding coding errors that could result in application crashes
Ensuring that the application meets user requirements
Testing the application's behavior under different user scenarios

Question 43 of 60

43. Question

A company has implemented a service-oriented architecture (SOA) to integrate its different business systems. They want to ensure secure communication between systems and have decided to use Security Assertion Markup Language (SAML). Which of the following statements about SAML is true?

SAML is used for data encryption between systems
SAML is a protocol used for authentication and authorization in SOA
SAML is used for data compression between systems
SAML is a protocol used for error reporting in SOA

Question 44 of 60

44. Question

In a company, a SOAP web service is used to exchange sensitive data between different systems. Which of the following best practices should be implemented to ensure secure coding for this web service?

Input validation
Parameterized queries
XML encryption
Role-based access control

Question 45 of 60

45. Question

In a RESTful web application, which secure coding best practice should be implemented to prevent SQL injection attacks?

Input validation
Session management
Authentication
Output encoding

Question 46 of 60

46. Question

A company wants to ensure that its servers’ boot process is secure and tamper-proof. Which of the following hardware security solutions would be the MOST appropriate for this scenario?

Trusted Platform Module (TPM)
Hardware Security Module (HSM)
Secure Enclave
Biometric Authentication

Question 47 of 60

47. Question

A company is considering implementing a Hardware Security Module (HSM) to secure its payment processing systems. Which of the following is a benefit of using an HSM?

Improved network performance
Reduced hardware maintenance costs
Increased encryption key security
Enhanced software compatibility

Question 48 of 60

48. Question

A company is planning to purchase new servers with the latest hardware components for its data center. The IT team wants to ensure the new servers have secure firmware and boot processes. Which of the following hardware assurance best practices can provide this level of security?

Trusted Platform Module (TPM)
Hardware Security Module (HSM)
eFuse
Unified Extensible Firmware Interface (UEFI)

Question 49 of 60

49. Question

A company is looking to manufacture new hardware components for its product. They want to ensure that the hardware components are authentic and have not been tampered with. Which of the following methods can they use to ensure this?

Use of counterfeit hardware components
Use of hardware components from an untrusted source
Use of a trusted foundry to manufacture the hardware components
Use of hardware components without any validation or testing

Question 50 of 60

50. Question

Which of the following is an example of trusted execution environment (TEE) technology?

Intel TXT
AMD Secure Processor
ARM TrustZone
All of the above

Question 51 of 60

51. Question

A company wants to ensure that the processing of its sensitive data is done securely. Which of the following best describes a secure enclave?

A secure, isolated hardware environment within a processor that provides confidentiality and integrity of code and data
A software-based security solution that encrypts data on disk and during transmission
A security feature that scans code for vulnerabilities and weaknesses
A hardware security module (HSM) that stores and protects cryptographic keys

Question 52 of 60

52. Question

A company wants to ensure the integrity and confidentiality of its data while it’s being processed on its servers. Which of the following hardware assurance techniques would BEST meet their requirement?

Trusted platform module (TPM)
Secure enclave
Atomic execution
Hardware root of trust

Question 53 of 60

53. Question

A company is developing a new hardware device that will be used in military applications. They want to ensure that the device cannot be tampered with or reverse-engineered. Which of the following would be the BEST solution to achieve this goal?

Use encryption algorithms to protect the device's firmware
Implement physical barriers to prevent tampering, such as tamper-resistant seals
Use obfuscation techniques to make it harder to reverse-engineer the device
Implement anti-tamper mechanisms, such as sensors that detect physical intrusion attempts

Question 54 of 60

54. Question

A company wants to ensure the security of its sensitive data stored on its laptops. Which of the following options would be the BEST solution for this requirement?

Encrypted file system
Secure Boot
Self-encrypting drive
Biometric authentication

Question 55 of 60

55. Question

In an organization, the IT team wants to ensure that firmware updates on all devices are secure and tamper-proof. Which of the following is the BEST hardware assurance practice to achieve this goal?

Implementing code signing certificates
Conducting regular security assessments
Creating firmware backups
Disabling automatic updates

Question 56 of 60

56. Question

Which of the following BEST describes measured boot and attestation?

Measured boot validates the system boot process and attestation verifies the identity of the user
Measured boot validates the system boot process and attestation verifies the integrity of the system
Measured boot verifies the integrity of the user and attestation validates the system boot process
Measured boot verifies the integrity of the system and attestation verifies the integrity of the user

Question 57 of 60

57. Question

A company wants to ensure the confidentiality of data being transmitted over their internal bus between various components of their computer system. Which of the following BEST describes an effective method to secure the bus against eavesdropping attacks?

Implement hardware-based bus encryption
Install a firewall between the components
Conduct regular vulnerability assessments
Train employees on secure coding practices

Question 58 of 60

58. Question

A company is considering implementing a microservices architecture for their application. Which of the following best practices should they follow to ensure software assurance?

Implement strict access control policies between microservices
Use a monolithic architecture instead to reduce the attack surface
Allow microservices to communicate with each other freely
Use a centralized database for all microservices to reduce complexity

Question 59 of 60

59. Question

A company is planning to migrate its traditional server-based infrastructure to a serverless architecture. What security solution should the company consider to minimize the risk of malicious activity in the new infrastructure?

Implementing network segmentation and access controls
Conducting regular vulnerability assessments and penetration testing
Enforcing strong encryption standards for data at rest and in transit
Implementing real-time monitoring and threat detection

Question 60 of 60

60. Question

A company’s critical infrastructure system contains sensitive information and needs to be protected from external threats. The IT department has decided to implement segmentation as a security solution. Which of the following options would be the BEST approach to implementing segmentation?

Implement a virtual private network (VPN) to connect the critical infrastructure system to the company network
Implement an air gap between the critical infrastructure system and the company network
Implement a demilitarized zone (DMZ) between the critical infrastructure system and the company network
Implement a firewall to control traffic between the critical infrastructure system and the company network