Protect and Secure Systems and Data Flashcards

An organization needs to ensure users accessing a VPN from personal devices meet minimum security posture requirements. Which technology BEST enforces this?

Answer: Network Access Control (NAC)

NAC evaluates device health and compliance posture before granting network access, allowing or quarantining devices based on policy.

Which cryptographic property ensures that a sender cannot later deny having sent a message?

Answer: Non-repudiation

Non-repudiation, typically achieved via digital signatures, provides proof of origin so the sender cannot credibly deny authorship.

A company stores customer PII in a cloud database. Which control ensures that even the cloud provider cannot read the data?

Answer: Implement client-side encryption with customer-managed keys

Client-side encryption with customer-managed keys means data is encrypted before reaching the cloud provider, so the provider never holds the plaintext or the keys.

What is the MAIN security benefit of network micro-segmentation?

Answer: It reduces the attack surface by limiting lateral movement between workloads

Micro-segmentation enforces granular traffic policies between workloads, containing breaches and preventing attackers from moving laterally through the network.

An administrator enables 'audit success and failure' for logon events on all Windows servers. What security function does this PRIMARILY support?

Answer: Detecting and investigating unauthorized access attempts

Auditing logon events creates a record of authentication attempts, enabling detection of unauthorized access and forensic investigation after an incident.

Which concept describes applying the minimum system services, ports, and features needed for a system to perform its function?

Answer: System hardening / secure baseline

System hardening reduces the attack surface by disabling unused services, closing unnecessary ports, and removing default accounts and software.

A web server must serve only HTTPS traffic. Which firewall rule set BEST enforces this?

Answer: Allow TCP 443 inbound, deny TCP 80 inbound

Allowing only TCP 443 (HTTPS) and blocking TCP 80 (HTTP) forces all web traffic through the encrypted channel, preventing unencrypted access.