Architecture & Design Flashcards

A company wants to ensure that a compromised application server cannot be used to pivot to the database server. Which network segmentation control BEST achieves this?

Answer: Microsegmentation with host-based firewall policies

Microsegmentation enforces granular east-west traffic policies between individual workloads, preventing lateral movement even within the same network zone.

Which secure network architecture concept places resources that must be publicly accessible in an isolated zone separate from the internal network?

Answer: DMZ (Demilitarized Zone)

A DMZ is a buffer zone between the internet and the internal network where public-facing servers are isolated so that a compromise does not directly expose internal systems.

An organization deploys an application that processes payment data. The security architect recommends a deception technology to detect attackers who have already breached the network. What is this technology called?

Answer: Honeypot

A honeypot is a decoy system designed to lure and detect attackers who have already gained internal network access.

A cloud architect needs to encrypt data so that it can still be searched and queried without full decryption. Which encryption concept supports this requirement?

Answer: Homomorphic encryption

Homomorphic encryption allows computations to be performed on ciphertext, producing encrypted results that match operations on the plaintext.

During a design review, a security engineer recommends that all internal services authenticate each request independently rather than relying on network location. This is a core principle of which model?

Answer: Zero trust architecture

Zero trust architecture operates on the principle of 'never trust, always verify,' requiring authentication and authorization for every request regardless of network origin.

A security architect wants to prevent a single vulnerability from compromising an entire system by implementing multiple, independent security controls. Which design principle does this represent?

Answer: Defense in depth

Defense in depth layers multiple security controls so that if one fails, others continue to protect the system.

An architect is designing an ICS environment for a power utility. To prevent any digital communication path between the operational network and the internet, which control should be implemented?

Answer: Air gap

An air gap physically isolates the ICS network from all external networks, including the internet, eliminating any digital attack path.