Architecture & Design Flashcards

What is defense in depth?

Answer: Layered security

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls to protect information and systems. Instead of relying on a single point of defense, it creates redundancy, meaning if one security measure fails, others are in place to prevent a breach. This layered approach significantly enhances overall security posture by making it harder for attackers to penetrate a system.

What is segmentation?

Answer: Network separation

Segmentation in network design involves dividing a computer network into smaller, isolated subnetworks or segments. This separation helps to contain security breaches by limiting the lateral movement of attackers within the network. If one segment is compromised, the damage is confined, preventing the entire network from being affected and enhancing overall security.

Why use secure baseline configuration?

Answer: Consistency and security

Using a secure baseline configuration ensures consistency and security across all systems within an organization. It establishes a minimum security standard, defining secure settings, installed software, and disabled services. This practice reduces the attack surface, minimizes misconfigurations, and ensures that all systems adhere to a known, secure state, making them less vulnerable to threats.

What is DMZ in network design?

Answer: Isolated network zone

A DMZ (Demilitarized Zone) in network design is an isolated network zone that acts as a buffer between an organization's internal network and an untrusted external network, like the internet. It hosts public-facing services such as web servers or email servers, protecting the internal network from direct attacks. If a DMZ server is compromised, the attacker still cannot directly access the more sensitive internal systems.

What does VPN do?

Answer: Secure remote connection

A VPN (Virtual Private Network) creates a secure, encrypted connection over a less secure network, such as the internet. Its primary function is to provide secure remote access to private networks, allowing users to send and receive data as if their computing devices were directly connected to the private network. This ensures data confidentiality and integrity, especially when working remotely or using public Wi-Fi.

What is the benefit of cloud architecture?

Answer: Scalability

The primary benefit of cloud architecture is scalability, which allows resources to be easily adjusted up or down based on demand. Organizations can quickly provision or de-provision computing power, storage, and network bandwidth as needed, without significant upfront investment. This flexibility enables businesses to handle fluctuating workloads efficiently and cost-effectively.

What is least privilege?

Answer: Minimum necessary access

Least privilege is a fundamental security principle dictating that users, programs, or processes should be granted only the absolute minimum level of access or permissions required to perform their legitimate tasks. This approach significantly reduces the potential impact if an account or system is compromised, limiting what an attacker can do. By restricting unnecessary access, the overall security posture of a system is greatly enhanced.

What is virtualization?

Answer: Multiple OS on one system

Virtualization is a technology that allows a single physical computer system to host multiple isolated virtual machines (VMs), each running its own operating system. This is achieved by abstracting the hardware resources, enabling efficient resource utilization and greater flexibility in IT environments. It allows for running diverse applications and operating systems concurrently on one physical machine, optimizing hardware investment.

What does redundancy do?

Answer: Increase availability

Redundancy involves duplicating critical components or functions within a system to ensure that if one component fails, another can take over seamlessly. This design principle is crucial for high availability, as it minimizes downtime and ensures continuous operation of services. By having backup systems or data paths, the overall reliability and uptime of the infrastructure are significantly improved, preventing single points of failure.