212-82 試験問題を無料オンラインアクセス

What can be used to ensure data confidentiality? (Select all that apply)

• A.Access control lists (ACLs)
• B.Encryption
• C.Regular system backups
• D.Social engineering

ProNet, a leading technology firm, has been dynamically evolving its internal infrastructure to cater to an expanding workforce and changing business needs. The company's current project involves enhancing the overall security of its internal platforms. The company's security team is focusing on a robust access control system. To make the system efficient, it needs to implement a model that would define access based on roles within the organization, where specific roles would have predefined access to certain resources, and the roles can be assigned to multiple users. The aim is to decrease the administrative work involved in assigning permissions and ensure that users gain only the necessary permissions in line with their job functions. Which access control model best suits ProNet's requirement?

• A.Mandatory Access Control (MAC)
• B.Role-Based Access Control (RBAC)
• C.Discretionary Access Control (DAC)
• D.Attribute-Based Access Control (ABAC)

You are the cybersecurity lead for an International financial institution. Your organization offers online banking services to millions of customers globally, and you have recently migrated your core banking system to a hybrid cloud environment to enhance scalability and cost efficiencies.
One evening, after a routine system patch, there is a surge in server-side request forgery (SSRF) alerts from your web application firewall(WAF). Simultaneously, your intrusion detection system (IDS) flags possible attempts to interact with cloud metadata services from your application layer, which could expose sensitive cloud configuration details and API keys. This Is a clear Indication that attackers might be trying to leverage the SSRF vulnerability to breach your cloud infrastructure. Considering the critical nature of your services and the high stakes involved, how should you proceed to tackle this imminent threat while ensuring minimal disruption to your banking customers?

• A.Engage with a third-party cybersecurity firm specializing in cloud security to conduct an emergency audit, relying on its expertise to identify the root cause and potential breaches.
• B.Notify all banking customers about the potential security incident, urging them to change their passwords and monitor their accounts for any unauthorized activity.
• C.Rollback the recent patch immediately and inform the cloud service provider about potential unauthorized access to gauge the extent of vulnerability and coordinate a joint response.
• D.Isolate the affected cloud servers and redirect traffic to backup servers, ensuring continuous service while initiating a deep-dive analysis of the suspicious activities using cloud-native security tools.

Elliott, a security professional, was appointed to test a newly developed application deployed over an organizational network using a Bastion host. Elliott initiated the process by configuring the nonreusable bastion host. He then tested the newly developed application to identify the presence of security flaws that were not yet known; further, he executed services that were not secure. identify the type of bastion host configured by Elliott in the above scenario.

• A.Non-routing dual-homed hosts
• B.Victim machines
• C.External services hosts
• D.One-box firewalls

A software company develops new software products by following the best practices for secure application development. Dawson, a software analyst, is responsible for checking the performance of applications in the client's network to determine any issue faced by end users while accessing the application.
Which of the following tiers of the secure application development lifecycle involves checking the application performance?

• A.Staging
• B.Quality assurance (QA)
• C.Development
• D.Testing