2.1 Architecture and Design - Enterprise Environment

Scenario: Sarah, an employee at a financial institution, frequently handles sensitive customer information, including financial records and personal data. One day, she inadvertently attaches a file containing confidential client details to an email intended for a colleague, but mistakenly sends it to an external email address. In this situation, what solution could the financial institution use to ensure this doesn't happen again?

• Digital Ledger Protocol (DLP)

• Dynamic Link Libraries (DLL)

• Data Loss Prevention (DLP)

• Data Ledger Prevention (DLP)

Answer explanation

Data Loss Prevention is a strategy or set of tools and processes designed to prevent unauthorized access, sharing, or leakage of sensitive and confidential information. (2.1)

IP Cyber handles a vast amount of customer data, including personally identifiable information (PII). To conduct software testing, developers require a realistic dataset that mirrors the production environment. However, they need to ensure that actual customer information remains confidential and protected. What solution can be implemented to provide realistic test datasets for software development while safeguarding sensitive customer information?

• Data Encryption

• Data Clustering

• Data Archiving

• Data Masking

Answer explanation

Data Masking transforms sensitive information for testing while maintaining structure. It allows realistic datasets without exposing actual customer data.

• Data Encryption: Encrypts but doesn't transform data, maintaining sensitivity.

• Data Archiving: Focuses on storage, not suitable for creating realistic test datasets.

• Data clustering: A technique used for grouping similar data points based on certain criteria. (2.1)

IP Cyber stores customer financial records in a centralized database. To ensure the security of this information during transmission over the network, the company decides to implement a protective measure that will safeguard these records during their transmission. Which of the solutions will provide the best protection?

• Data Obfuscation

• Data Compression

• Data Encryption

• Data Masking

Answer explanation

• Data encryption is designed to secure information during transmission, converting it into a coded format that can only be deciphered by authorized parties.

• Data Obfuscation: Obfuscation involves making data unclear, but it may not provide the robust protection needed during transmission.

• Data Compression: Compression reduces file size but doesn't focus on securing data during transmission.

• Data Masking: Masking is more relevant for creating non-production datasets than securing data during transmission. (2.1)

IP Cyber regularly archives historical customer data on a server that is not actively accessed, processed or transmitted. This data will sit in a static state, residing on the storage media for a long period of time. What is this known as?

• Data Masking

• Data Encryption

• Data at Rest

• Data in Transit

Answer explanation

Data at rest refers to information that is stored or archived on a storage device and is not actively being used, processed, or transmitted. This data is in a static state, residing on physical or digital storage media such as hard drives, solid-state drives, databases, tapes, or any other form of persistent storage. (2.1)

A banking company processes a large volume of credit card transactions daily. To enhance the security of customer payment information stored in their database, they seek a solution that replaces sensitive card numbers with randomly generated tokens while maintaining referential integrity for transaction purposes. As a security solutions provide for IP Cyber, what do you recommend they use?

• Data Obfuscation

• Data Masking

• Data Encryption

• Data Tokenization

Answer explanation

Data Tokenization involves replacing sensitive data with unique tokens, maintaining referential integrity for transactional purposes. It ensures that the original data is not exposed, providing a secure way to handle sensitive information like credit card numbers.

• Data Masking: Masks data for non-production purposes but may not be suitable for maintaining referential integrity in transactional systems.

• Data Encryption: Secures data through coded formats but does not typically maintain referential integrity for transactional processes.

• Data Obfuscation: Involves making data unclear but may not provide the structured replacement needed for transactional integrity.

After a system update, you notice performance issues and unexpected behavior in your server. You decide to restore the system to its original state to troubleshoot the issue. What term best describes bringing the system back to its initial, securely configured state?

• System Virtualization

• System Snapshot

• System Redundancy

• System Baseline Configuration

Answer explanation

Baseline configuration refers to the standard, securely configured state of a system. Restoring the system to its baseline helps troubleshoot issues and ensures a known, secure starting point.

• System Snapshot: A snapshot captures the current state but doesn't necessarily represent the securely configured baseline.

• System Redundancy: Redundancy is about having backup components, not restoring to a specific configuration state.

• System Virtualization: Virtualization involves creating virtual instances but doesn't inherently mean restoring to a securely configured baseline.

John, a network administrator, encounters connectivity issues in a company's network. To diagnose and resolve the problems, he needs to understand and document the structure and layout of the network communication protocols. What term best describes the structured plan or framework outlining the rules and conventions for internet communication?

• Network Routing Table

• Network Firewall Configuration

• Internet Protocol Addressing

• Internet Protocol Schema

Answer explanation

Internet Protocol Schema refers to the organized plan or framework specifying the rules and conventions for communication over the internet. It encompasses the protocols governing data transmission.

• Network Routing Table: A routing table is a dynamic document showing the path data takes through a network, but it doesn't capture the overall schema of internet communication.

• Internet Protocol Addressing: Addressing focuses on the assignment of unique identifiers to devices but doesn't encompass the entire structured plan for internet communication.

• Network Firewall Configuration: Firewall configuration involves setting rules for network security but doesn't represent the overall schema of internet communication protocols.

Organize these options into the right categories

Groups:

(a) Hot Site

,

(b) Warm Site

,

(c) Cold Site

• Ready in Weeks/Months

• All Equipment Pre-Installed

• Most Expensive

• Minimal Downtime

• Ready to Take Over

• Some pre-installed equipment

• Needs to be built

• Immediate Availability

• Least Expensive

• Availability isn't Immediate

• Ready in minutes

• Availability takes a long time

• Not Operational

• No pre-installed equipment

• Partially Set Up

• Fully Operational

• Ready in Days/Weeks

IP Cyber has identified a significant increase in malicious traffic and cybersecurity threats within its network. The IT team wants to proactively block access to known malicious domains and prevent potential security breaches. What solution would be most effective for intercepting and redirecting traffic away from these malicious domains?

• VPN Implementation

• Firewall Configuration

• Intrusion Detection System (IDS)

• DNS Sinkhole

Answer explanation

A DNS sinkhole is a technique used to redirect traffic from known malicious domains by manipulating the DNS resolution process. It is an effective method for preventing systems within the network from connecting to harmful sites.

• Firewall Configuration: While firewalls provide security by controlling incoming and outgoing network traffic, they may not be as focused on DNS-level redirection of malicious domains.

• Intrusion Detection System (IDS): IDS is designed to detect and alert on potential security threats but may not directly block or redirect traffic away from malicious domains.

• VPN Implementation: Virtual Private Networks (VPNs) are used for secure communication, but they are not specifically designed for blocking or redirecting traffic based on known malicious domains.