Which security concern is most significant when using Infrastructure as Code (IaC)?

An organization uses both on-premises servers for sensitive data and cloud services for customer-facing apps. Which architecture is this?

In a Responsibility Matrix (RACI) for cloud computing, which task is typically the customer’s responsibility?

Which of the following provides logical segmentation of resources within the same physical network?

An organization deploys applications using containers like Docker. What is the primary security implication of this approach?

In a software-defined networking (SDN) environment, which component poses a new potential attack surface?

Which of the following best describes the security goal of air-gapped networks in industrial control systems (ICS)?

A manufacturing plant runs equipment using a real-time operating system (RTOS). What is a major security limitation of this environment?

Which of the following architectures most improves resilience and availability while potentially increasing cost and complexity?

A security engineer places an intrusion prevention system (IPS) directly between the internal switch and the firewall. What device placement is this?

A data center’s external network segment hosts web servers accessible to the public, while internal segments host databases and applications. What security principle is being applied?

An organization’s firewall is configured to block all traffic if it fails due to a software crash. Which failure mode is this configuration using?

Which of the following devices should be used to provide secure remote administrative access to internal servers from untrusted networks?

A network appliance that combines firewall, anti-malware, VPN, and content filtering capabilities is best described as:

An organization wants to secure communication between branch offices over the internet using encryption at the network layer. Which technology should be implemented?

Which port security mechanism enforces authentication before allowing devices to connect to a switch port?

A company’s web-based CRM system is repeatedly targeted by SQL injection and cross-site scripting (XSS) attacks. Which control would best mitigate these threats?

A security architect recommends using Secure Access Service Edge (SASE) for remote workers. What main benefit does SASE provide?

A network team uses SD-WAN to optimize branch connectivity and automatically route traffic through secure tunnels. What is the main security advantage?

A healthcare organization must comply with laws governing the storage and transmission of patient information. What type of data is being protected?

A company’s formula for a new product is stored in a secure server with limited access. What type of data does this represent?

Which of the following data classifications typically requires the highest level of protection due to potential severe business impact if exposed?

Which data state is most at risk when it is actively being processed by an application in system memory?

A financial firm stores customer banking details in an encrypted database. What data state does this describe?

An organization replaces credit card numbers with randomly generated identifiers that can be mapped back only through a secure database. What technique is this?

What is the main difference between hashing and encryption?

To comply with data sovereignty requirements, a company must ensure that:

An organization hides specific characters of Social Security numbers when displaying them on-screen (e.g., ––1234*). What method is being used?

Which control limits access to sensitive data by granting users only the minimum permissions required for their roles?

To reduce the attack surface of sensitive data, an enterprise isolates the HR database from the rest of the internal network using a separate subnet. This is an example of:

A multinational company uses geolocation-based restrictions to prevent login attempts from countries where it does not operate. What type of control is this?

An organization’s web application runs on four servers behind a load balancer. One of the servers fails, but users continue to access the service with minimal disruption.

Which of the following BEST describes the configuration that enabled this?

A financial institution must recover operations within minutes of a data center outage, maintaining full transaction data synchronization.

Which site type BEST fulfills this requirement?

Why is geographic dispersion critical to resilience in security architecture?

An enterprise wants to minimize the risk that a single operating system vulnerability could compromise all services. Which approach BEST supports this goal?

A multinational company uses multiple cloud providers for redundancy. Which of the following is the PRIMARY security challenge in this architecture?

Which of the following BEST defines continuity of operations?

During resilience planning, a company identifies that in case of disaster, only half of its IT staff can report to the recovery site. What aspect of capacity planning does this impact the MOST?

A disaster recovery team walks through the recovery plan using a conference room scenario, discussing roles and procedures without executing systems. Which testing type is this?