CYBERSECURITY-ARCHITECTURE-AND-ENGINEERING Practice Questions

Hardware-based attacks, such as side-channel vulnerabilities (e.g., Spectre, Meltdown), are complex and evolve continuously. For a cloud service provider, the most effective strategy is a continuous security process. Regular vulnerability assessments and penetration testing are crucial for proactively identifying these specific hardware and hypervisor-level vulnerabilities, such as systems lacking necessary CPU microcode updates or having insecure configurations. This process of identification is a foundational component of a hardening strategy, as it enables the provider to apply the precise patches and configuration changes needed to mitigate the risks. It is the only viable option that addresses the provider's need to manage these threats while maintaining its core virtualization services.

B. Disabling central processing unit (CPU) virtualization support: This would make it impossible to run virtual machines, which is the core business of a cloud service provider. Therefore, this technique does not meet the provider's needs.

C. Implementing a web application firewall to monitor incoming traffic: A web application firewall (WAF) operates at the application layer (Layer 7) and is designed to protect web applications, not the underlying hardware or hypervisor from hardware-based attacks.

D. Enforcing strict access control policies for all users: While a fundamental security practice, access control primarily prevents unauthorized user actions and does not directly mitigate hardware-level exploits like side-channel attacks, which can leak information between processes.

---

1. Intel Corporation, "Side Channel Vulnerability Mitigations" (May 2022). This official vendor documentation outlines the mitigation process for vulnerabilities like Spectre and Meltdown. The process relies on a combination of microcode updates, operating system updates, and hypervisor updates. The document implicitly supports the need for assessment, stating, "System administrators and users of systems with affected processors should check with their system manufacturers and operating system vendors and apply any available updates as soon as practical." The identification of "affected processors" and required updates is a function of vulnerability assessment. (Reference: Section "Software Mitigations").

2. NIST Special Publication 800-53, Revision 5, "Security and Privacy Controls for Information Systems and Organizations" (September 2020). This standard defines vulnerability scanning as a key control. Control RA-5 (Vulnerability Monitoring) is essential for "identifying vulnerabilities [and] prioritizing and reporting vulnerabilities." This process is a prerequisite for applying hardening techniques (like those in the CM control family) to mitigate identified hardware-level risks. (Reference: Control RA-5, Page 201).

3. Wang, Z., & Jiang, X. (2010). "HyperSafe: A lightweight approach to provide lifetime hypervisor control-flow integrity." 2010 IEEE Symposium on Security and Privacy, 380-395. https://doi.org/10.1109/SP.2010.31. This peer-reviewed paper on hypervisor security highlights the importance of identifying and mitigating control-flow hijacking attacks. The development and implementation of such defenses rely on an initial and ongoing assessment of potential vulnerabilities in the hypervisor and its interaction with hardware, reinforcing the role of assessment in a hardening strategy. (Reference: Section 1, Introduction).

4. MIT OpenCourseWare, "6.858 Computer Systems Security" (Fall 2014). Course materials on system security, particularly lectures on side-channel attacks, emphasize that these vulnerabilities are often subtle and discovered over time. This underscores the need for continuous monitoring and assessment to detect systems susceptible to newly discovered attack variants, rather than relying on a one-time hardening configuration. (Reference: Lecture 15, "Side-Channel Attacks").

The audit identified that backup repositories lack any protection, which is fundamentally an access control failure. The most immediate and critical action is to contain this vulnerability by restricting access. Applying the principle of least privilege through mechanisms like Identity and Access Management (IAM) policies or Access Control Lists (ACLs) directly mitigates the risk of unauthorized data exposure. This is the foundational first step in securing any data asset, especially sensitive backups. Actions such as investigation or scanning should follow after the immediate threat has been contained.

B. Run a vulnerability scan: This action identifies software vulnerabilities (e.g., CVEs), not the configuration issue of open access permissions, which is the stated problem.

C. Disable the backup repositories: This is an overly drastic measure that would halt critical business continuity functions. Restricting access secures the data while maintaining operational availability.

D. Audit access logs: This is an investigative step to determine if a compromise has already occurred. It is reactive, whereas restricting access is a proactive, protective measure that must be prioritized.

1. Amazon Web Services (AWS) Documentation: In the Amazon S3 User Guide, the section on "Identity and access management for Amazon S3" emphasizes that managing access is a primary security task. It states, "By default, all S3 resources...are private and can be accessed only by the object owner." The first step to correct an unprotected repository is to enforce this principle. (See: AWS S3 User Guide, "Blocking public access to your Amazon S3 storage," Section: Block public access settings).

2. National Institute of Standards and Technology (NIST): NIST Special Publication 800-53, Revision 5, Security and Privacy Controls for Information Systems and Organizations, identifies Access Control (AC) as a fundamental control family. Control AC-3, "Access Enforcement," requires that the system enforces approved authorizations for logical access to information. This directly supports restricting access as the primary corrective action. (See: NIST SP 800-53 Rev. 5, pp. 53-54, Control Family: Access Control).

3. Microsoft Azure Documentation: The security recommendations for Azure Blob Storage prioritize managing access. The documentation states, "The first step in securing your Blob storage is to control who can access it... Azure Storage supports Azure Active Directory (Azure AD), Shared Key authorization, and shared access signatures (SAS)." This highlights access control as the initial and most critical security measure. (See: Microsoft Docs, "Security recommendations for Blob storage," Section: Manage access to Blob data).

4. Carnegie Mellon University, Software Engineering Institute (SEI): In the publication Cloud Security: A Review of Current Issues, and A Proposed Approach to Secure Cloud Adoption, the authors highlight that "improperly configured access controls" are a primary threat. The recommended mitigation is the immediate implementation of strong authentication and authorization mechanisms. (See: CMU/SEI-2019-TR-003, Section 3.2.1, Data Breaches).

The request is for a post-deployment test to ensure all application components can "interact and function properly." This is the definition of integration testing. Integration testing focuses on verifying the communication and data flow between different modules, services, or layers (e.g., the web, application, and database tiers in a three-tier architecture) after they have been integrated. It is conducted after unit testing and before system-wide validation to detect faults in the interfaces and interactions between integrated components, which directly addresses the management's requirement.

A. Static code analysis: This is a pre-deployment activity that analyzes source code for security vulnerabilities and coding errors without executing the application. It does not test runtime component interaction.

B. Dynamic code analysis: This is a security-focused test performed on a running application to find vulnerabilities. It does not primarily verify the functional correctness of component interactions.

D. Package scanning: Also known as Software Composition Analysis (SCA), this process scans for known vulnerabilities in third-party libraries and dependencies, not the functional interaction between the application's own components.

1. University Courseware:

Massachusetts Institute of Technology (MIT) OpenCourseWare. (2013). 6.170 Software Studio, Lecture 10: Testing. Section "Levels of testing." The lecture notes define integration testing as the phase where individual modules are combined and tested as a group to expose faults in their interaction.

Available at: https://ocw.mit.edu/courses/6-170-software-studio-spring-2013/resources/mit6170s13lec10/

2. Official Vendor Documentation:

Microsoft. (2023). Testing overview - Azure DevOps. In the "Test types" section, integration tests are described as verifying that different parts of an application work correctly together, often involving testing interactions with external resources like databases.

Reference: https://learn.microsoft.com/en-us/azure/devops/test/overview?view=azure-devops#test-types

3. Peer-reviewed Academic Publications:

Bertolino, A. (2007). Software Testing Research: Achievements, Challenges, Dreams. 2007 Future of Software Engineering, 85-103. In Section 3.1, "Test Levels," integration testing is defined as the activity of "testing the interfaces among the integrated components."

DOI: https://doi.org/10.1109/FOSE.2007.30

Data Loss Prevention (DLP) is a security strategy and set of tools designed to ensure that sensitive or critical information is not lost, misused, or accessed by unauthorized users. DLP systems are specifically engineered to prevent data exfiltration by enforcing policies for data at rest, in motion, and in use. They can detect and block the unauthorized transmission of sensitive data through various channels like email, web uploads, or removable media. This makes DLP the most direct and appropriate technique for preventing data exfiltration among the choices provided.

A. Intrusion Detection Software (IDS): An IDS monitors network or system activities for malicious actions or policy violations and reports them. It is a detective control, not a preventative one.

C. Multi-Factor Authentication (MFA): MFA is an access control mechanism that enhances security by requiring multiple verification methods. It prevents unauthorized access but does not stop an authenticated user from exfiltrating data.

D. Intrusion Prevention Software (IPS): An IPS is a preventative control that actively blocks detected threats and exploits at the network level. While it can stop attacks that might lead to exfiltration, it is not primarily focused on the data content itself, unlike DLP.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5).

Reference: Control Family PE (Physical and Environmental Protection), Control ID PE-19 "Information Leakage".

Content: This control specifically addresses measures to "protect information from unauthorized disclosure," which is the core function of DLP systems in preventing data exfiltration. The discussion notes for this control mention monitoring physical and logical egress points.

2. Asaf, M., & Zeadally, S. (2021). Data Leakage Prevention: A Survey. ACM Computing Surveys, 54(4), 1–37.

Reference: Section 2, "DLP Systems," pp. 3-4.

DOI: https://doi.org/10.1145/3447873

Content: This peer-reviewed academic survey defines DLP as a "set of technologies and processes that are used to detect and prevent the unauthorized use and transmission of sensitive information outside the corporate network." This directly aligns with the goal of preventing data exfiltration.

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 387-408. (Foundational principles often cited in university courseware).

Reference: Section I.A.3, "Least Privilege," p. 391.

Content: While MFA enforces authentication, it doesn't enforce the principle of least privilege regarding data access and movement. A legitimate, authenticated user can still exfiltrate data they have access to. DLP helps enforce policies that limit what even an authenticated user can do with sensitive data, thus supporting the principle of least privilege in the context of data movement.

4. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference: Lecture 19 Notes: Network Security.

Content: The lecture notes differentiate between Intrusion Detection Systems (IDS) as passive monitoring systems ("log and alert") and Intrusion Prevention Systems (IPS) as active systems that can drop malicious packets. This highlights that while IPS is preventative, its focus is on blocking network attacks, not on content-aware data exfiltration, which is the specific domain of DLP.

An organizational culture supports ethical guidelines by embedding shared values and beliefs into its operational procedures. Outlining and enforcing protocols to support the security and privacy of data is a direct manifestation of an ethical culture. It translates abstract ethical principles, such as the duty to protect sensitive information, into concrete, everyday actions and expectations for all employees. This fosters an environment where ethical conduct regarding data handling is a collective responsibility and a core component of the organization's identity, rather than merely a set of rules to be followed.

A. Outlining the roles of IT specialists is an administrative function of organizational structure, not a direct reflection of the organization's ethical culture.

C. Creating system requirements is a technical specification task that defines hardware and software standards, not the ethical principles guiding employee behavior.

D. Organizations are subject to and must comply with government regulations; they do not create them. This is an external legal constraint, not an internal cultural support mechanism.

---

1. Peer-Reviewed Academic Publication:

Schlienger, T., & Teufel, S. (2003). Information security culture—from analysis to change. In Proceedings of the 3rd Annual Information Security South Africa Conference (ISSA). This publication discusses how an information security culture is built on shared values, which are then expressed through concrete norms and artifacts, such as security and privacy protocols (Section 3, "The Information Security Culture Model"). This directly supports the idea that culture manifests through protocols.

2. Official Vendor/Standards Documentation:

National Institute of Standards and Technology (NIST). (2020). Special Publication (SP) 800-53, Revision 5: Security and Privacy Controls for Information Systems and Organizations. The Program Management (PM) control family, particularly PM-13 ("Information Security and Privacy Workforce"), emphasizes establishing a workforce with the necessary knowledge and skills, including ethical conduct, to protect data. This implies that the organizational framework (culture and policy) must support the ethical handling of information through defined procedures.

3. University Courseware:

MIT OpenCourseWare. (2016). 15.270 Ethical Practice: Leading Through Professionalism, Social Responsibility, and System Design. The course materials emphasize that ethical practice is embedded in an organization's systems and culture. Lecture notes on "System Design for Values" discuss how organizational processes and protocols (e.g., for data privacy) are designed to reflect and reinforce core ethical values, demonstrating the direct link between culture, protocols, and ethics.

Identity federation enables users to access resources across different security domains using a single set of credentials. In this scenario, the goal is to link the on-premises identity system with Azure's identity system. Security Assertion Markup Language (SAML) is an open standard specifically designed for exchanging authentication and authorization data between an identity provider (the on-premises corporate directory) and a service provider (Azure). By configuring SAML-based authentication, the on-premises system can authenticate the user and send a trusted security assertion to Azure, which then grants access to the portal. This establishes the federated trust required for single sign-on (SSO).

A. Encrypting with Transport Layer Security (TLS): TLS is a protocol for securing data in transit. While essential for protecting the authentication exchange, it does not provide the identity federation mechanism itself.

B. Deploying a hardware-based two-factor authentication (2FA) solution: 2FA is a method for strengthening authentication by requiring a second verification factor. It is a component of an authentication process, not a strategy for federating identities between systems.

C. Integrating with lightweight directory access protocol (LDAP): LDAP is a protocol for querying and managing directory services. While the on-premises directory likely uses LDAP, it is not the protocol used to establish federated trust with an external service like Azure.

1. Microsoft Azure Documentation. "What is federation with Azure AD?". Microsoft Learn. This document explicitly states, "Federation is a collection of domains that have established trust... When you set up federation with your on-premises environment, you establish a trust relationship between your on-premises identity provider and Azure AD." It further identifies SAML 2.0 as a protocol used for this purpose.

2. National Institute of Standards and Technology (NIST). Special Publication (SP) 800-63C: Digital Identity Guidelines: Federation and Assertions. June 2017. Section 5.1.1, "Security Assertion Markup Language (SAML)", describes SAML as a framework for communicating authentication and authorization information between an Identity Provider (IdP) and a Relying Party (RP), which is the exact model of identity federation.

3. Internet2. SAML: The Secret to Centralized & Streamlined Authentication. InCommon Federation. This university-backed consortium material explains, "SAML is the underlying technology that enables federated identity management, allowing a person to use the same digital identity to access a wide variety of systems at their own institution and in the cloud." (Section: "What is SAML?").

Application software is a category of computer programs designed to help end-users perform specific, productive tasks. These tasks can be for business, personal, or educational purposes. This software runs on top of the operating system, which manages the underlying hardware and provides essential services. Options B and C provide a perfect definition and classic examples of application software, such as email clients, word processors, and spreadsheets, which are all tools used directly by individuals to accomplish a goal.

A. System utilities are considered a type of system software, which, along with the operating system, manages and maintains the computer system itself, not application software.

D. The operating system is the software layer that directly manages and supports the computer hardware system, acting as an intermediary for application software.

1. Stallings, W. (2018). Operating Systems: Internals and Design Principles (9th ed.). Pearson. In Chapter 2, Section 2.1, "Computer Hardware and Software Structure," the text distinguishes between system software (including the OS and utilities) that manages computer resources and application software that provides services to the user (e.g., spreadsheets, word processors).

2. Patterson, D. A., & Hennessy, J. L. (2017). Computer Organization and Design RISC-V Edition: The Hardware Software Interface. Morgan Kaufmann. Chapter 1, Section 1.4, "Under the Covers," explains that application software is composed of high-level programs for users, while system software (including the OS) provides services to application software and manages the hardware.

3. MIT OpenCourseWare. (2009). 6.033 Computer System Engineering, Spring 2009. Massachusetts Institute of Technology. Lecture 1, "Introduction," defines the role of an operating system as a resource manager for hardware, creating abstractions for application programs to use, clearly separating its function from that of user-facing applications.

4. Silberschatz, A., Galvin, P. B., & Gagne, G. (2018). Operating System Concepts (10th ed.). Wiley. Chapter 1, Section 1.1, "What Operating Systems Do," describes the OS as a program that manages computer hardware and provides a basis for application programs, contrasting it with applications that solve the computing problems of the user.

A password expiration policy is a technical control that enforces a maximum lifespan for user passwords. The audit failure was specifically caused by passwords being older than 365 days. Implementing a password expiration policy set to a specific period (e.g., 90, 180, or 365 days) would compel users to change their passwords before they become "stale." This directly addresses the audit finding by ensuring credentials are periodically refreshed, which mitigates the risk of a compromised password remaining valid indefinitely.

B. Length: This policy defines the minimum number of characters required for a password, which impacts its strength against brute-force attacks, not its age.

C. Recovery: This policy governs the process for users to reset a forgotten password and regain account access; it is unrelated to the password's valid duration.

D. Complexity: This policy mandates the use of different character sets (e.g., uppercase, lowercase, numbers, symbols) to increase password strength, not to manage its lifecycle.

1. Microsoft Corporation. (2023). Password Policy. Microsoft Learn. In the description of the "Maximum password age" policy setting, it states, "This security setting determines the period of time (in days) that a password can be used before the system requires the user to change it." This directly corresponds to the concept of password expiration. (Reference: docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/password-policy)

2. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63B: Digital Identity Guidelines, Authentication and Lifecycle Management. Section 5.1.1.2, "Memorized Secret Verifiers," discusses password lifecycle events, including expiration. It states, "Verifiers SHALL require a subscriber to change their memorized secret... if there is evidence of compromise of the memorized secret." While modern guidance de-emphasizes arbitrary periodic expiration, the mechanism itself is defined as the control for forcing password changes after a set time. (DOI: https://doi.org/10.6028/NIST.SP.800-63b)

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 377-408. This foundational paper on computer security principles discusses password protection mechanisms. In Section I.A.3.b, "Passwords," the concept of limiting the lifetime of a password is introduced as a countermeasure to threats like password theft, establishing the academic basis for password expiration policies. (DOI: https://doi.org/10.1145/361011.361062)

The indicator of compromise (IOC)—unknown users logging onto the wireless local-area network (WLAN)—directly points to a failure in access control for the wireless network. An unsecured wireless access point is a significant vulnerability that facilitates such unauthorized access. This vulnerability can manifest as a lack of encryption, the use of weak or deprecated encryption protocols (e.g., WEP), default administrative credentials, or easily guessable pre-shared keys (PSKs). Any of these insecure configurations would allow an unauthorized user to connect to the network, matching the observed IOC precisely. The presence of unknown users is a classic symptom of an improperly secured wireless perimeter.

B. Up-to-date anti-malware software is a security control and a strength, not a vulnerability that would allow unauthorized network access.

C. A strong password policy is a security measure designed to prevent unauthorized access, making it the opposite of a vulnerability.

D. Regular security awareness training for employees is a proactive administrative control, not a technical vulnerability permitting unauthorized connections.

1. National Institute of Standards and Technology (NIST). (2012). Guidelines for Securing Wireless Local Area Networks (WLANs) (NIST Special Publication 800-153).

Section 3.1, "WLAN Threats," states: "Unauthorized access is a major security concern for WLANs... An attacker can gain unauthorized access to the WLAN by connecting to an AP [Access Point]... Attackers can also gain unauthorized access to the WLAN through APs that have been intentionally or unintentionally configured to not require authentication." This directly links the IOC (unauthorized users) to the vulnerability (unsecured access points).

2. Rivest, R. L., & Zissman, M. (2017). 6.857 Computer and Network Security, Fall 2017. (Massachusetts Institute of Technology: MIT OpenCourseWare).

Lecture 15: Wireless Security, discusses the vulnerabilities of early wireless security protocols like WEP, which are easily broken. An access point using such a protocol is considered unsecured and would allow an attacker to gain access, aligning with the scenario. The lecture details how weak cryptographic protections fail to prevent unauthorized connections.

3. National Institute of Standards and Technology (NIST). (2008). Guide to Securing Legacy IEEE 802.11 Wireless Networks (NIST Special Publication 800-48 Rev. 1).

Section 3.2, "Vulnerabilities," explicitly lists "Unauthorized access to the wireless network" as a key vulnerability. It details how misconfigured or poorly secured access points provide an entry point for attackers to connect to an organization's internal network.

The most direct strategy to prevent an attacker from gaining information about the web server is to obfuscate or customize error messages. Default server error messages (e.g., 404, 500) and server response headers often leak sensitive details, such as the server software (Apache, IIS), version numbers, and underlying frameworks. This information is valuable for an attacker during the reconnaissance phase to identify potential vulnerabilities. By replacing default messages with generic, custom error pages and sanitizing server headers, the organization directly addresses the management's goal of preventing this specific type of information leakage.

B. Enabling Hypertext Transfer Protocol Secure (HTTPS) over Domain Name Service (DNS): This technology (DNS over HTTPS or DoH) encrypts DNS queries to protect user privacy from network eavesdroppers; it does not hide information about the target web server itself.

C. Using HTTPS for all page and content requests: HTTPS encrypts data in transit, preventing man-in-the-middle attacks. However, it does not prevent the server from sending detailed error messages or headers to an attacker within the encrypted session.

D. Becoming PCI-DSS compliant and certified: PCI-DSS is a broad compliance framework focused on protecting cardholder data. While it requires secure configurations, it is not a specific strategy aimed solely at preventing server information disclosure.

---

1. OWASP Foundation. (2021). OWASP Top 10:2021, A05:2021 – Security Misconfiguration. OWASP. Retrieved from https://owasp.org/Top10/A052021-SecurityMisconfiguration/.

Reference Detail: The document states, "An application might be vulnerable if you are... exposing stack traces or other overly informative error messages to users." This directly supports the principle of obfuscating error messages to prevent information leakage.

2. National Institute of Standards and Technology (NIST). (2007). NIST Special Publication 800-95: Guide to Secure Web Services.

Reference Detail: Section 4.3.3, "Exception Handling," advises that "SOAP Faults can reveal implementation details of the web service... Exception handling logic should be careful not to return sensitive system information to a client such as stack traces..." This principle applies directly to web server error handling in general.

3. Apache HTTP Server Project. (n.d.). Core Features - ServerTokens Directive. Apache HTTP Server Version 2.4 Documentation.

Reference Detail: The documentation for the ServerTokens directive explains how it controls the information the server sends back in the Server response header. Setting it to Prod (ServerTokens Prod) is recommended to send only "Apache," preventing the disclosure of version and module information, which is a form of information obfuscation.