A security engineer needs to select the architecture for a cloud database that will protect an organization’s sensitive data. The engineer has a choice between a single-tenant or a multitenant database architecture offered by a cloud vendor. Which of the following best describes the security benefits of the single-tenant option? (Choose two.)
A. Most cost-effective
B. Ease of backup and restoration
C. High degree of privacy
D. Low resilience to side-channel attacks
E. Full control and ability to customize
F. Increased geographic diversity
Show Answer
Correct Answer: C, E
Explanation: A single-tenant database dedicates its environment to one organization, providing stronger isolation and privacy from other tenants. It also gives the organization greater control over configuration and security customization.
Question 122
Which of the following is record-level encryption commonly used to do?
A. Protect database fields.
B. Protect individual files.
C. Encrypt individual packets.
D. Encrypt the master boot record.
Show Answer
Correct Answer: A
Explanation: Record-level encryption protects specific records or fields within a database.
Question 123
A security analyst is performing a review of a web application. During testing as a standard user, the following error log appears:
Which of the following best describes the analyst’s findings and a potential mitigation technique?
A. The findings indicate unsecure references. All potential user input needs to be properly sanitized.
B. The findings indicate unsecure protocols. All cookies should be marked as HttpOnly.
C. The findings indicate information disclosure. The displayed error message should be modified.
D. The findings indicate a SQL injection. The database needs to be upgraded.
Show Answer
Correct Answer: C
Explanation: The error exposes internal database or table details to a standard user, which is information disclosure. Replace the detailed error with a generic message for users and keep technical details in protected server-side logs.
Question 124
An organization is developing a disaster recovery plan that requires data to be backed up and available at a moment’s notice. Which of the following should the organization consider first to address this requirement?
A. Implement a change management plan to ensure systems are using the appropriate versions.
B. Hire additional on-call staff to be deployed if an event occurs.
C. Design an appropriate warm site for business continuity.
D. Identify critical business processes and determine associated software and hardware requirements.
Show Answer
Correct Answer: D
Explanation: First identify the critical business processes and their supporting software and hardware. This establishes what data and systems must be backed up and how quickly they need to be available, before choosing recovery solutions such as a warm site.
Question 125
A software developer is working on a piece of code required by a new software package. The code should use a protocol to verify the validity of a remote identity. Which of the following should the developer implement in the code?
A. RSA
B. OCSP
C. HSTS
D. CRL
Show Answer
Correct Answer: B
Explanation: OCSP (Online Certificate Status Protocol) checks whether a digital certificate has been revoked, helping verify the validity of a remote identity. RSA is a cryptographic algorithm, HSTS enforces HTTPS, and a CRL is a published list rather than a status-checking protocol.
Question 126
A company is looking for a solution to hide data stored in databases. The solution must meet the following requirements:
• Be efficient at protecting the production environment
• Not require any change to the application
• Act at the presentation layer
Which of the following techniques should be used?
A. Masking
B. Steganography
C. Algorithmic
D. Random substitution
Show Answer
Correct Answer: A
Explanation: Data masking can hide sensitive database values at the presentation layer, protecting what users see in production without requiring changes to the application.
Question 127
An organization’s senior security architect would like to develop cyberdefensive strategies based on standardized adversary techniques, tactics, and procedures commonly observed. Which of the following would best support this objective?
A. OSINT analysis
B. The Diamond Model of Intrusion Analysis
C. MITRE ATT&CK
D. Deepfake generation
E. Closed-source intelligence reporting
Show Answer
Correct Answer: C
Explanation: MITRE ATT&CK is a standardized knowledge base of adversary tactics and techniques, with procedures and observed behaviors, and can guide cyberdefensive planning. The Diamond Model supports intrusion analysis but is not a catalog of standardized adversary TTPs.
Question 128
An organization is researching the automation capabilities for systems within an OT network. A security analyst wants to assist with creating secure coding practices and would like to learn about the programming languages used on the PLCs. Which of the following programming languages is the most relevant for PLCs?
A. Ladder logic
B. Rust
C. C
D. Python
E. Java
Show Answer
Correct Answer: A
Explanation: Ladder logic is a widely used PLC programming language, designed to represent relay-based control circuits and standardized as part of IEC 61131-3. The other options are general-purpose languages and are not as directly associated with PLC programming.
Question 129
A security administrator needs to develop a remediation plan to address a large number of vulnerability scan results. Which of the following should the administrator use to determine the vulnerabilities that should be addressed first?
A firewall administrator needs to ensure all traffic across the company network is inspected. The administrator gathers data and finds the following information regarding the typical traffic in the network:
Which of the following is the best solution to ensure the administrator can complete the assigned task?
A. A full-tunnel VPN
B. Web content filtering
C. An endpoint DLP solution
D. SSL/TLS decryption
Show Answer
Correct Answer: D
Explanation: SSL/TLS decryption allows the firewall to inspect encrypted HTTPS traffic before forwarding it. A VPN routes traffic, while content filtering and endpoint DLP do not provide comprehensive inspection of encrypted traffic crossing the network.
$19
Get all 400 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.