System and network architecture for security operations

Key: C

1. AWithout a delay field or a normalized UTC time, events cannot be ordered across sources or checked for late arrival.
2. BConverting to the server's local time at ingestion discards the original device timestamp that forensics needs.
3. CCorrect: Keeping the original device timestamp, the ingestion timestamp, the delay between them and a normalized UTC field preserves the evidence while letting the SIEM query on one consistent clock.
4. DA device timestamp with only a time zone string forces conversion at query time and omits the ingestion details.

Key: A

1. ACorrect: Only the cloud control plane records management activity such as IAM policy changes and resource modifications, and the firewall logs show no management context at all.
2. BNeither source in the table records payload volume, so this is not what relying on the firewall loses; the gap unique to the cloud source is management activity.
3. CThe firewall logs include source and destination IPs, so outbound destinations are still visible.
4. DFirewalls record permitted and denied traffic for inbound flows, so this connection data is still available.

Key: A

1. ACorrect: Shipping logs to a separate account with immutable (write-once) storage puts them out of reach of the compromised admin credentials, so the attackers cannot delete them.
2. BA customer-managed key protects confidentiality, but an admin who controls the account can still delete the logs or the key.
3. CIAM read restrictions do not stop a high-level administrator from deleting logs or changing the policies.
4. DThe hypervisor belongs to the cloud provider and is not a place customers can send logs, and syslog forwarding does not capture control-plane audit trails.

Key: C

1. ASampling 1 percent of events throws away almost all evidence, including the rare events investigations depend on.
2. BSeven days is too short for most investigations, which often start weeks after the compromise.
3. CCorrect: Keeping high-value records such as authentication events and privileged API calls for 90 days while sampling low-value, high-volume events such as image pulls balances forensic value against storage cost.
4. DKeeping every log for a year with no sampling preserves evidence but ignores the cost goal.

Key: C

1. ATracing every invocation adds cost and latency to functions that may run millions of times.
2. BTurning off instrumentation leaves serverless workloads with no visibility at all.
3. CCorrect: Short-lived functions suit lightweight, function-level tracing, while long-running VMs can carry full agents, so each workload gets visibility at a reasonable cost.
4. DServerless platforms often cannot host full agents, and where they can, agents slow startup and add cost.

Key: B

1. AInspecting only internal servers leaves outbound traffic, where most threats arrive, unexamined.
2. BCorrect: Decrypting only high-risk categories while exempting regulated traffic, such as health or banking sites, keeps detection where it matters and avoids compliance problems and broken connections.
3. CAccepting certificate errors disrupts users and teaches them to click through warnings.
4. DDisabling all inspection removes visibility into threats hidden in encrypted traffic.

Key: B

1. AA larger revocation list is an operational detail, not the main cryptographic risk of a shared key.
2. BCorrect: If one certificate and private key serve every inspection point, disclosing that key lets an attacker impersonate or decrypt traffic everywhere, so a single leak becomes a systemic compromise.
3. CSharing a certificate does not reduce validation errors, and fewer errors would not be a failure anyway.
4. DReusing one certificate does not improve forward secrecy, which depends on ephemeral key exchange.

Key: A

1. ACorrect: Measured boot hashes each boot component and records the values in the TPM so they can be checked later, rather than relying on digital signatures.
2. BAttestation reports the TPM's measurements to a verifier; it uses the hashes but is not the mechanism that records them.
3. CSecure boot checks digital signatures on boot components against trusted certificates, which is the approach the question rules out.
4. DAn HSM is a dedicated device for managing keys, not a boot-integrity mechanism built on the TPM.

Key: A

1. ACorrect: NAC checks a device's posture, such as patch level and security settings, before allowing it to connect.
2. BA firewall filters traffic by rules but does not assess whether a device is compliant.
3. CA VPN encrypts the connection but does not check device health on its own.
4. DAn IDS detects suspicious traffic and does not grant or deny access based on device compliance.

Key: B

1. AAn IDS watches for attacks on the network and does not manage device settings or updates.
2. BCorrect: MDM enrolls employee mobile devices and enforces security policies, updates and remote actions such as lock or wipe.
3. CEncryption protects data on the device but does not manage policies or updates.
4. DFirewall management controls network rule sets and has no say over mobile devices.

Key: D

1. ASDN separates network control from traffic forwarding; it is not a tool for enforcing security policy across cloud services.
2. BA VPN creates encrypted tunnels but does not monitor or enforce policy across cloud providers.
3. CA VPC is an isolated network inside a single cloud provider; it is no policy tool that spans several providers.
4. DCorrect: A CASB sits between users and cloud services and enforces security policies, such as access rules and DLP, while giving visibility across many cloud environments.

Key: A

1. ACorrect: Recording and analyzing privileged sessions captures exactly what administrators did, which is what monitoring privileged activity requires.
2. BPeriodic access reviews confirm who holds privileges but do not show what those users do with them.
3. CPassword rotation reduces credential risk but does not monitor activity.
4. DAwareness training changes behavior over time but provides no monitoring.

Key: D

1. AA self-encrypting drive encrypts its own data but is not a general device for managing keys.
2. BA TPM is a chip built into one device that protects that device's keys; it is not a dedicated key-management device.
3. CA TEE is an isolated area inside the processor for running sensitive code, whereas a separate hardware device for managing keys is an HSM.
4. DCorrect: An HSM is a dedicated, tamper-resistant hardware device built to generate, store and manage cryptographic keys.

Key: B

1. APurpose limitation means data is used only for the purpose it was collected for; limiting how much is collected in the first place is minimization.
2. BCorrect: Data minimization means collecting only the personal data needed for the stated purpose, a principle written into privacy laws such as the GDPR.
3. CData masking hides sensitive values, for example in test data, but does not limit what is collected.
4. DData sovereignty means data is subject to the laws of the country where it is stored.