SY0-701 practice questions: Security Architecture

Answer: D. Objective 3.1 names the cloud responsibility matrix as an architecture concept. The AWS shared responsibility model states that AWS is responsible for protecting the infrastructure that runs the cloud services, while the customer handles, for an instance service, management of the guest operating system including updates and security patches, the application software installed, and the configuration of the provider-supplied firewall. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 3: Security Architecture

Answer: B. Objective 3.2 lists device attributes as active versus passive and inline versus tap/monitor. A tap or mirror feeds a copy of the traffic to a passive sensor, so detection is achieved with no influence on forwarding - the trade-off being that a passive deployment can alert on an attack but cannot block it. NIST SP 800-94 defines a passive sensor as one deployed so that it monitors a copy of the actual network traffic, with no traffic passing through the sensor, and names spanning ports and network taps as the ways to feed it. Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 3: Security Architecture

Answer: B. Objective 3.2 lists the load balancer among network appliances, and one consequence of placing it in front of an application is that the application no longer sees its clients. MDN's reference for X-Forwarded-For states: "If a client connection passes through any forward or reverse proxies, the server only sees the final proxy's IP address". Its security section adds: "Any security-related use of X-Forwarded-For (such as for rate limiting or IP-based access control) must only use IP addresses added by a trusted proxy", and "Leftmost (untrusted) values must only be used for cases where there is no negative impact from using spoofed values." For choosing the trustworthy entry it describes a trusted proxy count, under which "The X-Forwarded-For IP list is searched from the rightmost by that count minus one." With one trusted load balancer the count is one, so the entry to use is the rightmost - the address the load balancer itself observed. MDN also warns that if the server can be reached directly from the internet, no part of the list is trustworthy, which is why the scenario matters that the application is reachable only through the load balancer. Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Forwarded-For

Answer: C. For connectionless protocols such as UDP, stateful firewalls track only addresses and ports. A UDP packet must still match a state table entry, so an unsolicited response with no earlier query is not permitted. Because the end of a session cannot be seen, the entry is removed after a preconfigured timeout. Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), SP80041r1-p14, p. 14-15 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations

Answer: C. Some personal firewall appliances can be partly configured by UPnP, which lets applications on PCs ask the firewall to open ports. Most that support it have the feature off by default, because it is a significant security risk to let untrusted applications alter a firewall's security policy. Source: NIST SP 800-41 Rev. 1, Guidelines on Firewalls and Firewall Policy (2009), 2.2.2 Personal Firewall Appliances SP80041r1-p21, p. 21 Source: CompTIA Security+ SY0-701 Exam Objectives - Domain 4: Security Operations