, Question 1
An architect must select a key management pattern for a multi-region SaaS
platform where encryption keys must never exist in plaintext in application
memory. Which design BEST satisfies this requirement while preserving
availability during a single-region outage?
A. Envelope encryption with a cloud KMS-held root key and per-tenant
data keys cached in application memory for latency.
B. Envelope encryption where data keys are wrapped by a regional KMS
CMK, with cross-region CMK replication and in-memory only unwrap
via a hardware-backed crypto service.
C. A single global KMS CMK shared by all regions, with data keys
stored encrypted in the application database.
D. Client-side encryption where tenants own the root key and the
platform stores only ciphertext and wrapped data keys.
Correct Answer: B - Envelope encryption where data keys are
wrapped by a regional KMS CMK, with cross-region CMK
replication and in-memory only unwrap via a hardware-backed
crypto service.
RATIONALE
A hardware-backed crypto service that unwraps data keys per
operation keeps plaintext keys out of application memory while
regional CMK replication preserves availability. Option A caches
plaintext keys in memory, violating the constraint; C uses a single
global CMK creating blast-radius and outage risk; D shifts control but
does not prevent plaintext key material in platform memory during
unwrap.
Page 2
, Question 2
During a threat modeling session using STRIDE on a microservices mesh, the
team identifies that service-to-service calls rely on mutual TLS terminated at
the sidecar. Which residual threat MOST warrants an additional control beyond
mTLS?
A. Spoofing of the service identity because certificates are issued by a
shared CA.
B. Information disclosure on the wire because mTLS does not encrypt
payloads.
C. Elevation of privilege via a compromised sidecar that can impersonate
any service holding a valid SVID.
D. Denial of service from certificate rotation storms during peak traffic.
Correct Answer: C - Elevation of privilege via a compromised
sidecar that can impersonate any service holding a valid SVID.
RATIONALE
mTLS authenticates the workload identity but a compromised sidecar
holding a valid SVID can impersonate that identity to call downstream
services, enabling lateral privilege escalation. A is mitigated by proper
CA scoping and attestation; B is false because mTLS encrypts the
channel; D is an operational concern, not an elevation-of-privilege
threat.
Question 3
A zero trust architecture (NIST SP 800-207) deployment must decide policy at
each request. Which combination BEST reflects the PDP/PEP model with
continuous authorization?
A. A centralized PDP evaluates device posture, identity, and context;
PEPs at each resource enforce decisions per request with short-lived
tokens.
B. A VPN concentrator acts as the PEP and the directory service acts as
Page 3
, the PDP with session-based authorization.
C. A SIEM correlates logs and issues policy updates to firewalls acting as
PEPs on a scheduled basis.
D. An IAM system issues long-lived JWTs that PEPs validate locally
without contacting the PDP.
Correct Answer: A - A centralized PDP evaluates device posture,
identity, and context; PEPs at each resource enforce decisions per
request with short-lived tokens.
RATIONALE
NIST SP 800-207 defines a PDP that evaluates identity, device, and
contextual signals, with PEPs enforcing per-request decisions using
short-lived credentials. B collapses to perimeter trust; C is detective,
not preventive, and not per-request; D uses long-lived tokens and local
validation, undermining continuous authorization.
Question 4
A security engineer must harden a Kubernetes cluster against container escape.
Which control set provides the STRONGEST defense-in-depth against a
privileged container breakout?
A. Pod Security Admission restricted profile, seccomp RuntimeDefault,
read-only root filesystem, and no hostPath mounts.
B. Network policies denying egress, image signing with Cosign, and
admission control via OPA Gatekeeper.
C. Runtime detection with Falco, node OS patching, and RBAC limiting
kubectl access.
D. Encrypted etcd, audit logging, and API server mTLS with short-lived
certificates.
Correct Answer: A - Pod Security Admission restricted profile,
seccomp RuntimeDefault, read-only root filesystem, and no
hostPath mounts.
Page 4
An architect must select a key management pattern for a multi-region SaaS
platform where encryption keys must never exist in plaintext in application
memory. Which design BEST satisfies this requirement while preserving
availability during a single-region outage?
A. Envelope encryption with a cloud KMS-held root key and per-tenant
data keys cached in application memory for latency.
B. Envelope encryption where data keys are wrapped by a regional KMS
CMK, with cross-region CMK replication and in-memory only unwrap
via a hardware-backed crypto service.
C. A single global KMS CMK shared by all regions, with data keys
stored encrypted in the application database.
D. Client-side encryption where tenants own the root key and the
platform stores only ciphertext and wrapped data keys.
Correct Answer: B - Envelope encryption where data keys are
wrapped by a regional KMS CMK, with cross-region CMK
replication and in-memory only unwrap via a hardware-backed
crypto service.
RATIONALE
A hardware-backed crypto service that unwraps data keys per
operation keeps plaintext keys out of application memory while
regional CMK replication preserves availability. Option A caches
plaintext keys in memory, violating the constraint; C uses a single
global CMK creating blast-radius and outage risk; D shifts control but
does not prevent plaintext key material in platform memory during
unwrap.
Page 2
, Question 2
During a threat modeling session using STRIDE on a microservices mesh, the
team identifies that service-to-service calls rely on mutual TLS terminated at
the sidecar. Which residual threat MOST warrants an additional control beyond
mTLS?
A. Spoofing of the service identity because certificates are issued by a
shared CA.
B. Information disclosure on the wire because mTLS does not encrypt
payloads.
C. Elevation of privilege via a compromised sidecar that can impersonate
any service holding a valid SVID.
D. Denial of service from certificate rotation storms during peak traffic.
Correct Answer: C - Elevation of privilege via a compromised
sidecar that can impersonate any service holding a valid SVID.
RATIONALE
mTLS authenticates the workload identity but a compromised sidecar
holding a valid SVID can impersonate that identity to call downstream
services, enabling lateral privilege escalation. A is mitigated by proper
CA scoping and attestation; B is false because mTLS encrypts the
channel; D is an operational concern, not an elevation-of-privilege
threat.
Question 3
A zero trust architecture (NIST SP 800-207) deployment must decide policy at
each request. Which combination BEST reflects the PDP/PEP model with
continuous authorization?
A. A centralized PDP evaluates device posture, identity, and context;
PEPs at each resource enforce decisions per request with short-lived
tokens.
B. A VPN concentrator acts as the PEP and the directory service acts as
Page 3
, the PDP with session-based authorization.
C. A SIEM correlates logs and issues policy updates to firewalls acting as
PEPs on a scheduled basis.
D. An IAM system issues long-lived JWTs that PEPs validate locally
without contacting the PDP.
Correct Answer: A - A centralized PDP evaluates device posture,
identity, and context; PEPs at each resource enforce decisions per
request with short-lived tokens.
RATIONALE
NIST SP 800-207 defines a PDP that evaluates identity, device, and
contextual signals, with PEPs enforcing per-request decisions using
short-lived credentials. B collapses to perimeter trust; C is detective,
not preventive, and not per-request; D uses long-lived tokens and local
validation, undermining continuous authorization.
Question 4
A security engineer must harden a Kubernetes cluster against container escape.
Which control set provides the STRONGEST defense-in-depth against a
privileged container breakout?
A. Pod Security Admission restricted profile, seccomp RuntimeDefault,
read-only root filesystem, and no hostPath mounts.
B. Network policies denying egress, image signing with Cosign, and
admission control via OPA Gatekeeper.
C. Runtime detection with Falco, node OS patching, and RBAC limiting
kubectl access.
D. Encrypted etcd, audit logging, and API server mTLS with short-lived
certificates.
Correct Answer: A - Pod Security Admission restricted profile,
seccomp RuntimeDefault, read-only root filesystem, and no
hostPath mounts.
Page 4
