, Question 1
An organization is migrating a monolithic on-premises application to a
microservices architecture on a public cloud. The security architect must
ensure that inter-service communication is authenticated, encrypted, and
resilient to lateral movement. Which design combination BEST satisfies these
requirements while adhering to zero trust principles?
A. Deploy a service mesh with mutual TLS (mTLS) and fine-grained
authorization policies, and use short-lived workload identities issued by a
SPIFFE-compatible identity provider.
B. Place all microservices in a single flat network segment protected by a
perimeter firewall and rely on network ACLs for service-to-service access
control.
C. Use API keys stored in environment variables for service
authentication and enable TLS termination at the ingress controller only.
D. Implement a VPN between all nodes and use long-lived X.509
certificates with static IP allowlisting for inter-service trust.
Correct Answer: A - Deploy a service mesh with mutual TLS
(mTLS) and fine-grained authorization policies, and use
short-lived workload identities issued by a SPIFFE-compatible
identity provider.
RATIONALE
Zero trust requires per-request authentication and least-privilege
authorization; a service mesh with mTLS and SPIFFE-based
short-lived identities provides cryptographic workload identity and
prevents lateral movement. Flat networks with ACLs (B), static API
keys (C), and long-lived certificates with IP allowlisting (D) violate
zero trust and enable credential replay or lateral movement.
Page 2
, Question 2
A security engineer is designing a key management system for a multi-tenant
SaaS platform. The requirement is to ensure that a compromise of one tenant's
data encryption key does not expose other tenants' data, and that the cloud
provider cannot access plaintext keys. Which architecture BEST meets these
requirements?
A. Use a single master key stored in a hardware security module (HSM)
to encrypt all tenant data keys, and store the encrypted keys in a shared
database.
B. Implement a hierarchical key management system with a per-tenant
master key stored in a cloud HSM, and derive data encryption keys using
HKDF with tenant-specific context.
C. Encrypt each tenant's data with a key derived from the tenant's
password using PBKDF2, and store the salt in the tenant's profile.
D. Use envelope encryption with a global master key and store wrapped
data keys alongside the ciphertext in the same object storage bucket.
Correct Answer: B - Implement a hierarchical key management
system with a per-tenant master key stored in a cloud HSM, and
derive data encryption keys using HKDF with tenant-specific
context.
RATIONALE
Per-tenant master keys in an HSM with HKDF-derived data keys
provide cryptographic isolation and ensure the provider cannot access
plaintext keys. Option A uses a single master key, so compromise
affects all tenants; C relies on passwords and lacks HSM protection; D
uses a global key and stores wrapped keys with ciphertext, increasing
blast radius.
Page 3
, Question 3
A hospital network must comply with HIPAA and protect electronic protected
health information (ePHI). The security team is evaluating network
segmentation strategies. Which approach MOST effectively reduces the attack
surface and limits lateral movement while meeting compliance requirements?
A. Implement a flat network with VLANs for each department and rely
on 802.1X for port-based access control.
B. Deploy a next-generation firewall at the perimeter and use intrusion
prevention systems (IPS) to block malicious traffic.
C. Adopt a zero trust microsegmentation architecture with
software-defined perimeters, encrypting ePHI in transit and at rest, and
enforcing least-privilege access based on user and device context.
D. Use a demilitarized zone (DMZ) for all medical devices and separate
the ePHI database on a dedicated VLAN.
Correct Answer: C - Adopt a zero trust microsegmentation
architecture with software-defined perimeters, encrypting ePHI
in transit and at rest, and enforcing least-privilege access based
on user and device context.
RATIONALE
Zero trust microsegmentation with software-defined perimeters and
context-based access control limits lateral movement and aligns with
HIPAA's access control and encryption requirements. Flat VLANs (A)
and perimeter-only defenses (B) do not prevent internal lateral
movement; a DMZ for all devices (D) is impractical and does not
enforce least privilege.
Page 4
An organization is migrating a monolithic on-premises application to a
microservices architecture on a public cloud. The security architect must
ensure that inter-service communication is authenticated, encrypted, and
resilient to lateral movement. Which design combination BEST satisfies these
requirements while adhering to zero trust principles?
A. Deploy a service mesh with mutual TLS (mTLS) and fine-grained
authorization policies, and use short-lived workload identities issued by a
SPIFFE-compatible identity provider.
B. Place all microservices in a single flat network segment protected by a
perimeter firewall and rely on network ACLs for service-to-service access
control.
C. Use API keys stored in environment variables for service
authentication and enable TLS termination at the ingress controller only.
D. Implement a VPN between all nodes and use long-lived X.509
certificates with static IP allowlisting for inter-service trust.
Correct Answer: A - Deploy a service mesh with mutual TLS
(mTLS) and fine-grained authorization policies, and use
short-lived workload identities issued by a SPIFFE-compatible
identity provider.
RATIONALE
Zero trust requires per-request authentication and least-privilege
authorization; a service mesh with mTLS and SPIFFE-based
short-lived identities provides cryptographic workload identity and
prevents lateral movement. Flat networks with ACLs (B), static API
keys (C), and long-lived certificates with IP allowlisting (D) violate
zero trust and enable credential replay or lateral movement.
Page 2
, Question 2
A security engineer is designing a key management system for a multi-tenant
SaaS platform. The requirement is to ensure that a compromise of one tenant's
data encryption key does not expose other tenants' data, and that the cloud
provider cannot access plaintext keys. Which architecture BEST meets these
requirements?
A. Use a single master key stored in a hardware security module (HSM)
to encrypt all tenant data keys, and store the encrypted keys in a shared
database.
B. Implement a hierarchical key management system with a per-tenant
master key stored in a cloud HSM, and derive data encryption keys using
HKDF with tenant-specific context.
C. Encrypt each tenant's data with a key derived from the tenant's
password using PBKDF2, and store the salt in the tenant's profile.
D. Use envelope encryption with a global master key and store wrapped
data keys alongside the ciphertext in the same object storage bucket.
Correct Answer: B - Implement a hierarchical key management
system with a per-tenant master key stored in a cloud HSM, and
derive data encryption keys using HKDF with tenant-specific
context.
RATIONALE
Per-tenant master keys in an HSM with HKDF-derived data keys
provide cryptographic isolation and ensure the provider cannot access
plaintext keys. Option A uses a single master key, so compromise
affects all tenants; C relies on passwords and lacks HSM protection; D
uses a global key and stores wrapped keys with ciphertext, increasing
blast radius.
Page 3
, Question 3
A hospital network must comply with HIPAA and protect electronic protected
health information (ePHI). The security team is evaluating network
segmentation strategies. Which approach MOST effectively reduces the attack
surface and limits lateral movement while meeting compliance requirements?
A. Implement a flat network with VLANs for each department and rely
on 802.1X for port-based access control.
B. Deploy a next-generation firewall at the perimeter and use intrusion
prevention systems (IPS) to block malicious traffic.
C. Adopt a zero trust microsegmentation architecture with
software-defined perimeters, encrypting ePHI in transit and at rest, and
enforcing least-privilege access based on user and device context.
D. Use a demilitarized zone (DMZ) for all medical devices and separate
the ePHI database on a dedicated VLAN.
Correct Answer: C - Adopt a zero trust microsegmentation
architecture with software-defined perimeters, encrypting ePHI
in transit and at rest, and enforcing least-privilege access based
on user and device context.
RATIONALE
Zero trust microsegmentation with software-defined perimeters and
context-based access control limits lateral movement and aligns with
HIPAA's access control and encryption requirements. Flat VLANs (A)
and perimeter-only defenses (B) do not prevent internal lateral
movement; a DMZ for all devices (D) is impractical and does not
enforce least privilege.
Page 4
