Security+ PBQ 3: Architecture and Data Protection

Scenario

A company is redesigning a customer portal. The design must protect web applications, keep public services separated from internal systems, protect payment data, and support recovery after an outage.

Your task: Select the best architecture, data protection, or recovery control.

Asset	Requirement
Customer web app	Protect against web attacks
Cardholder data	Reduce exposure
Portal availability	Recover within hours

1. Best control to inspect and block common web application attacks:

2. Best network area for public-facing servers separated from the internal LAN:

3. A security device should block traffic if it fails. This is:

4. Replacing card numbers with non-sensitive values in the application database is:

Resilience and Data

5. Best protection for data stored on a server volume:

6. Recovery site with some systems and connectivity already prepared, but not fully live:

7. Best availability method to spread requests across multiple web servers:

8. Best low-disruption test of an incident or recovery plan with stakeholders:

Instructor Answer

A WAF protects web applications from common Layer 7 attacks.
A screened subnet separates public-facing services from internal networks.
Fail-closed blocks traffic when the device cannot enforce policy.
Tokenization replaces sensitive data with substitute values.
Encryption at rest protects stored data.
A warm site is partially prepared and faster than a cold site.
Load balancing improves availability by distributing traffic.
A tabletop exercise validates plans without disrupting production.