CSLB General Building (B) — All Questions

Which security model assumes no user or device is trusted by default, even inside the network perimeter?

• a.Zero trust✓
• b.Defense in depth
• c.Perimeter security
• d.Implicit trust

Zero trust removes automatic trust based on network location and continuously verifies every request. Access is granted per session based on identity, device posture, and context. It reduces lateral movement after a breach.

Layering multiple independent security controls so that one failure does not cause a breach is called:

• a.Single sign-on
• b.Defense in depth✓
• c.Least privilege
• d.Air gapping

Defense in depth stacks overlapping controls across people, process, and technology so no single failure is catastrophic. If one layer is bypassed, others still protect the asset. It reflects the assumption that any one control can fail.

Dividing a network into isolated zones to limit the spread of an attack is known as:

• a.Load balancing
• b.Port forwarding
• c.Segmentation✓
• d.Tunneling

Network segmentation separates systems into zones so a compromise in one cannot freely reach others. It limits lateral movement and contains breaches. VLANs, firewalls, and microsegmentation implement this principle.

Which network area sits between the internet and the internal network to host public-facing services?

• a.Intranet
• b.VPN concentrator
• c.Air gap
• d.Screened subnet (DMZ)✓

A screened subnet, historically called a DMZ, isolates public-facing servers from the internal network. If a public host is compromised, the internal network remains protected by an additional boundary. Firewalls control traffic on both sides.

Which cloud model gives the customer the most control over the operating system and applications while the provider manages the physical hardware?

• a.Infrastructure as a Service✓
• b.Software as a Service
• c.Platform as a Service
• d.Function as a Service

Infrastructure as a Service (IaaS) provides virtualized compute, storage, and networking while the customer manages the OS and applications. This maximizes customer control and responsibility. SaaS, by contrast, hands nearly everything to the provider.

In cloud computing, which concept defines who is responsible for securing which layers of the stack?

• a.Elasticity
• b.Shared responsibility model✓
• c.Multitenancy
• d.Serverless

The shared responsibility model divides security duties between the cloud provider and the customer. The provider secures the underlying infrastructure while the customer secures data, identities, and configurations. Misunderstanding the split is a common source of cloud breaches.

Which technology allows multiple isolated operating systems to run on a single physical host?

• a.Containerization
• b.Clustering
• c.Virtualization✓
• d.Load balancing

Virtualization uses a hypervisor to run multiple guest operating systems on one physical machine, each isolated in a virtual machine. It improves resource use and isolation. Hardening the hypervisor is critical because it is a high-value target.

Which approach packages an application with its dependencies to run consistently across environments while sharing the host OS kernel?

• a.Full virtualization
• b.Bare-metal deployment
• c.Air gapping
• d.Containerization✓

Containerization bundles an application and its dependencies into a lightweight, portable unit that shares the host kernel. Containers start quickly and use fewer resources than full VMs. Isolation is weaker than VMs, so kernel and image security matter.

Which principle grants users only the minimum access needed to perform their job?

• a.Least privilege✓
• b.Separation of duties
• c.Defense in depth
• d.Implicit deny

Least privilege limits each user or process to only the permissions required for its role. This shrinks the attack surface and limits damage from compromised accounts. Regular access reviews keep privileges aligned with need.

A firewall rule set ends with a rule that blocks anything not explicitly permitted. This is called:

• a.Explicit allow
• b.Implicit deny✓
• c.Stateful inspection
• d.Failover

Implicit deny blocks all traffic that no earlier rule explicitly allows. It ensures only intended traffic passes and unknowns are rejected by default. This deny-by-default posture is a core secure design principle.

Which design ensures a system has no single point of failure by duplicating critical components?

• a.Least functionality
• b.Segmentation
• c.Redundancy✓
• d.Tokenization

Redundancy duplicates critical components, such as power supplies or servers, so failure of one does not cause an outage. It supports high availability and resilience. Combined with failover, it keeps services running through faults.

Which term describes an isolated environment where suspicious code can be executed and analyzed safely?

• a.Honeypot
• b.Bastion host
• c.Air gap
• d.Sandbox✓

A sandbox is a contained, isolated environment for running untrusted code without risking the host or network. It is used to analyze malware behavior or test software safely. Escapes from the sandbox are a key security concern.

Which decoy system is deployed to attract attackers and study their techniques?

• a.Honeypot✓
• b.Jump server
• c.Proxy server
• d.Load balancer

A honeypot is a deliberately vulnerable-looking decoy that lures attackers away from real assets and gathers intelligence on their methods. Any interaction with it is suspicious by design. Honeynets extend the concept to entire fake networks.

Which hardened intermediary host is used to securely administer devices in a sensitive network segment?

• a.Honeypot
• b.Jump server (bastion host)✓
• c.Web proxy
• d.DNS resolver

A jump server, or bastion host, is a tightly controlled system that administrators connect through to reach protected segments. It centralizes and monitors administrative access. Hardening and logging on this host are essential because it is a gateway to sensitive systems.

Which control physically separates a highly sensitive network from all other networks and the internet?

• a.VPN
• b.Screened subnet
• c.Air gap✓
• d.NAT

An air gap isolates a system or network so it has no physical or logical connection to untrusted networks. It is used for critical systems like industrial controls. Data transfer requires manual, controlled processes, which reduces remote attack surface.

Which concept keeps availability high by automatically shifting workloads to a standby system when the primary fails?

• a.Load balancing
• b.Segmentation
• c.Snapshotting
• d.Failover✓

Failover automatically transfers operations to a redundant standby when the active component fails, minimizing downtime. It is a cornerstone of high-availability design. Regular testing ensures the standby will actually take over when needed.

Embedded systems in industrial equipment that monitor and control physical processes are collectively known as:

• a.ICS/SCADA✓
• b.IoT hubs
• c.Thin clients
• d.Edge routers

Industrial control systems (ICS), including SCADA, manage physical processes in utilities and manufacturing. They often run legacy software and prioritize availability over patching. Segmentation and strict access control are key because downtime and safety are critical.

Which design principle removes unnecessary services, ports, and software to reduce a system's attack surface?

• a.Redundancy
• b.Least functionality✓
• c.Elasticity
• d.Multitenancy

Least functionality configures a system to run only the services and features required for its purpose. Disabling unneeded components shrinks the attack surface. It complements least privilege by hardening the system itself, not just user access.