3.0 · 18% of the exam

Security Architecture

Zero trust, bastion access, where a WAF sits, and how card data is shown to a person who should never see all of it.

• 3.1 · AppliedA network lead says devices on the corporate VPN should be trusted because they ‘made it inside.’ Which model are they describing, and which model rejects that sentence?
• 3.2 · ScenarioAdministrators need SSH into private subnets. You do not want SSH exposed on the internet, and you want every admin session recorded. Which pattern fits?
• 3.3 · ScenarioSupport agents must confirm a card with the customer by reading back only the last four digits. The full number is stored for settlement. Which approach matches the agent’s screen?
• 3.2 · AppliedA public web form is being hit with SQL injection attempts. The network firewall already allows 443 to the web tier. Which additional control is aimed at this traffic?