Free 300-740 practice test: 30 questions with answers

Encryption at rest protects stored data, so keys managed by a key management service keep the objects unreadable even if the media leaves the provider's control. TLS protects data in transit, while HTTPS redirects and IP allow lists control transport and access but do not encrypt stored data.

An IPS sits inline and can drop matching packets, while an IDS on a mirrored port can only alert. NAC authenticates devices for network admission and a packet capture appliance records traffic, so neither blocks exploit traffic.

Data loss prevention inspects the content of transfers and blocks data that matches sensitive patterns such as card numbers. Category filtering checks destinations rather than content, MFA controls logins, and certificate pinning addresses trust in TLS certificates.

A WAF inspects HTTP requests and applies rules that detect injection attacks such as SQL injection. DDoS scrubbing targets traffic volume, a port-based firewall rule does not examine request contents, and health checks only manage backend availability.

Label- or tag-based policy describes workloads by their attributes, so the rules stay valid when IP addresses change or workloads migrate. IP-only rules break under movement, allowing all east-west traffic defeats segmentation, and per-user VPN profiles do not govern workload-to-workload flows.

A cloud security edge applies one policy to users regardless of location, so branches and remote users do not each need their own inspection appliance. The other options describe connectivity or key storage claims that are incorrect, and they would restrict inspection rather than extend it.

DNS-layer security blocks the name lookup before any connection to the malicious host is made, which stops the page before it loads. Antivirus scanning happens after content arrives, packet capture only records traffic, and MFA protects the email account rather than blocking the destination.

QUIC runs over UDP and encrypts end to end with TLS 1.3, so a proxy built to inspect TCP-based HTTPS cannot see inside it. Blocking UDP 443 makes browsers fall back to HTTPS over TCP, which the gateway can inspect. QUIC is encrypted, DNS normally uses port 53 or encrypted DNS, and blocking a port does not change certificate validation.

A CASB gives visibility into SaaS and cloud app usage, including unsanctioned apps, and applies data protection policy to those apps. A load balancer, a perimeter IPS, and an on-premises SIEM do not discover or control SaaS app use.

Fingerprinting compares content, so renamed copies still match. Extension-based blocking is too broad and is easily bypassed by renaming, filename matching fails after a rename, and blocking a whole network segment does not identify the sensitive content.

Zero trust network access brokers connections to individual applications, so the user never gets routed reachability to the internal network. The site-to-site tunnel, shared VPN account, and full-intranet gateway all expose more than the single application the contractor needs.

QUIC runs over UDP and integrates TLS 1.3 for its handshake and encryption, which is why modern web and remote access clients use it. Routing protocols such as BGP exchange prefixes, QUIC does not need IPsec, and it is not a DNS extension.

SAML assertions are signed by the identity provider, and the service provider validates that signature with the IdP certificate exchanged during trust setup. In SAML SSO the password is not sent to the SaaS application, and static keys or IP address checks are not how SAML establishes trust.

SCIM is an open standard for creating, updating, and removing user accounts across identity-aware cloud services. OAuth issues tokens for delegated access, while Kerberos and RADIUS authenticate users to domains or network access and do not manage account lifecycle across SaaS apps.

FIDO2 and WebAuthn credentials are bound to the origin of the legitimate site, so a phishing proxy cannot reuse them. SMS codes and TOTP codes can be captured and relayed in real time, and push approvals can be abused through approval fatigue.

A device certificate from an internal CA lets the access service verify that a request comes from a managed device, and that check is combined with user identity and posture. Disk encryption, OS login, and DNS records are separate functions that a device certificate does not perform.

Posture policies check security state such as disk encryption, host firewall status, OS patch level, and endpoint protection presence. Bookmark counts, desktop themes, and purchase dates say nothing about the device's security state.

Identity intelligence correlates sign-in and risk events across providers so that patterns become visible in one place. Pooling password hashes, disabling federation, or using basic authentication would weaken security or fragment visibility instead of improving it.

NIST SP 800-207 assumes no implicit trust based on location or ownership, and each request is authenticated and authorized against policy. The perimeter model and one-time login model describe the legacy approach zero trust replaces, and inventory membership alone does not establish trust.

The CISA Zero Trust Maturity Model organizes progress across five pillars: Identity, Devices, Networks, Applications and Workloads, and Data. The other lists are the NIST Cybersecurity Framework functions, AAA terms, or pillar names that do not appear in the model.

MITRE ATT&CK catalogs adversary tactics and techniques, including cloud-specific matrices, which lets detections be mapped to observed behavior. ISO 27017 and NIST SP 800-53 are control catalogs describing safeguards to implement, and CIS Benchmarks give hardening settings rather than adversary behavior.

eBPF lets sandboxed programs run inside the Linux kernel and observe runtime events such as process execution and network connections, which is the basis of tools such as Cilium and Tetragon. Image scanning happens before deployment, disk encryption protects data at rest, and SNMP counters report interface totals without showing process activity.

A Type 1 (bare-metal) hypervisor boots on the hardware and manages virtual machines directly. A Type 2 hypervisor runs on top of a host OS, container runtimes share a kernel rather than virtualizing hardware, and application virtualization does not host full virtual machines.

In IaaS the customer controls the operating systems, applications, data, and the access and network configuration of the resources it deploys. The provider secures the physical facilities, the physical network, and the hypervisor layer.

Microsegmentation enforces allow lists between workload groups, so a compromised workload cannot reach others it has no need to contact. A flat subnet, disabled logging, and open ports all increase lateral movement or reduce visibility.

Flow records summarize who communicated with whom, on which ports, and how much data moved, without storing the content. Full packet capture stores payloads, debug logs can contain request bodies, and console screenshots do not describe network connections.

Baseline behavior analysis learns normal patterns and alerts on significant deviations, which fits a sudden change after a stable history. Signature matching finds known exploit content, configuration checks compare settings to a benchmark, and retention testing verifies storage duration rather than behavior.

A compliance posture assessment evaluates configuration settings, such as storage access or encryption options, against a policy or benchmark. Flow baselining and signature matching examine traffic rather than settings, and retention testing checks how long logs are stored.

Monitor-mode discovery shows the real dependencies between workloads, so allow policies can be built without breaking legitimate flows. Enforcing deny-all first, disabling logs, or removing existing rules would cause outages or leave gaps in visibility and protection.

A baseline represents normal behavior, so after an approved change it must be updated or the new pattern will keep generating false alerts. Keeping the old baseline, disabling analysis, or deleting history either produces noise or removes the basis for comparison.