Topic: SY0-601 topic 1 question 656

The cost of removable media and the security risks of transporting data have become too great for a laboratory. The laboratory has decided to interconnect with partner laboratories to make data transfers easier and more secure. The Chief Security Officer (CSO) has several concerns about proprietary data being exposed once the interconnections are established. Which of the following security features should the network administrator implement to prevent unwanted data exposure to users in partner laboratories?

A.
VLAN zoning with a file-transfer server in an external-facing zone
B.
DLP running on hosts to prevent file transfers between networks
C.
NAC that permits only data-transfer agents to move data between networks
D.
VPN with full tunneling and NAS authenticating through the Active Directory

Re: SY0-601 topic 1 question 656

For the scenario described where proprietary data might be exposed once interconnections are established with partner laboratories, option D (VPN with full tunneling and NAS authenticating through the Active Directory) offers a holistic security solution. It combines the encrypted communication features of a VPN with the strong user and device authentication mechanisms of Active Directory.

Re: SY0-601 topic 1 question 656

CompTIA makes nice discussion starter here, but I would prefer clear questions with clear aswers for my money.

As I understand, question here to transfer SOME data, which they want to share with other labs, but KEEP themself the rest, which they NOT want to share. From this point of view only C makes some sense, if there are agents, who has the rights, knowledge, training to send out what is meant to send out.

Re: SY0-601 topic 1 question 656

"For the scenario described where proprietary data might be exposed once interconnections are established with partner laboratories, option D (VPN with full tunneling and NAS authenticating through the Active Directory) offers a holistic security solution. It combines the encrypted communication features of a VPN with the strong user and device authentication mechanisms of Active Directory.
"

Re: SY0-601 topic 1 question 656

A. VLAN zoning: could maybe prevent a hacker from traversing the network, but the scenario is regarding insider threats.
B. DLP: stops everything from being transferred. Why even build this in the first place if DLP will stop all data transfers
C. NAC: doesn’t prevent users from sending proprietary info THROUGH a transfer agent. Basically useless in this scenario.
D. VPN: provides security and accountability by requiring AD logging. So data can be linked to each user, minimizing insider threats.

Re: SY0-601 topic 1 question 656

you're absolutely right. Option B is impossibe as DLP may block the traffic

Re: SY0-601 topic 1 question 656

B. DLP running on hosts to prevent file transfers between networks:

Data Loss Prevention (DLP) solutions can monitor and control data transfers, helping to prevent unauthorized file transfers.
This solution can be effective in preventing data exposure by monitoring and blocking sensitive data transfers between networks.

  • BD69
  • New member
  • Offline

Re: SY0-601 topic 1 question 656

D is obviously the most secure, and the most configurable, here
A, B & C can all be compromised via MITM attacks

  • BD69
  • New member
  • Offline

Re: SY0-601 topic 1 question 656

Another note on DLP. It's reasonable to assume that these partner labs are sending proprietary data TO EACH OTHER, so DLP rules would have to be relaxed. Proprietary data sent, when it is sent across the Internet, will be easily sniffed. DLP, alone, has no encryption.
With A, we can only assume that SFTP or FTPS will be used in file transfer server. This is a good method, however, nothing beats answer D (especially integrated with Active Directory which includes Role, User, and Resource Management ).   D is a no-brainer. No assumptions have to be made

Re: SY0-601 topic 1 question 656

The correct answer is **D. VPN with full tunneling and NAS authenticating through the Active Directory**. This is because a VPN (Virtual Private Network) with full tunneling establishes a secure, encrypted connection over a potentially unsecure network, like the internet. It's like a private tunnel in the internet that can securely transmit data between networks. This ensures that even if the data is intercepted, it cannot be understood due to the encryption.

NAS (Network Attached Storage) authenticating through Active Directory means that the users are authenticated (their identities are confirmed) via a central directory before they can access the data. This ensures that only authorized users can access the data.

This option addresses the CSO's concerns regarding proprietary data exposure as it provides secure data transmission and restricts data access to authenticated users only. The other options (A, B, and C) do not provide both these security measures. Therefore, D is the correct answer.

Re: SY0-601 topic 1 question 656

This company only wants to upgrade removable media capabilities to allow file transfers. B is fine and all, but it says it "prevents" file transfers. Answer A for VLAN zoning would be more of a benefit if you were merging networks/companies. VPN full tunneling at D makes no sense to me when they only need to do file transfer. C makes the most sense to me.

Re: SY0-601 topic 1 question 656

NAC is more about controlling access to a network, not specifically about preventing data exposure.

Re: SY0-601 topic 1 question 656

Chat says something I hadn't considered. the CSO is worried that only the authorized devices (w agents) at the partner labs have access. -- Answer: C. NAC that permits only data-transfer agents to move data between networks

Explanation:

Network Access Control (NAC):
Network Access Control (NAC) is a security solution that ensures only authorized devices are granted access to network resources.
In the context of the scenario, implementing NAC can help prevent unwanted data exposure by allowing only designated data-transfer agents to move data between the laboratory's network and partner laboratories' networks.
NAC solutions can enforce policies that specify which devices are allowed to connect to the network and what resources they can access. By permitting only authorized data-transfer agents, the risk of unauthorized access to proprietary data is mitigated.

Re: SY0-601 topic 1 question 656

B. DLP running on hosts to prevent file transfers between networks:

Data Loss Prevention (DLP) systems can monitor and control the movement of data within and outside the network.
Running DLP on hosts allows for fine-grained control over file transfers and can prevent unauthorized data exposure.
This solution addresses the concern of preventing unwanted data exposure effectively.

  • BD69
  • New member
  • Offline

Re: SY0-601 topic 1 question 656

I picked D, because it the only solution that provides encryption and authentication and authorization for both the VPN and the NAS where the data is being stored. 
I don't understand how answer A would provide any real security over the internet (VLANs are more like security through obscurity and not encrypted) by itself and B & C is really for preventing file transfers, but when one is allowed, it's all in the clear and a MITM attack could restore it (off the Internet).

Re: SY0-601 topic 1 question 656

NAC (Network Access Control) best choice here.
VLAN - does segmentation - but not really secure and placing a file transfer server in an external facing zone?  no...
DLP - Data Loss Prevention - good for preventing data xfer - but the question is talking about xfer between two labs....  (no)
VPN - that better since it uses encryption during data exchange, but does not prevent unauthorized device access...  yes it did say AD in the question but that does not deal with data transfer between two systems.
Best answer is NAC here.

Re: SY0-601 topic 1 question 656

B. DLP running on hosts to prevent file transfers between networks.

"The CSO has several concerns about  PROPRIETARY DATA being exposed...."

The goal is to prevent PROPRIETARY data from being exposed.

The best solution is to classify and label the proprietary data you don't want leaving the network and then using a DLP to prevent that data from leaving.

The primary purpose of a DLP is to prevent sensitive data from leaving an organization. So DLP is the best tool to use here.

Re: SY0-601 topic 1 question 656

D makes most sense

Re: SY0-601 topic 1 question 656

I think it’s b

Re: SY0-601 topic 1 question 656

Here is what Chatgpt has to say and i agree with it:
C. NAC that permits only data-transfer agents to move data between networks

Network Access Control (NAC) allows you to control and restrict access to your network based on predefined policies. In this scenario, using NAC to permit only data-transfer agents to move data between networks would help prevent unwanted data exposure to users in partner laboratories. This way, you can ensure that only authorized and secure channels are used for transferring data between laboratories while maintaining control and security over the proprietary data.

Re: SY0-601 topic 1 question 656

The last part of the question emphasizes what the requirement here is and that is protecting data. In this case, the answer will always be DLP.