To encrypt traffic within a VLAN  Incorrect.  VACLs do not encrypt traffic; encryption is handled by protocols like IPsec or SSL.

To assign devices to specific VLANs dynamically  Incorrect.  Dynamic VLAN assignment is typically managed by protocols like 802.1X or MAB, not VACLs.

To authenticate users accessing the switch  Incorrect.  User authentication is handled by protocols like RADIUS or TACACS+, not VACLs.

Amazon CloudFront  Incorrect. Amazon CloudFront is a content delivery network (CDN) service that caches content, such as web pages and media, at edge locations to reduce latency for end users. While it improves performance and availability for cached content globally, it is not designed to distribute application traffic across multiple AWS Regions for high availability of dynamic applications.

Elastic Load Balancer (ELB)  Incorrect.  Elastic Load Balancer distributes incoming application traffic across multiple targets, such as EC2 instances, within a single AWS Region. While it supports high availability within a region by balancing traffic across Availability Zones, it does not provide cross-region traffic distribution, which is required for the organization’s goal of multi-region high availability.

Amazon Route 53  Incorrect.  Amazon Route 53 is a scalable DNS service that can route traffic to different endpoints based on policies like latency or geolocation. While it supports failover and multi-region routing via DNS, it does not optimize traffic paths across the AWS global network as effectively as AWS Global Accelerator, which is specifically designed for cross-region traffic distribution and high availability.

Amazon DynamoDB with global tables  Incorrect.  Amazon DynamoDB is a NoSQL database service that supports global tables for multi-region replication, which is useful for low-latency access across regions. However, the question specifies a relational database, and DynamoDB’s non-relational structure does not meet this requirement. While it offers high availability, it is not the appropriate choice for a relational database workload.

Amazon Redshift with automated snapshots  Incorrect.  Amazon Redshift is a data warehouse service optimized for large-scale analytics and reporting, not for low-latency transactional workloads typical of web applications. While it supports automated snapshots for data recovery, it does not provide automatic failover in the same way as RDS Multi-AZ, and its architecture is not suited for the low-latency relational database needs described in the question.

Amazon EC2 with a self-managed MySQL database  Incorrect.  Running a self-managed MySQL database on Amazon EC2 gives full control over the database configuration but requires manual setup for high availability, such as configuring replication and failover mechanisms. This approach is more complex and error-prone compared to Amazon RDS with Multi-AZ, which automates failover and scalability, making it less suitable for meeting the requirements efficiently.

Disabling SSID broadcasting  Incorrect.  Disabling SSID broadcasting makes the network less visible but does not prevent unauthorized access, as attackers can still detect hidden SSIDs using tools like packet sniffers.

Using a guest VLAN  Incorrect.  A guest VLAN isolates guest users but does not secure the primary wireless network from unauthorized access.

Reducing antenna power  Incorrect.  Reducing antenna power limits signal range but does not address authentication or encryption, leaving the network vulnerable to unauthorized access within range.

Formatting the SSD – Incorrect. Formatting an SSD only removes the file system pointers to the data, not the data itself. Specialized recovery tools can often retrieve data from a formatted SSD, making this an insecure method for disposing of sensitive information. For secure disposal, the data must be physically destroyed or overwritten multiple times, which formatting does not accomplish.

Degaussing the SSD – Incorrect. Degaussing involves applying a strong magnetic field to erase data, which is effective for magnetic media like hard disk drives (HDDs). However, SSDs use flash memory, which is not affected by magnetic fields. Therefore, degaussing is ineffective for securely disposing of an SSD and does not prevent data recovery.

Encrypting the SSD – Incorrect. While encrypting an SSD can protect data during its use, it does not securely dispose of the data. If the encryption keys are compromised or improperly managed, the data could still be recovered. Encryption is a protective measure, not a disposal method, and does not meet secure disposal requirements for sensitive data.

Penetration testing Incorrect. Penetration testing simulates attacks to identify exploitable vulnerabilities in a network. It is a proactive measure used to assess security posture, not a reactive technique for investigating an ongoing or past incident. It would not help the analyst determine which systems have communicated with a malicious IP address or assess the scope of an existing compromise.

Packet capture analysis Incorrect. Packet capture analysis involves capturing and examining network traffic to identify specific patterns or anomalies. While it can provide detailed insights into communications with the malicious IP address for a specific system, it is not the most effective technique for determining the scope of a compromise across the entire network, as it focuses on individual traffic flows rather than aggregated data.

Vulnerability scanning Incorrect. Vulnerability scanning identifies weaknesses in systems or applications that could be exploited. While useful for proactive security, it does not directly help in investigating an active compromise or determining which systems may have been affected by communication with a malicious IP address. It focuses on potential risks rather than analyzing current or past network activity.

Wired Equivalent Privacy (WEP)  Incorrect.  WEP is an outdated wireless security protocol that uses weak encryption (RC4) and has known vulnerabilities, making it easily susceptible to attacks. It does not provide strong encryption or mutual authentication, making it unsuitable for securing modern wireless networks as required by the question.

An organization is implementing a new wireless network and wants to ensure Wi-Fi Protected Access (WPA)  Incorrect.  WPA was an improvement over WEP, introducing stronger encryption with TKIP and better key management. However, it is outdated compared to WPA3 and does not offer the same level of security, such as resistance to modern attack vectors or robust mutual authentication mechanisms, making it less suitable for the organization’s goal of strong encryption and authentication.

Temporal Key Integrity Protocol (TKIP)  Incorrect.  TKIP is a legacy encryption protocol used in WPA to improve upon WEP’s weaknesses. It is not a standalone protocol for wireless authentication and is considered deprecated due to vulnerabilities, such as susceptibility to decryption attacks. It does not provide the strong encryption or mutual authentication required, making it an incorrect choice for the scenario.

Firewall logs  Incorrect.  Firewall logs track network traffic, not specific process activities on a server.

Network packet captures  Incorrect.  Network packet captures provide network-level data but lack detailed process-specific information like system logs.

DNS query logs  Incorrect.  DNS query logs track domain name resolutions, not process activities on a server.

Static code analysis  Incorrect.  Static code analysis examines code without execution, which is less effective for dynamic payloads like those in phishing emails.

Packet sniffing  Incorrect.  Packet sniffing captures network traffic but does not analyze the behavior of a payload.

Vulnerability scanning  Incorrect.  Vulnerability scanning identifies system weaknesses, not the behavior of malicious payloads.

Dynamic ARP Inspection (DAI)  Incorrect.  DAI prevents ARP spoofing attacks by validating ARP packets, not restricting device connections to ports.

DHCP Snooping  Incorrect.  DHCP Snooping filters untrusted DHCP messages to prevent rogue DHCP servers, not unauthorized device connections.

Access Control Lists (ACLs)  Incorrect.  ACLs control traffic flow based on IP or port information, not physical device connections to a port.

Access mode  Incorrect.  Access mode is used to configure a switch port to belong to a single VLAN, allowing only devices in that VLAN to communicate through the port. This mode is suitable for connecting end devices, such as PCs or printers, but it does not allow multiple VLANs to coexist on the same port.

Dynamic auto mode  Incorrect.  Dynamic auto mode is a setting for Dynamic Trunking Protocol (DTP), which allows switches to negotiate whether a port should be in access or trunk mode. While it might result in a trunk link if the other side is configured appropriately, it is not a guaranteed or explicit configuration for allowing multiple VLANs. Relying on dynamic negotiation is less reliable than explicitly setting the port to trunk mode.

Static VLAN assignment  Incorrect.  Static VLAN assignment refers to manually assigning a port to a single VLAN, similar to access mode. This configuration does not support multiple VLANs on the same port, as it restricts the port to traffic from one VLAN only. It fails to meet the requirement of allowing multiple devices on different VLANs to communicate through a single port.

Simple Network Management Protocol (SNMP) Incorrect. SNMP is used for managing and monitoring network devices, such as routers, switches, and servers, by collecting and organizing information about their status and performance. It is not designed for file transfers, secure or otherwise, making it unsuitable for the purpose described in the question.

File Transfer Protocol (FTP) Incorrect. FTP is a protocol used for transferring files between a client and a server over a network. However, it lacks built-in encryption, making it insecure for transferring sensitive data. The question specifies securely transferring files, so FTP does not meet this requirement.

Trivial File Transfer Protocol (TFTP) Incorrect. TFTP is a simplified protocol used for transferring small files, often in scenarios like booting devices over a network. It lacks security features, such as encryption or authentication, making it unsuitable for secure file transfers.

Sending a ping request to the server to check for connectivity  Incorrect.  Sending a ping request is a basic network diagnostic technique used to verify if a server is reachable over the network. It does not interact with the web application or its database, nor does it help confirm a SQL injection vulnerability or extract data, making it irrelevant to the scenario described in the question.

Scanning the server for open ports using a port scanner  Incorrect.  Port scanning is a reconnaissance technique used to identify open ports and services on a server, which can help map the attack surface. However, it does not directly confirm a SQL injection vulnerability or allow data extraction from a database, as it focuses on network-level information rather than application-level vulnerabilities like SQL injection.

Encrypting the input data to bypass the application’s authentication  Incorrect.  Encrypting input data is not a valid technique for exploiting SQL injection vulnerabilities. SQL injection relies on injecting unfiltered SQL code into input fields to manipulate the database, not on encrypting data. This approach would not confirm the vulnerability or extract data, as it does not interact with the database in a way that exploits the SQL injection flaw.

Rely solely on perimeter-based defenses to protect internal resources. Incorrect. Perimeter-based defenses, such as firewalls, are insufficient in a zero trust architecture, which assumes that threats can exist both outside and inside the network. Zero trust shifts away from traditional perimeter security by requiring continuous verification of all access requests, regardless of whether they originate from within or outside the organization’s network.

Assume all network traffic is trusted until proven otherwise. Incorrect. This approach contradicts the core philosophy of zero trust, which assumes that no traffic, user, or device—inside or outside the network—can be trusted by default. Zero trust requires explicit verification for every access request, regardless of the source, to ensure security in a dynamic threat landscape.

Implement least privilege access only for administrative accounts. Incorrect. While implementing least privilege access is an important security practice, it is not specific to zero trust architecture and does not apply exclusively to administrative accounts. Zero trust requires least privilege for all accounts, not just administrative ones, and encompasses broader principles like continuous validation of identity and device posture for every access request.

Data loss prevention (DLP)  Incorrect.  DLP focuses on preventing data exfiltration, not detecting unauthorized access patterns.

Firewall rule updates  Incorrect.  Firewall rule updates control network traffic but do not monitor user behavior or credential misuse.

Mandatory access control (MAC)  Incorrect.  MAC enforces strict access policies but does not actively detect anomalous behavior after access is granted.