SIMULATION A recent black-box penetration test of http://example.com discovered that external website vulnerabilities exist, such as directory traversals, cross-site scripting, cross-site forgery, and insecure protocols. You are tasked with reducing the attack space and enabling secure protocols. INSTRUCTIONS Part 1 Use the drop-down menus to select the appropriate technologies for each location to implement a secure and resilient web architecture. Not all technologies will be used, and technologies may be used multiple times. Part 2 Use the drop-down menus to select the appropriate command snippets from the drop-down menus. Each command section must be filled.

Part 1 of the simulation presents a layered security architecture. A router directs traffic from the internet, and a firewall provides the first layer of network-level defense by filtering traffic based on rules. A WAF (Web Application Firewall) is then placed in front of the web server to protect against application-level attacks like XSS and SQL injection, as specified in the scenario. This configuration reduces the attack surface by inspecting and blocking malicious requests before they reach the web server.

Part 2 requires constructing the correct OpenSSL command for generating a new private key and Certificate Signing Request (CSR). The openssl req -new -newkey command is used to create a new key and CSR. The option -newkey specifies the algorithm and key size. rsa:2048 is the precise and standard command snippet for generating a 2048-bit RSA private key, which is a widely accepted key size for security. The other options are either file paths, which are part of the -keyout and -out parameters, or incorrect syntax. The Generating RSA private key output is a result of the -newkey rsa:2048 command. Therefore, rsa:2048 is the correct command snippet to select in all three instances where a key generation parameter is required.

Network Architecture & WAFs: The Open Group. (2018). Security Architecture and Engineering. Section 5.3.

OpenSSL Commands: OpenSSL Foundation. (2023). OpenSSL req documentation. https://www.openssl.org/docs/man3.0/man1/openssl-req.html.

Firewall & Router Roles: Cisco Systems. (2020). Introduction to Networking and Security. Section 3.4.

RSA Key Length: Rivest, R. L., Shamir, A., & Adleman, L. (1978). A Method for Obtaining Digital Signatures and Public-Key Cryptosystems. Communications of the ACM, 21(2), 120–126. https://doi.org/10.1145/359340.359342.