CISSP Security Architecture and Engineering — 20 Questions

Question 1

An organization is implementing a hardware security module (HSM) to manage cryptographic keys. The security architect requires that keys be backed up securely and that the backup process ensures the same level of protection as the primary key storage. Which backup method best meets this requirement?

Accepted Answer

Use the HSM's key-wrapping function to encrypt the key and store the wrapped key in a secure offsite facility. Option C is correct because key-wrapping (also known as key encryption) uses a dedicated wrapping key within the HSM to encrypt the target key, ensuring the key never leaves the HSM in plaintext. The wrapped key can be safely stored offsite and later unwrapped only by an authorized HSM, preserving the same cryptographic protection as the primary storage. This method aligns with NIST SP 800-57 guidelines for secure key backup and escrow.

Answer

Export the key in plaintext and store it in a safe

Answer

Replicate the HSM configuration to another HSM in a different location

Answer

Store an encrypted copy on a local server in the same data center

Question 2

A security architect is designing a secure enclave for processing highly sensitive data. The architecture must ensure that even if the operating system is compromised, the enclave's memory contents remain confidential and integrity-protected. Which technology should be used?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it provides hardware-enforced isolation of memory regions (enclaves) that remain confidential and integrity-protected even if the operating system or hypervisor is compromised. SGX encrypts enclave memory on-die and decrypts it only within the CPU, preventing any privileged software from reading or tampering with the data.

Answer

Full disk encryption (FDE) with a strong passphrase

Answer

Trusted Platform Module (TPM)

Answer

Hypervisor-based isolation

Question 3

A company deploys a web application that uses TLS to protect data in transit. The security team discovers that the server supports TLS 1.0 and uses a 1024-bit RSA certificate. What is the most significant security concern?

Accepted Answer

The server supports TLS 1.0. TLS 1.0 is a deprecated protocol with known vulnerabilities, including susceptibility to BEAST and POODLE attacks, which can allow an attacker to decrypt intercepted traffic. While a 1024-bit RSA key is weak, the most immediate and significant risk is the use of an outdated protocol that is actively exploited in the field. Disabling TLS 1.0 and enforcing TLS 1.2 or higher is the critical first step to secure data in transit.

Answer

The certificate uses RSA 1024-bit key

Answer

The server does not support HTTP/2

Answer

The server enables TLS session tickets

Question 4

An organization is implementing a bring-your-own-device (BYOD) policy. The security architect must ensure that corporate data on the device is protected from unauthorized access if the device is lost or stolen, while minimizing impact on user privacy. Which solution is most appropriate?

Accepted Answer

Use mobile device management (MDM) to create a secure container for corporate apps and data. A secure container (often implemented via MDM with app wrapping or per-app VPN) creates an encrypted, isolated partition on the device for corporate apps and data. This ensures that if the device is lost or stolen, the corporate data remains encrypted and inaccessible without the container's authentication, while personal apps and data outside the container remain untouched, thus minimizing privacy impact.

Answer

Require employees to use company-issued devices only

Answer

Disable camera and microphone on the device

Answer

Full device encryption with remote wipe capability

Question 5

A security architect is reviewing a system that uses a microkernel operating system. The architect is concerned about potential side-channel attacks between processes. Which mitigation is most effective at the architecture level?

Accepted Answer

Use cache partitioning or cache coloring to isolate process caches. D is correct because cache partitioning or cache coloring directly addresses the root cause of side-channel attacks in a microkernel environment: shared CPU caches. By isolating each process's cache footprint, an attacker cannot infer sensitive data (e.g., cryptographic keys) through timing variations or cache occupancy measurements, which is a fundamental architectural mitigation.

Answer

Randomize the address space layout (ASLR)

Answer

Implement stack canaries in all user-space applications

Answer

Reduce the number of system calls and IPC mechanisms

Question 6

A small business wants to implement multifactor authentication (MFA) for remote access to its internal network. The solution must be cost-effective and easy to deploy. Which combination is most appropriate?

Accepted Answer

Password and one-time passcode sent via SMS. Option B is correct because it combines a password (something you know) with a one-time passcode sent via SMS (something you have), satisfying the definition of multifactor authentication. SMS-based OTP is cost-effective and easy to deploy for a small business, as it requires no additional hardware or complex infrastructure, leveraging existing mobile networks.

Answer

Fingerprint scanner and password

Answer

Smart card and PIN

Answer

Password and security questions

Question 7

An organization is designing a disaster recovery site. The primary data center is located in a region prone to earthquakes. The recovery site must be far enough away to avoid the same seismic zone but close enough to minimize latency. Which site selection criteria is most important?

Accepted Answer

Geographical diversity to avoid the same seismic zone. Geographical diversity (Option B) is the most important criterion because the primary data center is in an earthquake-prone region, and the recovery site must be located outside the same seismic zone to ensure that a single seismic event does not destroy both sites. This directly addresses the core requirement of disaster recovery: maintaining availability during a regional catastrophe. While latency and connectivity are important, they are secondary to ensuring the recovery site survives the same disaster.

Answer

Access to diverse power grids

Answer

High-speed network connectivity between sites

Answer

Availability of skilled personnel near the recovery site

Question 8

Which TWO of the following are principles of the Bell-LaPadula security model?

Accepted Answer

No read up. The Bell-LaPadula model enforces mandatory access control (MAC) to protect confidentiality. Option D (No read up) is correct because a subject cannot read an object at a higher classification level, preventing unauthorized access to sensitive information. Option E (No write down) is correct because a subject cannot write to an object at a lower classification level, preventing the downgrading of classified data.

Answer

Separation of duty

Answer

No write up

Answer

No read down

Question 9

Which THREE of the following are valid countermeasures against buffer overflow attacks?

Accepted Answer

Stack canaries. Stack canaries are correct because they place a known value (canary) between the buffer and control data on the stack. Before a function returns, the canary is checked; if it has been overwritten (indicating a buffer overflow), the program terminates, preventing code execution. This directly detects stack-based buffer overflows before they can hijack the return address.

Answer

Full disk encryption

Answer

Input validation using allowlists

Question 10

Which TWO of the following are examples of physical security controls?

Accepted Answer

Biometric door locks. Biometric door locks are physical security controls because they restrict physical access to a facility or room by verifying a unique biological trait (e.g., fingerprint, iris pattern). This falls under the domain of physical access control, which is a core component of physical security, not logical or administrative controls.

Answer

Firewall rules

Answer

Security awareness training

Answer

Intrusion detection system (IDS)

Question 11

A financial services company has a hybrid cloud environment with on-premises servers and a public cloud provider. The security team recently discovered that an attacker exfiltrated sensitive customer data from a cloud storage bucket. The investigation reveals that the bucket was configured with a bucket policy that allowed anonymous read access. The security architect must redesign the architecture to prevent such incidents. The company uses AWS for cloud services. The architect proposes the following: (1) Enable AWS CloudTrail and Amazon GuardDuty for monitoring. (2) Implement AWS Identity and Access Management (IAM) roles for applications instead of long-term access keys. (3) Use AWS Key Management Service (KMS) to encrypt data at rest. (4) Configure a VPC with a NAT gateway and private subnets for all compute resources. (5) Implement S3 bucket policies that deny all access unless explicitly allowed by a specific IAM role. During a review, the chief information security officer (CISO) points out that one of these measures does not directly address the root cause of the incident. Which measure is least effective in preventing unauthorized access to S3 buckets?

Accepted Answer

Enable AWS CloudTrail and Amazon GuardDuty for monitoring. Option C (enabling AWS CloudTrail and Amazon GuardDuty) is a detective control, not a preventive one. The root cause of the incident was a misconfigured bucket policy that allowed anonymous read access. Monitoring tools can detect unauthorized access after it occurs but cannot prevent it. The other options directly address the root cause by enforcing least privilege, encrypting data, or restricting network access.

Answer

Use AWS KMS to encrypt data at rest

Answer

Configure a VPC with private subnets and a NAT gateway

Answer

Implement IAM roles for applications instead of long-term access keys

Question 12

Drag and drop the steps for setting up a VPN using IPsec in tunnel mode in the correct order.

Question 13

Match each PKI component to its function.

Question 14

A security architect is evaluating security models for a multilevel secure system. Which model enforces the * property (no write down) and is typically used for confidentiality?

Accepted Answer

Bell-LaPadula. The Bell-LaPadula model enforces the * (star) property, which prohibits subjects from writing to objects at a lower classification level (no write down). This property, combined with the simple security property (no read up), ensures that information cannot flow from higher to lower security levels, making it the standard model for enforcing confidentiality in multilevel secure systems.

Answer

Clark-Wilson

Answer

Brewer-Nash

Answer

Biba

Question 15

Which of the following is a primary benefit of using an application programming interface (API) gateway in a microservices architecture from a security perspective?

Accepted Answer

It provides a centralized point for authentication and rate limiting. An API gateway acts as a single entry point for all client requests in a microservices architecture. It centralizes cross-cutting security concerns such as authentication (e.g., validating OAuth 2.0 tokens or JWT) and rate limiting (e.g., enforcing requests per second per client), offloading these tasks from individual microservices. This reduces attack surface and ensures consistent enforcement of security policies across the entire system.

Answer

It eliminates the need for encryption

Answer

It replaces the need for a web application firewall

Answer

It allows direct database access to services

Question 16

An organization requires that all data stored in a cloud object storage service be encrypted at rest using customer-managed keys. Which encryption option should be implemented?

Accepted Answer

Server-side encryption with customer-provided keys (SSE-C). SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to encrypt objects at rest in cloud object storage using keys that are managed and supplied by the customer, not the cloud provider. This meets the requirement for customer-managed keys because the encryption key is provided in each API request and is never stored by the service, giving the customer full control over key lifecycle and access.

Answer

Server-side encryption with Amazon S3 managed keys (SSE-S3)

Answer

Transport Layer Security (TLS)

Answer

Client-side encryption

Question 17

In the context of physical security, which of the following is an example of a preventive control?

Accepted Answer

Mantrap door. A mantrap door is a preventive physical security control because it actively prevents unauthorized entry by requiring authentication and verification before allowing passage through a series of interlocking doors. Unlike monitoring or detection systems, a mantrap physically blocks access until the user is validated, thereby stopping a breach before it occurs.

Answer

Security guards monitoring

Answer

CCTV cameras

Answer

Intrusion detection system

Question 18

A company is implementing a secure software development lifecycle (SSDLC). Which of the following is a key activity during the design phase?

Accepted Answer

Threat modeling. Threat modeling is a key activity during the design phase of the SSDLC because it proactively identifies potential security threats, vulnerabilities, and attack vectors before any code is written. By analyzing the system's architecture, data flows, and trust boundaries (e.g., using STRIDE or PASTA methodologies), teams can design security controls directly into the system, reducing the cost and impact of fixes later. This aligns with the NIST SP 800-64 and Microsoft SDL frameworks, which mandate threat modeling as a core design-phase activity.

Answer

Static code analysis

Answer

Code signing

Answer

Penetration testing

Question 19

Which of the following describes the concept of 'least privilege' in the context of access control?

Accepted Answer

Users are granted only the permissions necessary to perform their job functions. Least privilege is a fundamental access control principle that mandates users be granted only the permissions necessary to perform their specific job functions. This minimizes the attack surface by reducing unnecessary access to sensitive resources, limiting potential damage from accidental or malicious actions. In practice, this is enforced through mechanisms like discretionary access control (DAC) or role-based access control (RBAC) with granular permission sets, ensuring no user has more rights than required.

Answer

Access is granted on a need-to-know basis but with maximum permissions

Answer

Access is based on roles and seniority

Answer

Users have access to all resources unless explicitly denied

Question 20

A security engineer is designing a cryptographic solution to ensure data integrity and non-repudiation. Which combination should be used?

Accepted Answer

Digital signature with hashing. Digital signature with hashing is the correct combination because hashing ensures data integrity by producing a fixed-size digest, and the digital signature encrypts that hash with the sender's private key, providing non-repudiation by proving the sender's identity and preventing denial of message origin. This satisfies both requirements without relying on a shared secret.

Answer

HMAC with a shared key

Answer

Asymmetric encryption with digital signature

Answer

Symmetric encryption with HMAC