ISC Security Architecture Modeling — 10 Questions

Question 1

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Accepted Answer

NIST SP 800-144. NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing,' is the NIST publication specifically written to address cloud security architecture, defining the cloud service and deployment models and the security/privacy considerations unique to public cloud environments. It is the most directly relevant reference for designing a cloud reference architecture because it maps security responsibilities across IaaS, PaaS, and SaaS and addresses multi-tenancy, virtualization, and shared responsibility.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-160

Question 2

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is the standard architectural pattern for isolation.

Answer

Load Balancing

Answer

VPN

Answer

Microsegmentation

Question 3

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Accepted Answer

Clause 6. The SoA documents which controls are selected from Annex A and why, acting as the bridge between the ISMS and architecture.

Answer

Clause 10

Answer

Clause 4

Answer

Clause 8

Question 4

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

Accepted Answer

Architecture Definition Document. The Architecture Definition Document (ADD) is itself the primary deliverable produced by the TOGAF Architecture Definition phase (Phases A through D). It documents the baseline and target architectures, the gap analysis, the architecture rationale, and the roadmap components — serving as the master artifact that stakeholders review and approve. The question is essentially asking which option names the deliverable that the ADD produces, and the ADD is that deliverable.

Answer

Gap Analysis

Answer

Security Policy

Answer

Risk Register

Question 5

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

Accepted Answer

Risk management and balancing. Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.

Answer

Network perimeter defense

Answer

Code vulnerability discovery

Answer

Attack simulation

Question 6

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

Accepted Answer

OS versions. While the Shared Responsibility Model is foundational, compliance audits (such as SOC2, HIPAA, or PCI-DSS) specifically require documentation of security controls, data residency, and encryption configurations. The Shared Responsibility Model is a conceptual framework, not a specific architectural artifact.

Answer

Shared Responsibility Model

Answer

Cloud vendor pricing

Answer

Employee names

Question 7

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

Accepted Answer

Opportunities and Solutions. Architecture Vision (Phase A) is critical for establishing the security framework, scope, and initial security principles. Opportunities and Solutions (Phase E) is critical for identifying and evaluating security work packages and implementation projects to ensure security controls are properly deployed.

Answer

Requirements Management

Answer

Preliminary Phase

Answer

Implementation Governance

Question 8

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

Accepted Answer

Contextual Layer. The Contextual Layer in SABSA is the topmost layer and represents the business view, answering the 'What' question — what business attributes, drivers, and goals must be protected. It maps business requirements into security attributes before any logical or physical design decisions are made. This is why it is the correct answer for a business-perspective 'What' mapping.

Answer

Conceptual Layer

Answer

Physical Layer

Answer

Logical Layer

Question 9

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Accepted Answer

To standardize organizational processes. The Capability Maturity Model (CMM) provides a framework for assessing and improving the maturity of organizational processes across five levels, from ad hoc to optimized. Its primary goal in Enterprise Security Architecture is to standardize organizational processes so that security practices are repeatable, measurable, and continuously improving rather than dependent on individual heroics. This standardization enables consistent governance and predictable outcomes across the enterprise.

Answer

To reduce software defects

Answer

To purchase better hardware

Answer

To identify all existing threats

Question 10

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

Accepted Answer

Technical Scope Definition. Stage 2 of PASTA is defining the technical scope, which identifies assets, trust boundaries, and data flows.

Answer

Risk Analysis

Answer

Business Impact Analysis

Answer

Threat Analysis