ISC Security Architecture Modeling — 20 Questions

Question 1

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is the standard architectural pattern for isolation.

Answer

Load Balancing

Answer

VPN

Answer

Microsegmentation

Question 2

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Accepted Answer

Clause 6. The SoA documents which controls are selected from Annex A and why, acting as the bridge between the ISMS and architecture.

Answer

Clause 10

Answer

Clause 4

Answer

Clause 8

Question 3

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Accepted Answer

NIST SP 800-144. NIST SP 800-144 is the standard reference for cloud computing security and architecture guidelines.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-160

Question 4

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

Accepted Answer

Contextual Layer. SABSA uses a matrix where the Contextual layer (Layer 1) defines the 'What' (Business requirements).

Answer

Conceptual Layer

Answer

Physical Layer

Answer

Logical Layer

Question 5

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Accepted Answer

To standardize organizational processes. CMM allows an organization to measure the effectiveness and repeatability of its security architecture processes.

Answer

To reduce software defects

Answer

To purchase better hardware

Answer

To identify all existing threats

Question 6

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

Accepted Answer

Technical Scope Definition. Stage 2 of PASTA is defining the technical scope, which identifies assets, trust boundaries, and data flows.

Answer

Risk Analysis

Answer

Business Impact Analysis

Answer

Threat Analysis

Question 7

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

Accepted Answer

Elevation of Privilege. Elevation of Privilege (E) occurs when a user gains access rights they should not possess.

Answer

Information Disclosure

Answer

Spoofing

Answer

Denial of Service

Question 8

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

Accepted Answer

Architecture Vision. The Preliminary Phase and Phase A are critical for scoping, but the Architecture Vision phase specifically mandates stakeholder identification and scope definition.

Answer

Business Architecture

Answer

Transition Planning

Answer

Architecture Requirements Repository

Question 9

In the context of TOGAF, what is the 'Architecture Repository' used for?

Accepted Answer

Managing architectural artifacts. The repository acts as a central library for all architectural work products, models, and design patterns.

Answer

Storing source code

Answer

Logging security events

Answer

Defining business requirements

Question 10

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

Accepted Answer

Architecture Definition Document. The ADD is the main container for all architectural descriptions and documentation.

Answer

Gap Analysis

Answer

Security Policy

Answer

Risk Register

Question 11

What is the primary function of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a blueprint for security design. SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.

Answer

To manage incidents

Answer

To configure firewalls

Answer

To identify vulnerabilities

Question 12

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Separation of duties via multi-party approval in the pipeline prevents a single compromised account from pushing code to production.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest

Question 13

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 14

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults

Question 15

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 16

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 17

Which type of diagram is used to represent the different zones in an architecture?

Accepted Answer

Trust Boundary Diagram. A trust boundary diagram or network architecture diagram is used to illustrate security zones.

Answer

Sequence diagram

Answer

Class diagram

Answer

Activity diagram

Question 18

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Accepted Answer

Attributes drive services. The business attributes (what the business needs) drive the requirement for specific security services.

Answer

Attributes describe technical vulnerabilities

Answer

Services drive attributes

Answer

They are independent

Question 19

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

Accepted Answer

Microsoft Threat Modeling Tool. Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 20

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

Accepted Answer

Defense in depth. Defense in depth ensures that if one layer fails, others remain to protect the system.

Answer

Separation of duties

Answer

Principle of Least Privilege

Answer

Fail-safe defaults