ISC Security Architecture Modeling — All Questions With Answers

Question 1

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Accepted Answer

NIST SP 800-144. NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing,' is the NIST publication specifically written to address cloud security architecture, defining the cloud service and deployment models and the security/privacy considerations unique to public cloud environments. It is the most directly relevant reference for designing a cloud reference architecture because it maps security responsibilities across IaaS, PaaS, and SaaS and addresses multi-tenancy, virtualization, and shared responsibility.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-160

Question 2

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is the standard architectural pattern for isolation.

Answer

Load Balancing

Answer

VPN

Answer

Microsegmentation

Question 3

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Accepted Answer

Clause 6. The SoA documents which controls are selected from Annex A and why, acting as the bridge between the ISMS and architecture.

Answer

Clause 10

Answer

Clause 4

Answer

Clause 8

Question 4

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

Accepted Answer

Architecture Definition Document. The Architecture Definition Document (ADD) is itself the primary deliverable produced by the TOGAF Architecture Definition phase (Phases A through D). It documents the baseline and target architectures, the gap analysis, the architecture rationale, and the roadmap components — serving as the master artifact that stakeholders review and approve. The question is essentially asking which option names the deliverable that the ADD produces, and the ADD is that deliverable.

Answer

Gap Analysis

Answer

Security Policy

Answer

Risk Register

Question 5

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

Accepted Answer

Risk management and balancing. Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.

Answer

Network perimeter defense

Answer

Code vulnerability discovery

Answer

Attack simulation

Question 6

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

Accepted Answer

OS versions. While the Shared Responsibility Model is foundational, compliance audits (such as SOC2, HIPAA, or PCI-DSS) specifically require documentation of security controls, data residency, and encryption configurations. The Shared Responsibility Model is a conceptual framework, not a specific architectural artifact.

Answer

Shared Responsibility Model

Answer

Cloud vendor pricing

Answer

Employee names

Question 7

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

Accepted Answer

Opportunities and Solutions. Architecture Vision (Phase A) is critical for establishing the security framework, scope, and initial security principles. Opportunities and Solutions (Phase E) is critical for identifying and evaluating security work packages and implementation projects to ensure security controls are properly deployed.

Answer

Requirements Management

Answer

Preliminary Phase

Answer

Implementation Governance

Question 8

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

Accepted Answer

Contextual Layer. The Contextual Layer in SABSA is the topmost layer and represents the business view, answering the 'What' question — what business attributes, drivers, and goals must be protected. It maps business requirements into security attributes before any logical or physical design decisions are made. This is why it is the correct answer for a business-perspective 'What' mapping.

Answer

Conceptual Layer

Answer

Physical Layer

Answer

Logical Layer

Question 9

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Accepted Answer

To standardize organizational processes. The Capability Maturity Model (CMM) provides a framework for assessing and improving the maturity of organizational processes across five levels, from ad hoc to optimized. Its primary goal in Enterprise Security Architecture is to standardize organizational processes so that security practices are repeatable, measurable, and continuously improving rather than dependent on individual heroics. This standardization enables consistent governance and predictable outcomes across the enterprise.

Answer

To reduce software defects

Answer

To purchase better hardware

Answer

To identify all existing threats

Question 10

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

Accepted Answer

Technical Scope Definition. Stage 2 of PASTA is defining the technical scope, which identifies assets, trust boundaries, and data flows.

Answer

Risk Analysis

Answer

Business Impact Analysis

Answer

Threat Analysis

Question 11

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

Accepted Answer

Elevation of Privilege. STRIDE's Elevation of Privilege category covers scenarios where an attacker gains access to resources or accounts beyond their authorization level, such as obtaining administrative access. Gaining unauthorized access to an admin account is the textbook example of Elevation of Privilege. This makes B correct.

Answer

Information Disclosure

Answer

Spoofing

Answer

Denial of Service

Question 12

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

Accepted Answer

Architecture Vision. TOGAF ADM Phase A (Architecture Vision) is where the scope of the architecture engagement is defined, stakeholders are identified, and the Architecture Vision is produced. The Phase A inputs and steps explicitly include defining scope, identifying stakeholders, and creating the Statement of Architecture Work. This makes A the correct answer.

Answer

Business Architecture

Answer

Transition Planning

Answer

Architecture Requirements Repository

Question 13

In the context of TOGAF, what is the 'Architecture Repository' used for?

Accepted Answer

Managing architectural artifacts. In TOGAF, the Architecture Repository is the central holding area for all architectural assets produced and consumed by the Architecture Development Method (ADM), including the Architecture Metamodel, Architecture Capability, Architecture Landscape, Standards Information Base, Reference Library, and Governance Log. It is used to manage architectural artifacts so they can be reused, governed, and traced across architecture iterations.

Answer

Storing source code

Answer

Logging security events

Answer

Defining business requirements

Question 14

What is the primary function of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a blueprint for security design. SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.

Answer

To manage incidents

Answer

To configure firewalls

Answer

To identify vulnerabilities

Question 15

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Multi-party approval is the most critical control for preventing unauthorized deployment because it requires multiple authorized individuals to approve a deployment before it proceeds. This separation of duties ensures that no single compromised account or malicious insider can push code to production. It directly addresses the risk of unauthorized deployment by adding a human gate.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest

Question 16

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 17

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults

Question 18

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 19

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 20

Which type of diagram is used to represent the different zones in an architecture?

Accepted Answer

Trust Boundary Diagram. A trust boundary diagram or network architecture diagram is used to illustrate security zones.

Answer

Sequence diagram

Answer

Class diagram

Answer

Activity diagram

ISC Security Architecture Modeling — All Questions With Answers

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

In the context of TOGAF, what is the 'Architecture Repository' used for?

What is the primary function of a Security Reference Architecture (SRA)?

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Which type of diagram is used to represent the different zones in an architecture?

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Which component of an architecture document defines the communication standards between services?

Which component is the most critical to protect in a web-based architecture?

Which security principle is enforced when you restrict an application's ability to modify system files?

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

Which THREE components are typically included in an Enterprise Security Architecture (ESA) framework? (Select THREE)

When evaluating architectural threats, which THREE categories are explicitly defined in the STRIDE methodology? (Select THREE)

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

Which THREE elements are essential to define a trust boundary? (Select THREE)

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Which THREE of the following are considered 'Assets' in security architecture? (Select THREE)

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

When designing a secure cloud architecture, which TWO security services are essential for identity and access management? (Select TWO)

ISC Security Architecture Modeling — All Questions With Answers

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

In the context of TOGAF, what is the 'Architecture Repository' used for?

What is the primary function of a Security Reference Architecture (SRA)?

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Which type of diagram is used to represent the different zones in an architecture?

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Which component of an architecture document defines the communication standards between services?

Which component is the most critical to protect in a web-based architecture?

Which security principle is enforced when you restrict an application's ability to modify system files?

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

Which THREE components are typically included in an Enterprise Security Architecture (ESA) framework? (Select THREE)

When evaluating architectural threats, which THREE categories are explicitly defined in the STRIDE methodology? (Select THREE)

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)