ISC Security Architecture Modeling Practice Test 1 — 15 Questions

Question 1

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Accepted Answer

NIST SP 800-144. NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing,' is the NIST publication specifically written to address cloud security architecture, defining the cloud service and deployment models and the security/privacy considerations unique to public cloud environments. It is the most directly relevant reference for designing a cloud reference architecture because it maps security responsibilities across IaaS, PaaS, and SaaS and addresses multi-tenancy, virtualization, and shared responsibility.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-160

Question 2

Which architecture pattern is specifically designed to isolate sensitive processes from the rest of the network?

Accepted Answer

DMZ. A DMZ (Demilitarized Zone) is the standard architectural pattern for isolation.

Answer

Load Balancing

Answer

VPN

Answer

Microsegmentation

Question 3

When documenting security architecture, which component of the ISO/IEC 27001 standard is most closely aligned with the 'Statement of Applicability'?

Accepted Answer

Clause 6. The SoA documents which controls are selected from Annex A and why, acting as the bridge between the ISMS and architecture.

Answer

Clause 10

Answer

Clause 4

Answer

Clause 8

Question 4

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

Accepted Answer

Architecture Definition Document. The Architecture Definition Document (ADD) is itself the primary deliverable produced by the TOGAF Architecture Definition phase (Phases A through D). It documents the baseline and target architectures, the gap analysis, the architecture rationale, and the roadmap components — serving as the master artifact that stakeholders review and approve. The question is essentially asking which option names the deliverable that the ADD produces, and the ADD is that deliverable.

Answer

Gap Analysis

Answer

Security Policy

Answer

Risk Register

Question 5

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

Accepted Answer

Risk management and balancing. Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.

Answer

Network perimeter defense

Answer

Code vulnerability discovery

Answer

Attack simulation

Question 6

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

Accepted Answer

OS versions. While the Shared Responsibility Model is foundational, compliance audits (such as SOC2, HIPAA, or PCI-DSS) specifically require documentation of security controls, data residency, and encryption configurations. The Shared Responsibility Model is a conceptual framework, not a specific architectural artifact.

Answer

Shared Responsibility Model

Answer

Cloud vendor pricing

Answer

Employee names

Question 7

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

Accepted Answer

Opportunities and Solutions. Architecture Vision (Phase A) is critical for establishing the security framework, scope, and initial security principles. Opportunities and Solutions (Phase E) is critical for identifying and evaluating security work packages and implementation projects to ensure security controls are properly deployed.

Answer

Requirements Management

Answer

Preliminary Phase

Answer

Implementation Governance

Question 8

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

Accepted Answer

Contextual Layer. The Contextual Layer in SABSA is the topmost layer and represents the business view, answering the 'What' question — what business attributes, drivers, and goals must be protected. It maps business requirements into security attributes before any logical or physical design decisions are made. This is why it is the correct answer for a business-perspective 'What' mapping.

Answer

Conceptual Layer

Answer

Physical Layer

Answer

Logical Layer

Question 9

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Accepted Answer

To standardize organizational processes. The Capability Maturity Model (CMM) provides a framework for assessing and improving the maturity of organizational processes across five levels, from ad hoc to optimized. Its primary goal in Enterprise Security Architecture is to standardize organizational processes so that security practices are repeatable, measurable, and continuously improving rather than dependent on individual heroics. This standardization enables consistent governance and predictable outcomes across the enterprise.

Answer

To reduce software defects

Answer

To purchase better hardware

Answer

To identify all existing threats

Question 10

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

Accepted Answer

Technical Scope Definition. Stage 2 of PASTA is defining the technical scope, which identifies assets, trust boundaries, and data flows.

Answer

Risk Analysis

Answer

Business Impact Analysis

Answer

Threat Analysis

Question 11

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

Accepted Answer

Elevation of Privilege. STRIDE's Elevation of Privilege category covers scenarios where an attacker gains access to resources or accounts beyond their authorization level, such as obtaining administrative access. Gaining unauthorized access to an admin account is the textbook example of Elevation of Privilege. This makes B correct.

Answer

Information Disclosure

Answer

Spoofing

Answer

Denial of Service

Question 12

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

Accepted Answer

Architecture Vision. TOGAF ADM Phase A (Architecture Vision) is where the scope of the architecture engagement is defined, stakeholders are identified, and the Architecture Vision is produced. The Phase A inputs and steps explicitly include defining scope, identifying stakeholders, and creating the Statement of Architecture Work. This makes A the correct answer.

Answer

Business Architecture

Answer

Transition Planning

Answer

Architecture Requirements Repository

Question 13

In the context of TOGAF, what is the 'Architecture Repository' used for?

Accepted Answer

Managing architectural artifacts. In TOGAF, the Architecture Repository is the central holding area for all architectural assets produced and consumed by the Architecture Development Method (ADM), including the Architecture Metamodel, Architecture Capability, Architecture Landscape, Standards Information Base, Reference Library, and Governance Log. It is used to manage architectural artifacts so they can be reused, governed, and traced across architecture iterations.

Answer

Storing source code

Answer

Logging security events

Answer

Defining business requirements

Question 14

What is the primary function of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a blueprint for security design. SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.

Answer

To manage incidents

Answer

To configure firewalls

Answer

To identify vulnerabilities

Question 15

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Multi-party approval is the most critical control for preventing unauthorized deployment because it requires multiple authorized individuals to approve a deployment before it proceeds. This separation of duties ensures that no single compromised account or malicious insider can push code to production. It directly addresses the risk of unauthorized deployment by adding a human gate.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest