ISC Security Architecture Modeling Practice Test 2 — 15 Questions

Question 1

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 2

Which type of diagram is used to represent the different zones in an architecture?

Accepted Answer

Trust Boundary Diagram. A trust boundary diagram or network architecture diagram is used to illustrate security zones.

Answer

Sequence diagram

Answer

Class diagram

Answer

Activity diagram

Question 3

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Accepted Answer

Attributes drive services. The business attributes (what the business needs) drive the requirement for specific security services.

Answer

Attributes describe technical vulnerabilities

Answer

Services drive attributes

Answer

They are independent

Question 4

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

Accepted Answer

Microsoft Threat Modeling Tool. Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 5

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

Accepted Answer

Defense in depth. Defense in depth ensures that if one layer fails, others remain to protect the system.

Answer

Separation of duties

Answer

Principle of Least Privilege

Answer

Fail-safe defaults

Question 6

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 7

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

Accepted Answer

Risk management and balancing. Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.

Answer

Network perimeter defense

Answer

Code vulnerability discovery

Answer

Attack simulation

Question 8

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

Accepted Answer

FEAF. FEAF (Federal Enterprise Architecture Framework) is the standard for US federal government agencies.

Answer

TOGAF

Answer

SABSA

Answer

Zachman Framework

Question 9

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern prevents an application from repeatedly trying to execute an operation that is likely to fail.

Answer

Sharding

Answer

Load Balancing

Answer

Encryption

Question 10

Which component of an architecture document defines the communication standards between services?

Accepted Answer

Interface specification. The Interface Specification or API design document defines how services communicate.

Answer

System overview

Answer

Data dictionary

Answer

Security policy

Question 11

Which component is the most critical to protect in a web-based architecture?

Accepted Answer

Database. The database is typically the primary target for attackers as it contains the sensitive data.

Answer

Web server

Answer

Load balancer

Answer

CSS files

Question 12

Which security principle is enforced when you restrict an application's ability to modify system files?

Accepted Answer

Least privilege. Least privilege ensures that the application has only the permissions required for its function, preventing system-wide modifications.

Answer

Defense in depth

Answer

Economy of mechanism

Answer

Complete mediation

Question 13

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

Accepted Answer

Shared Responsibility Model. Shared Responsibility Model documentation is essential to define which security controls the provider manages vs. the customer.

Answer

Cloud vendor pricing

Answer

Employee names

Answer

OS versions

Question 14

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

Accepted Answer

Motivation. The 'Why' column in the Zachman Framework is the 'Motivation' column, which focuses on business goals and security drivers.

Answer

Data

Answer

Function

Answer

Time

Question 15

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

Accepted Answer

Automated security assessment. SCAP provides a standardized way to automate security vulnerability management and configuration assessment.

Answer

Firewall management

Answer

Access control

Answer

Encryption