ISC Security Architecture Modeling Practice Test 2 — 15 Questions

Question 1

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 2

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults

Question 3

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 4

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 5

Which type of diagram is used to represent the different zones in an architecture?

Accepted Answer

Trust Boundary Diagram. A trust boundary diagram or network architecture diagram is used to illustrate security zones.

Answer

Sequence diagram

Answer

Class diagram

Answer

Activity diagram

Question 6

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Accepted Answer

Attributes drive services. The business attributes (what the business needs) drive the requirement for specific security services.

Answer

Attributes describe technical vulnerabilities

Answer

Services drive attributes

Answer

They are independent

Question 7

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

Accepted Answer

Microsoft Threat Modeling Tool. Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 8

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

Accepted Answer

Defense in depth. Defense in depth ensures that if one layer fails, others remain to protect the system.

Answer

Separation of duties

Answer

Principle of Least Privilege

Answer

Fail-safe defaults

Question 9

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 10

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

Accepted Answer

FEAF. FEAF (Federal Enterprise Architecture Framework) is the standard for US federal government agencies.

Answer

TOGAF

Answer

SABSA

Answer

Zachman Framework

Question 11

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern wraps calls to a remote service and, after a threshold of failures, 'trips' to fail fast and stop hammering the failing dependency, allowing it time to recover. This preserves availability by preventing cascading failures and resource exhaustion in a distributed system.

Answer

Sharding

Answer

Load Balancing

Answer

Encryption

Question 12

Which component of an architecture document defines the communication standards between services?

Accepted Answer

Interface specification. The Interface Specification or API design document defines how services communicate.

Answer

System overview

Answer

Data dictionary

Answer

Security policy

Question 13

Which component is the most critical to protect in a web-based architecture?

Accepted Answer

Database. The database is typically the primary target for attackers as it contains the sensitive data.

Answer

Web server

Answer

Load balancer

Answer

CSS files

Question 14

Which security principle is enforced when you restrict an application's ability to modify system files?

Accepted Answer

Least privilege. Least privilege means granting a subject only the minimum access rights necessary to perform its function — no more. Restricting an application from modifying system files enforces least privilege by removing write access the application does not need, thereby limiting the blast radius if the application is compromised. This is the canonical example of least privilege applied at the process/application level.

Answer

Defense in depth

Answer

Economy of mechanism

Answer

Complete mediation

Question 15

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

Accepted Answer

Motivation. The 'Why' column in the Zachman Framework is the 'Motivation' column, which focuses on business goals and security drivers.

Answer

Data

Answer

Function

Answer

Time