Security Architecture Modeling

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?

In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

What is the primary function of a Security Reference Architecture (SRA)?

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)

When designing a secure cloud architecture, which TWO security services are essential for identity and access management? (Select TWO)

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

Which THREE components are typically included in an Enterprise Security Architecture (ESA) framework? (Select THREE)

Which THREE of the following are considered 'Assets' in security architecture? (Select THREE)

Which type of diagram is used to represent the different zones in an architecture?

Which THREE elements are essential to define a trust boundary? (Select THREE)

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)

Which security principle is enforced when you restrict an application's ability to modify system files?

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Which component is the most critical to protect in a web-based architecture?

When evaluating architectural threats, which THREE categories are explicitly defined in the STRIDE methodology? (Select THREE)

In the context of TOGAF, what is the 'Architecture Repository' used for?

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Which component of an architecture document defines the communication standards between services?

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?