Select Two (Multi-Select) Questions

Enabling audit logging.

Enabling audit logging creates a chronological, tamper-evident record of all database transactions, administrative alterations, and authentication attempts. This mechanism directly satisfies the requirement for accountability and forensic traceability, which are fundamental security controls for monitoring unauthorized access attempts and satisfying regulatory compliance mandates. By capturing granular event data at the database engine level, administrators can investigate security incidents, reconstruct timeline events, and detect anomalous query patterns that indicate privilege escalation or data exfiltration.

Encryption at rest.

Encryption at rest protects stored database files, backups, and transaction logs from physical theft or unauthorized direct access to storage media by rendering the underlying data unreadable without the corresponding cryptographic keys. This mechanism directly satisfies the requirement for a valid security control designed to mitigate confidentiality breaches at the persistence layer, ensuring that even if storage hardware is compromised, the sensitive records contained within the database remain secure.

Strong access control lists (ACLs).

Database security requires granular authorisation mechanisms to satisfy the requirement for strict limitation of data access based on the principle of least privilege. Strong access control lists (ACLs) achieve this by enforcing explicit permission matrices at the table, row, or column level, directly satisfying the necessity for fine-grained privilege management. By defining precisely which users or service accounts can execute specific Data Manipulation Language (DML) operations—such as SELECT, INSERT, or UPDATE—ACLs prevent unauthorised lateral movement and restrict data exposure to only those entities with an authenticated operational requirement.

Identify design-level security flaws

Conducting threat modelling during the architecture phase satisfies the requirement to identify design-level security flaws by enabling the systematic decomposition of trust boundaries and data flows before code implementation. By scrutinising architectural patterns, security professionals detect systemic vulnerabilities, such as improper authentication mechanisms or insecure integration with Microsoft Entra ID, which are difficult to remediate post-deployment. This proactive approach ensures that structural weaknesses are mitigated early in the software development lifecycle, preventing the propagation of fundamental flaws into the final production environment.

Prioritize security investments

Threat modelling during the architecture phase provides the necessary visibility into potential attack vectors, allowing stakeholders to map identified risks against the organisation’s risk appetite. By quantifying the likelihood and impact of threats early, security teams can effectively prioritise security investments, ensuring that limited capital is allocated to the most critical vulnerabilities. This satisfies the constraint of identifying strategic resource allocation, enabling architects to justify the implementation of specific controls, such as conditional access policies within Microsoft Entra ID, before development commences.

Organizational silos

Organizational silos present a primary structural challenge when developing a cohesive Enterprise Security Architecture. Fragmented business units and isolated IT departments frequently maintain disparate authentication mechanisms, divergent patch management policies, and non-standardised logging formats. This decentralisation prevents centralised Security Information and Event Management (SIEM) aggregation and undermines unified identity federation protocols such as Microsoft Entra ID. Consequently, security teams struggle to enforce baseline controls, achieve total asset visibility, and implement zero-trust principles across heterogeneous departmental boundaries.

Alignment with business strategy

Ensuring that security frameworks directly support organizational objectives addresses the foundational constraint of strategic alignment within enterprise security architecture. Security teams must translate abstract risk tolerances and governance mandates into actionable technical controls, such as identity federations managed via Microsoft Entra ID or dynamic network segmentation, without introducing friction that impedes operational velocity. Bridging the gap between executive business goals and technical implementation prevents security silos, ensuring that protective measures enable rather than obstruct enterprise growth.

Prevents configuration drift.

Immutable infrastructure eliminates configuration drift by ensuring that servers are never modified in place after deployment. Instead of applying manual patches or runtime updates which introduce discrepancies between environments, any system change requires building a completely new server image and replacing the existing instance entirely. This architectural constraint guarantees that the running state always matches the version-controlled source template, maintaining absolute consistency across production and development lifecycles.

Enables reliable automated recovery.

Because immutable infrastructure prevents runtime configuration drift by entirely replacing compromised or degraded components with pristine, pre-configured images rather than patching them in place, it satisfies the reliability constraint required for automated recovery. This architectural determinism eliminates hidden state discrepancies between test and production environments, ensuring that automated orchestration tools can redeploy identical, known-good system states predictably during disaster recovery scenarios without risking residual artifact corruption.

Tenants

Tenants are logical containers within the Cisco ACI fabric that isolate policies, VRFs and EPGs between organisational units. They provide the administrative and policy boundary through which security segmentation is enforced, making them a primary fabric design component for segmentation.

Contracts

Cisco ACI uses contracts to enforce security segmentation by defining the allowed communication rules between Endpoint Groups (EPGs). This satisfies the stem constraint requiring a primary component for traffic enforcement, as contracts act as the logical policy containers that govern inter-EPG communication through filters and subjects, effectively functioning as stateful firewalls within the fabric architecture.

Endpoint Groups (EPG)

Endpoint Groups (EPGs) act as logical containers for collections of applications, systems, or resources that share similar policy requirements, directly satisfying the requirement for security segmentation within the Cisco ACI fabric design. By grouping endpoints based on their function rather than their physical network placement or IP address, EPGs enable administrators to apply granular whitelist-based security policies and micro-segmentation rules between different application tiers through the centralized Application Policy Infrastructure Controller (APIC).

Business attribute profiles

Business attribute profiles satisfy the demand for specific SABSA documentation types by capturing stakeholder value requirements along the vertical operational axis of the framework's matrix. This artifact translates high-level business goals into measurable security qualities, directly addressing the requirement for architecture definition documents that bridge strategic intent and security service delivery within the lower-level abstraction layers.

Security service specifications

Security service specifications directly satisfy the architectural requirement in the SABSA methodology to define what protection mechanisms are implemented at the operational layer. SABSA structures security architectures across a matrix of attributes and layers, where the operational and service management viewpoints demand precise definitions of security services. This documentation translates business security policies into functional technical specifications, detailing how mechanisms like access control, encryption, and auditing operate to protect enterprise assets within the defined architectural framework.

Access rights for cross-region data transfers.

Defining access rights for cross-region data transfers satisfies the data residency compliance constraint by enforcing identity and access management controls, such as Microsoft Entra ID conditional access policies, which restrict movement to authorized personnel and compliant jurisdictions. Implementing strict authorization barriers ensures that data packets crossing regional boundaries comply with geographic regulations, preventing unauthorized exfiltration and maintaining auditable trails of jurisdictional handoffs.

Backup retention policies.

Multi-region cloud architectures must enforce strict geographic boundaries to satisfy data residency compliance mandates. Backup retention policies directly address this constraint by controlling where long-term snapshots and historical archives are physically stored and replicated. Because regulatory frameworks often restrict data transit and out-of-region storage, defining precise retention periods ensures that secondary copies do not inadvertently violate sovereignty laws by persisting within unauthorized foreign jurisdictions beyond their operational lifecycle.

Geographic location of storage nodes.

Defining the geographic location of storage nodes directly satisfies the data residency compliance constraint in a multi-region cloud architecture. Regulatory frameworks such as GDPR mandate that personally identifiable information must remain physically bound to specific jurisdictions. Architecturally, this requires configuring cloud storage buckets, databases, and backup vaults with strict regional pinning. By enforcing these geographical boundaries at the infrastructure level, organisations prevent automated replication engines from inadvertently migrating sovereign data across international borders, thereby maintaining legal compliance and avoiding severe regulatory penalties.

API-based integration with cloud providers.

API-based integration with cloud providers is essential because a centralized governance, risk, and compliance platform must continuously ingest resource configurations and telemetry across heterogeneous architectures without manual intervention. In an enterprise multi-cloud environment, static compliance assessments fail due to rapid resource churn; programmatic interfaces allow the platform to query provider control planes in real time, satisfying the critical requirement for dynamic visibility across disparate hyperscalers.

Integrated risk assessment workflow.

Centralising governance, risk, and compliance in a multi-cloud architecture requires automated mapping between distinct cloud provider APIs and compliance frameworks, a constraint satisfied by an integrated risk assessment workflow. This capability dynamically harmonises control evaluations across AWS, Google Cloud, and Microsoft Azure by triggering automated evidence collection and remediation tasks within a unified pipeline. Without this automated workflow, security teams cannot continuously validate posture against multi-tenant policy drift, rendering enterprise oversight fragmented and manual across hyperscale boundaries.

Automated mapping of controls to multiple standards.

Managing security posture across an enterprise multi-cloud environment requires continuous alignment against diverse regulatory frameworks such as NIST, ISO, and PCI-DSS. Automated mapping of controls to multiple standards directly satisfies the core constraint of multi-cloud complexity by dynamically translating a single implementation of a technical safeguard into continuous compliance evidence across all distinct frameworks. This capability eliminates manual audit overhead and policy duplication by establishing a unified control baseline that scales efficiently across heterogeneous cloud service providers without requiring bespoke configuration for each environment.

Setting allowPrivilegeEscalation to false in the SecurityContext

Setting allowPrivilegeEscalation to false in the container's SecurityContext blocks processes from gaining more privileges than their parent, defeating setuid binaries and similar escalation vectors. This directly satisfies the requirement to prevent unauthorised container privilege escalation.

Running containers as a non-root user

Running containers as a non-root user removes the default root capabilities inside the container, so a compromised process cannot perform privileged host operations. This limits escalation impact, satisfying the best-practise requirement for preventing unauthorised privilege escalation.

Organizational maturity

Organisational maturity dictates the complexity and depth of security controls that an enterprise can effectively implement and maintain. A less mature organisation requires a framework that prioritises foundational governance and basic visibility, whereas a mature entity can adopt advanced, integrated models like SABSA or TOGAF. This factor directly satisfies the constraint of aligning architectural rigour with internal operational capabilities, ensuring that security processes are sustainable rather than overwhelming for existing staff, much like how Microsoft Entra ID provides scalable identity management tailored to varying levels of administrative expertise.

Business goals

Aligning security architecture with business goals ensures that technical controls directly support organisational objectives, such as regulatory compliance or operational agility. By mapping security requirements to specific business drivers, architects avoid implementing unnecessary overhead that could impede productivity. This factor satisfies the constraint of organisational alignment, as the framework must facilitate the delivery of services while maintaining risk thresholds. For instance, integrating Microsoft Entra ID for identity management provides a scalable mechanism that balances robust access control with the business goal of seamless user authentication.

Regulatory requirements

Regulatory requirements mandate specific controls and audit trails that dictate the structural design of a security architecture. Organisations must select frameworks that align with legal obligations, such as GDPR or PCI DSS, to ensure compliance. These external constraints force the architecture to incorporate particular logging, encryption, and access management mechanisms, such as those provided by Microsoft Entra ID for identity governance. Consequently, the chosen framework must be flexible enough to integrate these mandatory technical controls while maintaining the integrity of the overall security posture.

Implementing automated security scanning (SAST/DAST).

Automated security scanning via Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) directly satisfies the fundamental cloud requirement for continuous, scalable vulnerability management within a rapid deployment pipeline. By embedding these tools natively into the build and test phases, code repositories and running artifacts are systematically inspected for flaws, hardcoded credentials, and configuration drift before promotion to production. This programmatic enforcement ensures that security checks scale dynamically alongside ephemeral cloud infrastructure without relying on manual oversight.

Using ephemeral, isolated build runners.

Ephemeral, isolated build runners satisfy the requirement for secure pipeline execution by ensuring that every build runs inside a temporary, stateless container or virtual machine that is completely destroyed immediately afterwards. This technical mechanism directly mitigates the risk of persistent state compromise and lateral movement, as any malicious artifact, leftover secret, or inadvertent configuration drift cannot survive across separate build jobs or affect subsequent pipeline runs.

Insecure inter-service communication

Microservices architectures distribute application logic across numerous autonomous modules that constantly exchange data over networks. This physical and logical separation directly satisfies the stem's constraint regarding service distribution, exposing APIs to interception, tampering, and eavesdropping. Because boundaries that were previously shielded inside a monolithic memory space now traverse internal networks, securing these pathways via mutual TLS (mTLS), strict token validation, and encrypted service meshes is vital to prevent unauthorized access and maintain system integrity.

Lateral movement

Service distribution inherently creates fragmented network perimeters, satisfying the architectural constraint of distributed trust boundaries across containerised nodes. Because microservices frequently communicate over internal networks, an initial compromise of a single peripheral service provides attackers with an exposed pivot point. Threat modeling must account for how adversaries leverage unsecured east-west traffic and overly permissive inter-service credentials to traverse adjacent clusters, escalating privileges and compromising auxiliary workloads before security teams can detect the anomalous internal propagation.

Unexpected outbound network traffic.

Unexpected outbound network traffic serves as a primary indicator of compromise because compromised endpoints frequently communicate with external command and control (C2) infrastructure or exfiltrate sensitive data to unauthorised external hosts. By continuously monitoring egress points for anomalous connection volumes, destination IP reputations, or non-standard port usage, security teams can effectively detect covert exfiltration attempts and malicious beaconing activity that violate baseline organisational network access policies.

Unusual login times or locations.

Unusual login times or locations serve as a primary indicator of a potential system compromise by violating established behavioural baselines, directly satisfying the requirement to identify anomalies that deviate from typical user access patterns. Security information and event management (SIEM) systems and identity platforms, such as Microsoft Entra ID, continuously evaluate contextual signals—including geographical velocity, IP reputation, and historical session data. When authentication requests originate from impossible travel scenarios or outside normal operational hours, these engines trigger risk-based alerts, exposing potential credential theft and unauthorised access attempts.

Unauthorized modification of system files.

Malicious actors frequently alter critical binaries, libraries, or configuration parameters to establish persistence or execute unauthorised code on a target host. Detecting changes to these foundational elements satisfies the requirement to identify direct tampering with host integrity. Cryptographic file integrity monitoring (FIM) tools baseline known-good states and flag unexpected byte-level deviations or permission alterations, exposing persistent attacker tooling before broader network propagation occurs.

Verify explicitly

Authenticating and authorising every access request based on all available data points—including user identity, location, device health, service or workload, data classification, and anomalies—satisfies the "Verify explicitly" principle required by a Zero Trust architecture. Rather than implicitly trusting traffic originating from inside the corporate network perimeter, this mechanism continuously evaluates trust signals using policy engines like Microsoft Entra ID before granting least-privilege access to resources.

Use least privileged access

Enforcing strict least privileged access aligns directly with the core Zero Trust constraint of granting users and systems only the minimum permissions necessary to perform their specific functions, thereby mitigating lateral movement risks. By continuously validating context—such as device health and user identity—before authorising dynamic Just-In-Time and Just-Enough-Access policies, organisations effectively limit the blast radius of compromised credentials. This mechanism contrasts sharply with traditional perimeter-based implicit trust models, ensuring that even authenticated entities face granular, resource-specific access boundaries managed through identity providers like Microsoft Entra ID.

Assume breach

Assuming breach is a foundational principle of a Zero Trust architecture that directly satisfies the core requirement of operating as if an adversary is already inside the network perimeter. Instead of relying on implicit trust based on network location, this approach mandates continuous validation of identity, device health, and context. By decoupling security from the physical network topology, systems enforce strict least-privilege access and micro-segmentation, ensuring that even if an attacker compromises a credential, lateral movement is effectively contained and thwarted.

Capability to export logs and audit data.

Log and audit data export capabilities satisfy the shared responsibility governance constraint by ensuring the organisation retains independent visibility and verification over cloud-based security events. Because the underlying infrastructure and hypervisor layers remain managed by the cloud service provider, an ISSAP architect must mandate mechanisms such as API-driven log streaming or native SIEM integration to feed telemetry into an enterprise security operations centre. Without continuous, programmatic extraction of these audit trails, maintaining regulatory compliance and effective incident response is impossible.

Availability of third-party audit reports (SOC2/ISO).

Independent verification through third-party audit reports such as SOC 2 or ISO/IEC 27001 is essential because it addresses the core architectural constraint of the Shared Responsibility Model: validating the security controls implemented by the Cloud Service Provider within their hypervisor and physical infrastructure. Since an ISSAP architect cannot physically inspect or independently test underlying cloud infrastructure, these attestation reports provide cryptographic and procedural proof that the provider meets requisite baseline security, availability, and confidentiality standards.

Native security features and API maturity.

Native security features and API maturity directly satisfy the operational governance constraint mandated by the Shared Responsibility Model, as an ISSAP architect must ensure that the organisation can programmatically enforce fine-grained access controls, automated logging, and continuous compliance monitoring across the infrastructure boundary. Robust APIs and built-in cryptographic controls enable seamless integration with existing security information and event management (SIEM) pipelines, allowing the enterprise to effectively manage its assigned portion of the risk continuum without relying on brittle third-party overlays.

IPsec.

Internet Protocol Security (IPsec) operates at the network layer to secure communications across IP networks, directly satisfying the requirement to protect data during transit. By encapsulating and encrypting the entire packet payload alongside header information, IPsec establishes a secure virtual private network (VPN) tunnel between endpoints. This cryptographic mechanism ensures confidentiality, integrity, and authentication for all traversing traffic, effectively preventing interception or tampering while packets move across untrusted external networks.

TLS 1.3.

Transport Layer Security version 1.3 (TLS 1.3) directly satisfies the requirement to protect data during transit by encrypting network traffic between client and server applications. It streamlines the handshake process, eliminating obsolete and insecure cryptographic algorithms from earlier versions to ensure that intercepted packets remain confidential and tamper-proof. By establishing a secure tunnel over public networks, it prevents eavesdropping and man-in-the-middle attacks while data is actively moving across the wire.

Automated request and approval workflow.

Automated request and approval workflows provide the necessary governance to satisfy the temporal constraint inherent in Just-In-Time access. By integrating these mechanisms within Microsoft Entra ID, organisations enforce the principle of least privilege, ensuring that elevated permissions are granted only for a defined duration following explicit authorisation. This automated lifecycle management eliminates standing privileges, mitigating the risk of credential misuse by ensuring that access rights are revoked immediately upon the expiration of the approved window.

Automated revocation of privileges.

Automated revocation of privileges directly satisfies the temporal constraint inherent in Just-In-Time access by ensuring that elevated permissions expire immediately upon the completion of a task or a predefined duration. By leveraging the Microsoft Entra ID Privileged Identity Management service, this mechanism enforces the principle of least privilege through the programmatic removal of access tokens. This prevents privilege creep and minimises the window of exposure, effectively neutralising the risk of persistent unauthorised access that manual de-provisioning processes fail to mitigate.

Time-To-Live (TTL) enforcement on permissions.

Time-To-Live (TTL) enforcement directly satisfies the temporal constraint inherent in Just-In-Time access by ensuring that elevated privileges are automatically revoked after a predefined duration. Within Microsoft Entra ID, this mechanism mitigates the risk of persistent standing access by enforcing a strict expiration window on role assignments. By automating the removal of permissions, organisations minimise the attack surface and prevent privilege creep, ensuring that access remains scoped strictly to the specific timeframe required for the authorised task.

Device Posture/Health.

Evaluating device posture and health satisfies the continuous verification constraint of a Policy Decision Point by assessing compliance states such as patch levels, encryption status, and endpoint detection telemetry before granting access. In a Zero Trust architecture, verifying endpoint integrity ensures that compromised or unmanaged hardware cannot introduce vulnerabilities into the network perimeter, operating independently of user identity credentials to enforce granular, risk-based access control policies dynamically.

User Identity context.

Evaluating user identity context is a core criterion for a Policy Decision Point (PDP) because Zero Trust architecture strictly rejects implicit trust based solely on network location. The PDP assesses verifiable identity attributes, such as multi-factor authentication strength, credential risk scores, and role memberships, to satisfy the user identity context criterion specified in the stem. This mechanism ensures that access requests are continually authenticated and authorised against dynamic identity telemetry before any resource is granted.

Network/Location context.

Zero Trust architectures treat network location as untrusted, meaning the Policy Decision Point (PDP) must actively evaluate the origin of a request to satisfy the core "never trust, always verify" constraint of the stem. By inspecting contextual metadata such as source IP addresses, subnet boundaries, and geographical positioning, the PDP determines whether an access attempt originates from a corporate-managed internal network or an unmanaged public hotspot. This contextual telemetry allows the access control engine to dynamically enforce stricter authentication requirements, such as multi-factor authentication, when anomalous or external network locations are detected.

Validation of JWT/Auth tokens at the gateway.

Offloading token verification directly to the API Gateway satisfies the requirement to centralise credential inspection before requests reach backend microservices. By cryptographically validating JSON Web Tokens (JWT) at the ingress boundary—checking signatures, issuer claims, and expiration timestamps—the gateway ensures that only authenticated traffic traverses the internal network. This mechanism prevents invalid or tampered credentials from consuming backend compute resources, thereby enforcing a zero-trust perimeter at the earliest possible architectural checkpoint.

Logging and monitoring of all incoming requests.

Comprehensive logging and monitoring of all incoming requests provides the necessary audit trail to satisfy the security mechanism requirement for accountability. By capturing metadata such as source IP addresses, authentication tokens, and request patterns, administrators can detect anomalous behaviour or unauthorised access attempts. This visibility is essential for identifying potential credential stuffing or brute-force attacks against the API Gateway, ensuring that security teams can proactively respond to threats while maintaining compliance with organisational policies and integrating seamlessly with identity providers like Microsoft Entra ID.

Rate limiting to prevent brute-force attacks.

Rate limiting serves as a critical defensive layer by restricting the frequency of authentication requests from a single source, thereby mitigating the risk of brute-force or credential-stuffing attacks. By enforcing these thresholds at the API Gateway, organisations prevent malicious actors from exhaustively testing password combinations against backend services. This mechanism directly satisfies the requirement for robust authentication handling by ensuring that excessive traffic volumes do not compromise the integrity of identity providers, such as Microsoft Entra ID, while maintaining overall system availability.

Different access privileges

A trust boundary requires a distinct transition in authorization context, which is established by enforcing different access privileges across the boundary. When two system segments operate under disparate security domains, the disparity in permissions—such as the separation between standard user authorization and elevated administrative privileges—acts as the definitive architectural line where trust must be formally evaluated and validated. This satisfies the core constraint of defining a trust boundary by identifying where authorization levels shift, necessitating explicit security controls and privilege management to govern data and control flow between the two domains.

Different authentication requirements

Varying authentication requirements satisfy the criteria for establishing a trust boundary because they enforce a strict demarcation where security context, credential validation mechanisms, or identity providers must transition. When data or execution flows cross from an environment relying on multifactor token-based validation into a zone permitting legacy perimeter-based basic authentication, a distinct security tier is crossed. This operational shift in verification rigour necessitates a boundary to isolate disparate levels of assurance and prevent privilege escalation across the security domain.

Network zone separation

Network zone separation functions as a core structural constraint when defining a trust boundary because it enforces logical and physical isolation between distinct security domains, such as separating a public-facing perimeter from an internal enterprise segment. By deploying firewalls, VLANs, or software-defined perimeters, administrators establish explicit transit control points where ingress and egress traffic must be inspected, authenticated, and authorised. This architectural segmentation satisfies the explicit requirement for boundary definition by delineating where disparate trust levels meet, thereby containing potential lateral movement during a security compromise.