208 questions total · 3pages · All types, answers revealed
Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)
Visual documentation is mandatory for audit.
Why this answer
Auditors require the design itself (diagrams) and the security controls implemented to protect the assets.
In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?
Govern is the new core function in 2.0.
Why this answer
NIST CSF 2.0 added the 'Govern' function, which specifically includes Supply Chain Risk Management (SCRM) and governance strategy.
You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?
Uses attributes for fine-grained authorization decisions.
Why this answer
Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.
Which THREE of the following are risks associated with using shared cloud storage buckets?
A leading cause of data breaches.
Why this answer
Public access, lack of encryption, and missing object versioning are common risks.
What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?
Scope-based access control is a security best practice.
Why this answer
Scopes limit the permissions (actions and resources) associated with a specific token, ensuring that if a token is compromised, the attacker's capabilities are restricted.
You are auditing an OAuth 2.0 implementation. You discover that the application uses the 'Implicit Grant' flow. Why is this considered an architectural security weakness?
This is the primary vulnerability of the Implicit flow.
Why this answer
The Implicit Grant returns access tokens directly in the URL fragment, which is susceptible to browser history leaks, referrer header exposure, and interception via malicious extensions.
A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?
This policy prevents specific users or groups from using RDP to access the target machine.
Why this answer
Restricted Groups or the newer 'Group Policy Preferences > Local Users and Groups' can be used, but specifically, to mitigate lateral movement, 'Deny log on through Remote Desktop Services' is the standard hardening control for local admins.
When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?
This is the engine where access levels are defined for PDP decisions.
Why this answer
Access Context Manager is the policy engine in GCP that defines the context used by the BeyondCorp architecture to make access decisions.
To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?
This is the primary compliance dashboard for AWS standards.
Why this answer
AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.
Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?
The ADD serves as the comprehensive record of the architecture.
Why this answer
The ADD is the main container for all architectural descriptions and documentation.
When designing a secure cloud architecture, which TWO security services are essential for identity and access management? (Select TWO)
Standard for managing permissions.
Why this answer
IAM requires robust policy enforcement and federation for secure access.
Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?
The framework for IT-business alignment.
Why this answer
COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.
When using the 'Trike' methodology for threat modeling, which of the following is the main focus?
Trike aims to balance risk between stakeholder assets and security requirements.
Why this answer
Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.
Which TWO actions should be taken when designing a highly available IAM architecture?
Ensures regional failure does not result in total outage.
Why this answer
Redundancy of the IdP (multi-region/multi-cloud) and geo-replication of the directory service are critical for high availability in IAM.
When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?
Necessary to locate the user's data.
Why this answer
Right to be forgotten requires finding and securely deleting data across potentially distributed systems.
When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?
PSM acts as a secure proxy to provide session isolation.
Why this answer
CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.
What is the primary function of an 'Identity Bridge' in a hybrid architecture?
This is the core purpose of an identity bridge or connector.
Why this answer
An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.
Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?
The core framework document for governance.
Why this answer
COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.
A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?
AppArmor uses profiles to restrict programs to a limited set of resources.
Why this answer
SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).
Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?
Enforces least privilege by limiting access to only required systems/actions.
Why this answer
Credential vaulting, session recording, and granular access delegation are core pillars of PAM.
When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?
IAP is the standard method for wrapping legacy apps in a modern ZT architecture.
Why this answer
An Identity-Aware Proxy (IAP) can act as a modern authentication frontend for legacy apps, handling the modern auth flow and passing the identity to the backend via headers or Kerberos.
In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?
FEAF is the specific framework for federal enterprise architecture.
Why this answer
FEAF (Federal Enterprise Architecture Framework) is the standard for US federal government agencies.
You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?
Trust must exist for the SP to validate the incoming assertion.
Why this answer
The SP must be configured to receive and validate the unsolicited SAML assertion sent by the IdP to the assertion consumer service (ACS) endpoint.
Which THREE components are critical to implement an effective 'Security as Code' architecture?
Automates the feedback loop.
Why this answer
Security as Code requires automation, testing, and continuous enforcement.
Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?
Prevents code injection/theft.
Why this answer
HTTPS (transport security), PKCE (binding code to request), and short-lived tokens/codes are standard security measures.
You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?
These are essential for hardening cookies against interception and XSS.
Why this answer
The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.
NSX Groups allow for dynamic membership based on tags or attributes, enabling policy application regardless of host location.
Why this answer
NSX-T uses 'Groups' based on dynamic criteria (tags, VM names, etc.) to apply DFW rules consistently across the infrastructure.
A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?
Managed services provide auditability, rotation, and lifecycle management.
Why this answer
Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.
Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?
Prevents orphaned accounts.
Why this answer
Automated provisioning, role-based access assignment, and automated de-provisioning are pillars of IAM LCM.
Which THREE components are typically included in an Enterprise Security Architecture (ESA) framework? (Select THREE)
Reference models provide reusable components.
Why this answer
ESA frameworks require governance, a design methodology, and a component reference library.
In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?
The activity of verifying alignment.
Why this answer
Compliance Monitoring is the governance activity that ensures the implemented system remains aligned with business requirements and regulatory standards.
You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?
This is the specific control for Intune compliance verification.
Why this answer
The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.
You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?
Explicit Deny statements always override Allow statements.
Why this answer
Block Public Access settings at the account level, using Bucket Policies with Deny statements, and enforcing S3 Block Public Access at the bucket level are the primary defense-in-depth measures.
Which THREE of the following are considered 'Assets' in security architecture? (Select THREE)
A critical data asset.
Why this answer
Assets include data, hardware, software, and intellectual property.
Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?
MFA is the standard defense against stolen credentials.
Why this answer
Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.
Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?
This enforces segmentation within the cluster.
Why this answer
Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.
An ISSAP architect is designing a system that must be compliant with the General Data Protection Regulation (GDPR). Which THREE technical safeguards should be implemented to ensure data confidentiality?
Protects data during transport.
Why this answer
GDPR mandates technical and organizational measures for protection, specifically confidentiality via encryption and access control.
What is the primary risk of 'Standing Privileges'?
This is the core risk of persistent access.
Why this answer
Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.
When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?
The failover link specifically synchronizes firewall connection state tables.
Why this answer
The Cisco Failover Link is used to synchronize the state table, session information, and configuration between the active and standby units.
An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?
Provides granular network control.
Why this answer
Virtual Network service endpoints or Azure Private Link allow for restricted network access, preventing data exfiltration to the public internet.
Which type of diagram is used to represent the different zones in an architecture?
This clearly shows zones of differing security requirements.
Why this answer
A trust boundary diagram or network architecture diagram is used to illustrate security zones.
A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?
This enforces mTLS for all services within the mesh automatically.
Why this answer
A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.
You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?
Vulnerability protection profiles include signature-based matching to detect and block exploits such as SQL injection.
Why this answer
Vulnerability protection profiles allow for specific signatures to be applied to block SQL injection attempts at the application layer.
An ISSAP architect is configuring Azure AD (Entra ID) Conditional Access policies to enforce Zero Trust. The requirement is to ensure that users accessing sensitive applications are verified as compliant with Intune device status. Which assignment condition is required?
This condition forces the user to have a device that has successfully passed Intune compliance policies.
Why this answer
The 'Require device to be marked as compliant' grant control is the specific mechanism in Entra ID to bridge device compliance state from Intune to access decisions.
Which THREE elements are essential to define a trust boundary? (Select THREE)
Transitioning between privilege levels requires a boundary.
Why this answer
A trust boundary is defined by the transition between levels of access, authentication, or network zones.
An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?
This explicitly prevents bucket creation in unauthorized regions.
Why this answer
Using 's3:RequestedRegion' in an SCP allows for the restriction of bucket creation to specific geographic regions, which is a common requirement for data sovereignty.
What is the purpose of 'JWT Validation' on a resource server?
This is the essential gatekeeping step for RS.
Why this answer
Validation ensures that the JWT is authentic (signature check), has not expired (exp claim), and was issued by a trusted entity (iss claim) before granting access.
You are designing an OIDC implementation. An application needs to obtain user profile information without including it in the ID Token to keep the token size small. Which endpoint should the application call?
The UserInfo endpoint returns claims based on the provided Access Token.
Why this answer
The UserInfo endpoint is the OIDC standard for fetching claims about the authenticated user using an Access Token.
When designing a secure API, which protocol is recommended for authorization?
OAuth 2.0 is designed specifically for API authorization delegation.
Why this answer
OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.
AES-GCM is a modern, authenticated encryption standard.
Why this answer
AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.
An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?
SCPs are the preventative mechanism within Control Tower to restrict actions across member accounts.
Why this answer
AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.
Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)
Tracks if the decision is proposed or accepted.
Why this answer
ADRs need to document the decision, the context, and the consequences of the decision.
An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?
This enables the specific control mapping and monitoring.
Why this answer
Defender for Cloud provides integrated regulatory compliance dashboards for NIST 800-53, requiring specific setup steps.
Which THREE types of claims are typically included in a JSON Web Token (JWT)?
Claims defined by the application.
Why this answer
Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.
Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?
Essential for oversight and compliance.
Why this answer
Architects must ensure their CSP selection supports the organization's specific compliance and security needs.
You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?
This specifically addresses cloud security architecture and guidelines.
Why this answer
NIST SP 800-144 is the standard reference for cloud computing security and architecture guidelines.
You need to protect a legacy web application that cannot be patched. What is the best strategy?
Virtual patching through a WAF is the standard defense for unpatchable legacy apps.
Why this answer
Placing a Web Application Firewall (WAF) or an RASP solution in front of the application can filter malicious traffic before it reaches the vulnerable application.
A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?
Enforces network perimeters and data isolation.
Why this answer
VPC Service Controls provides a security perimeter that prevents data exfiltration and enforces strict network boundary compliance in GCP.
You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?
Remote attestation is the mechanism to verify code integrity in a TEE.
Why this answer
Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.
An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?
This acts as an admission controller to block non-compliant deployments.
Why this answer
Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.
An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?
This provides early, consistent, and scalable security validation.
Why this answer
Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.
Which security principle is enforced when you restrict an application's ability to modify system files?
Restricting access to only necessary files is least privilege.
Why this answer
Least privilege ensures that the application has only the permissions required for its function, preventing system-wide modifications.
Which THREE of the following are critical for a secure identity architecture?
Standard for securing identities.
Why this answer
Multi-factor authentication, least privilege, and robust auditing are required for identity security.
Which THREE of the following are valid security controls for a database?
Essential for monitoring and accountability.
Why this answer
Encryption, auditing, and access control are fundamental database security controls.
In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?
SABSA maps business requirements (attributes) to security services.
Why this answer
The business attributes (what the business needs) drive the requirement for specific security services.
When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?
This pattern prevents cascading failures in distributed systems.
Why this answer
The Circuit Breaker pattern prevents an application from repeatedly trying to execute an operation that is likely to fail.
Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?
SCIM is the standard for identity provisioning.
Why this answer
SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.
You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?
A NAT Gateway is specifically designed to allow private instances to initiate outbound traffic while blocking inbound requests.
Strong encryption is required to protect the confidentiality of the transit traffic.
Why this answer
A secure design requires robust authentication (MFA), transport security (encryption), and granular authorization (least privilege).
Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?
This focuses on the threat actors and their goals.
Why this answer
Attacker-centric threat modeling starts with the adversary and their specific objectives.
Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)
Silos prevent consistent security architecture implementation.
Why this answer
Managing organizational silos and maintaining alignment with changing business needs are top challenges.
What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?
Governance is the primary function.
Why this answer
The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.
When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?
The DMZ is the classic architectural pattern for isolating public-facing services.
Why this answer
The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.
In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?
The SP uses the IdP public key to verify the digital signature on the SAML assertion.
Why this answer
For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.
When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?
Centralized PDP ensures uniform enforcement.
Why this answer
The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.
Practice ISC by domain
Target a specific domain to shore up weak areas.