208 questions total · 3pages · All types, answers revealed
Page 3 of 3
Which THREE of the following are best practices for securing a remote worker's endpoint?
Essential for detecting threats.
Why this answer
Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.
A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?
SSH CAs allow for identity-based, short-lived certificate issuance.
Why this answer
Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.
To satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?
This mitigates credential theft, a key SOC2 requirement.
Why this answer
SOC2 requires strict lifecycle management and authentication assurance for privileged accounts.
Which TWO of the following are key benefits of 'Immutable Infrastructure'?
Ensures consistent state.
Why this answer
Immutability prevents configuration drift and allows for rapid recovery.
Which TWO components are critical for an identity-centric Zero Trust architecture?
The brain that makes access decisions.
Why this answer
A central Identity Provider (IdP) and a Policy Decision Point (PDP) are the structural heart of a ZT identity architecture.
Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?
Is the device secure?
Why this answer
Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.
What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?
ATAM assesses the impact of architectural choices on system quality attributes.
Why this answer
ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.
When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?
Logs compliance without blocking.
Why this answer
The 'Audit' effect is specifically designed to log events without impacting the deployment action.
Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)
Used to map business requirements.
Why this answer
SABSA requires business requirements documentation and security service specifications.
An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?
Logs key usage and API activities.
Why this answer
CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.
You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?
This algorithm splits the master key into shares, requiring a defined threshold to reconstitute the key.
Why this answer
Vault utilizes Shamir's Secret Sharing to split the unseal key into multiple shares, requiring a quorum to unseal the vault.
When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?
SDP is a physical implementation of Zero Trust architecture.
Why this answer
SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.
You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?
App Mesh uses Envoy proxies to manage traffic, providing identity-based security rather than network-layer security.
Why this answer
AWS App Mesh provides application-level networking, allowing for service-to-service communication control using mutual TLS (mTLS) and fine-grained traffic routing independent of IP addresses.
What is the purpose of 'Claims Transformation' in an Identity Provider?
This enables interoperability between systems with different schema requirements.
Why this answer
Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).
What is the primary architectural purpose of implementing Just-in-Time (JIT) access?
This is the core security benefit of JIT.
Why this answer
JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.
Which component is the most critical to protect in a web-based architecture?
The database is the ultimate repository of sensitive information.
Why this answer
The database is typically the primary target for attackers as it contains the sensitive data.
An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?
Allows for real-time compliance polling.
Why this answer
Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.
You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?
This prevents a process from gaining more privileges than its parent process.
Why this answer
To prevent escalation, you must restrict the container's ability to run as root and prevent it from gaining additional privileges that were not granted at start-up.
When evaluating architectural threats, which THREE categories are explicitly defined in the STRIDE methodology? (Select THREE)
Part of the STRIDE acronym.
Why this answer
STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.
Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?
Tenants represent the highest level of logical separation in the ACI fabric for security and administration.
Why this answer
In Cisco ACI, the EPG, Contract, and Tenant are the fundamental building blocks for security policy definition and isolation.
An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?
This is the specific feature for secret detection.
Why this answer
GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.
In the context of TOGAF, what is the 'Architecture Repository' used for?
The repository stores reusable standards and models.
Why this answer
The repository acts as a central library for all architectural work products, models, and design patterns.
In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)
Security solutions are evaluated here.
Why this answer
Phase A (Vision) and Phase E (Opportunities and Solutions) are where security requirements are integrated and evaluated.
You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?
DPoP adds cryptographic binding between the token and the sender.
Why this answer
DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.
In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?
The motivation column addresses the business drivers and goals.
Why this answer
The 'Why' column in the Zachman Framework is the 'Motivation' column, which focuses on business goals and security drivers.
You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?
Using default accounts leads to privilege escalation risks and visibility issues.
Why this answer
The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.
Which TWO of the following are common methods to protect data during transit?
Standard for secure network-to-network traffic.
What is the function of 'Token Introspection' in OAuth 2.0?
This provides a mechanism to check if a token is still valid.
Why this answer
Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.
To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?
These are specific defenses against side-channel analysis.
Why this answer
Constant Time (CT) instructions and hardware-based mitigations like Intel SGX or isolation features prevent information leakage through timing side-channels.
When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?
This is the definition of the Vault Database secrets engine operation.
Why this answer
The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.
Which THREE factors influence the choice of a security architecture framework? (Select THREE)
The framework must match the organization's ability to implement it.
Why this answer
Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.
Which TWO of the following are essential for a secure Cloud CI/CD pipeline?
This finds vulnerabilities early.
Why this answer
Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.
When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)
Lack of mutual authentication between services is a major risk.
Why this answer
Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.
What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?
STS is the foundation of identity federation.
Why this answer
An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.
A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?
This service includes the agent-based FIM and vulnerability assessment capabilities required.
Why this answer
Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.
Which TWO of the following are fundamental pillars of information security (CIA triad)?
One of the three pillars.
Why this answer
The CIA triad consists of Confidentiality, Integrity, and Availability.
A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?
This is the secure standard for multi-tier application architecture.
Why this answer
Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.
Which TWO of the following are best practices for securing API endpoints?
Industry-standard authentication.
Why this answer
Rate limiting and strong authentication are foundational API security practices.
You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?
JWE is the standard for encrypting JWTs to protect sensitive claims.
Why this answer
PII should be encrypted within tokens (e.g., using JWE - JSON Web Encryption) or minimized in the token payload to meet privacy regulations.
Which component of an architecture document defines the communication standards between services?
This defines the contracts and communication protocols.
Why this answer
The Interface Specification or API design document defines how services communicate.
A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?
Conditional Access policies evaluate signals, including device compliance, to permit or deny access.
Why this answer
Microsoft Entra ID (formerly Azure AD) Conditional Access policies are used to evaluate device compliance status before granting access to M365 resources.
What is the primary purpose of a TPM chip in a laptop?
TPM is a hardware root of trust for identity and boot integrity.
Why this answer
The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.
You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?
The Architecture Vision phase is where the scope is defined and stakeholders are identified.
Why this answer
The Preliminary Phase and Phase A are critical for scoping, but the Architecture Vision phase specifically mandates stakeholder identification and scope definition.
What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?
EDR provides behavioral analysis and response capabilities.
Why this answer
EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.
When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?
Provides rule-based enforcement for tags.
Why this answer
AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.
When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?
This enforces separation of duties and oversight for code changes.
Why this answer
Separation of duties via multi-party approval in the pipeline prevents a single compromised account from pushing code to production.
What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?
The core purpose of a gap analysis.
Why this answer
A gap analysis identifies where the current architecture deviates from the target compliance framework.
Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)
This is the primary goal of architecture threat modeling.
Why this answer
Threat modeling identifies design flaws and helps prioritize security investments.
When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?
The audience claim confirms the token was intended for this specific SP.
Why this answer
Validating the token signature and checking the audience claim are the two most critical steps to prevent token spoofing or replay attacks.
Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?
Standardizes the elevation process.
Why this answer
A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.
You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?
The broker facilitates the handshake between the user session and the app connector.
Why this answer
The Zscaler App Connector initiates an outbound-only connection to the Zscaler cloud, where the ZPA broker connects the user to the application without exposing the application to the internet.
Which of the following is the most effective way to secure a remote access connection for employees?
This is the industry standard for secure remote access.
You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?
The 'nonce' claim provides a unique link between the OIDC authentication request and the resulting token.
Why this answer
The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.
Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?
This tool automates DFD creation and STRIDE threat generation.
Why this answer
Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.
A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?
GWLB is the standard architectural pattern for centralized inspection in AWS.
Why this answer
Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.
What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?
The primary role is communication and alignment.
Why this answer
A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.
In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?
A mismatch in the unique identifier mapping often results in the SP rejecting the session due to unknown identity.
Why this answer
If the signature is valid but access is denied, the NameID or attributes in the assertion often do not match the expected user mapping or authorization requirements at the SP.
An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?
SCPs provide a preventative guardrail that cannot be bypassed by IAM users.
Why this answer
Service Control Policies (SCPs) applied at the OU level can explicitly deny the 's3:PutBucketPolicy' action if the bucket is public, overriding any IAM user permissions.
Page 3 of 3
Practice ISC by domain
Target a specific domain to shore up weak areas.