View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 61.

A security architect is reviewing a system that processes highly sensitive information. Which design decision BEST reduces the risk of unauthorized data disclosure between application components?

1. Increase server processing capacity
   2. Apply strong authentication, authorization, and encrypted communications between trust zones
   3. Use identical passwords across components
   4. Place all components in one unrestricted network segment

Correct Answer: 2. Apply strong authentication, authorization, and encrypted communications between trust zones

Explanation:

Sensitive information should be protected whenever it crosses trust boundaries. Strong authentication verifies communicating parties, authorization restricts permitted actions, and encryption protects data from interception. Segmentation can provide another layer of protection. Increasing processing capacity does not address confidentiality, while shared passwords and unrestricted network placement weaken the architecture. Security controls should be aligned with the sensitivity of the information and the risks associated with component-to-component communication.

Question 62.

Which architectural principle BEST reduces the likelihood that an implementation error in one security mechanism results in complete compromise?

1. Defense in depth
   2. Shared administration
   3. Default allow
   4. Single-point authentication

Correct Answer: 1. Defense in depth

Explanation:

Defense in depth combines multiple complementary safeguards so that the failure of one control does not leave the system entirely exposed. Network segmentation, application authorization, endpoint controls, encryption, monitoring, and identity security can provide independent layers. The principle assumes that individual controls may fail or be bypassed. Shared administration, default-allow policies, and reliance on a single security mechanism increase rather than reduce exposure.

Question 63.

A business plans to expose an application programming interface to external partners. What should the security architect identify FIRST?

1. The preferred programming language
   2. The partner’s office locations
   3. Trust boundaries, authentication requirements, data sensitivity, and permitted API actions
   4. The color scheme of the developer portal

Correct Answer: 3. Trust boundaries, authentication requirements, data sensitivity, and permitted API actions

Explanation:

An external API crosses organizational and technical trust boundaries. Before selecting controls, the architect should determine who may access the API, what data it exposes, which operations are permitted, and the consequences of misuse. These requirements guide authentication, authorization, encryption, rate limiting, logging, validation, and other safeguards. Technology choices should follow the risk analysis rather than precede it.

Question 64.

A company requires its authentication platform to continue functioning if an entire server fails. Which architecture BEST meets this requirement?

1. One highly powerful authentication server
   2. A single server with a larger storage device
   3. Manual authentication during outages
   4. Redundant authentication nodes with tested failover**

Correct Answer: 4. Redundant authentication nodes with tested failover

Explanation:

A single authentication server creates a single point of failure. Redundant nodes can continue providing service if one component fails, but failover should be tested rather than assumed to work. Depending on business requirements, redundancy may also include independent network paths, power sources, or geographic locations. Increasing the capacity of one server does not provide comparable resilience against server failure.

Question 65.

An application currently grants users broad permissions and relies on them not to access data they do not need. Which security principle should be applied?

1. Least privilege
   2. Open design
   3. Fail open
   4. Maximum availability

Correct Answer: 1. Least privilege

Explanation:

Least privilege requires users and processes to receive only the permissions necessary for their authorized functions. Broad permissions increase the consequences of account compromise, mistakes, and insider misuse. Access should be based on defined business roles or other appropriate authorization rules and reviewed periodically. The principle reduces unnecessary exposure while preserving legitimate access needed for business operations.

Question 66.

A security architect is evaluating a cloud-hosted application. Which issue is MOST important when assigning responsibility for operating-system patching?

1. The number of cloud regions
   2. The service model and shared-responsibility agreement
   3. The cloud provider’s advertising strategy
   4. The application’s user-interface framework

Correct Answer: 2. The service model and shared-responsibility agreement

Explanation:

Responsibility for operating-system patching varies significantly among infrastructure, platform, and software service models. In some services, the customer manages the operating system; in others, the provider does. The architect must understand the shared-responsibility model and contractual commitments before assigning control ownership. Assuming responsibility without verifying the service model can create serious security gaps.

Question 67.

Which architectural mechanism BEST supports accountability for privileged changes to critical systems?

1. Shared administrator accounts
   2. Anonymous management access
   3. Unique privileged identities with protected audit logging
   4. Disabled change records

Correct Answer: 3. Unique privileged identities with protected audit logging

Explanation:

Unique privileged identities make it possible to associate administrative activity with specific individuals. Protected audit logs provide independent evidence of what was changed and when. Together, these controls support accountability, investigations, and governance. Shared accounts reduce traceability, while anonymous access and disabled logging make it difficult to determine who performed a sensitive action.

Question 68.

A highly sensitive system cannot reliably verify a user’s authorization because its policy service is unavailable. What should the system normally do if confidentiality is the highest priority?

1. Permit access temporarily
   2. Grant read-only access to everyone
   3. Ignore authorization until the service returns
   4. Deny access until authorization can be verified**

Correct Answer: 4. Deny access until authorization can be verified

Explanation:

When confidentiality is the dominant requirement, failure of an authorization mechanism should generally place the system in a protected state. Denying access prevents a security-control failure from becoming an unintended authorization bypass. Architects must balance this against availability requirements, but granting access without reliable authorization would create significant confidentiality risk. This behavior reflects fail-secure and fail-safe default principles.

Question 69.

What is the MOST important reason to separate production administrative traffic from ordinary user traffic?

1. It reduces exposure of sensitive management interfaces and privileged communications
   2. It guarantees administrators cannot make mistakes
   3. It eliminates the need for authentication
   4. It makes backups unnecessary

Correct Answer: 1. It reduces exposure of sensitive management interfaces and privileged communications

Explanation:

Administrative traffic often provides powerful capabilities and should be protected from ordinary user networks where possible. Dedicated management networks, controlled jump systems, segmentation, and strong authentication reduce the chance that a compromised user workstation can directly attack production management interfaces. Separation does not eliminate human error or the need for other controls, but it substantially reduces attack surface.

Question 70.

An architect must choose between two designs that satisfy the same functional requirements. Which factor should MOST influence the security decision?

1. Which design has the newer logo
   2. Comparative risk, control effectiveness, operational impact, and business requirements
   3. Which design uses more technologies
   4. Which design is more complicated

Correct Answer: 2. Comparative risk, control effectiveness, operational impact, and business requirements

Explanation:

Architecture decisions should be risk-based. The architect should compare how effectively each design addresses threats, supports business objectives, meets compliance obligations, and affects operations, cost, resilience, and maintainability. Complexity alone is not necessarily beneficial and can itself introduce risk. A defensible security decision should be traceable to requirements and risk rather than product novelty or appearance.

Question 71.

An organization wants to reduce the risk that a compromised application account can access data belonging to unrelated applications. Which control BEST supports this goal?

1. Use one shared database account for all applications
   2. Grant administrator privileges to every service account
   3. Use separate application identities with narrowly scoped permissions
   4. Disable database auditing

Correct Answer: 3. Use separate application identities with narrowly scoped permissions

Explanation:

Separate service identities allow permissions to be restricted according to each application’s actual requirements. If one account is compromised, the attacker is less likely to inherit access to unrelated data or administrative functions. Sharing powerful accounts expands the blast radius of compromise and weakens accountability. This design applies least privilege and separation principles at the application level.

Question 72.

A critical application must survive the failure of a complete geographic region. Which architecture provides the STRONGEST resilience?

1. Two servers in the same rack
   2. Multiple virtual machines in one data center
   3. Daily backups stored in the primary site
   4. Redundant processing and data capability across independent geographic regions**

Correct Answer: 4. Redundant processing and data capability across independent geographic regions

Explanation:

Regional resilience requires the service to avoid dependence on infrastructure located in a single geographic area. Redundant processing, replicated data, independent network connectivity, and tested failover across regions can protect against large-scale outages. Redundancy within one rack or data center addresses smaller failures but may not survive a regional disruption. The architecture should also be designed to meet defined RTO and RPO requirements.

Question 73.

A security architect is designing an application that should collect only the personal information required to provide the service. Which principle is being applied?

1. Data minimization
   2. Maximum privilege
   3. Fail open
   4. Single point of control

Correct Answer: 1. Data minimization

Explanation:

Data minimization limits collection, processing, and retention to information that is genuinely needed for a legitimate business purpose. Reducing unnecessary personal information lowers privacy exposure and can reduce the impact of a data breach. It may also simplify compliance obligations. The architect should evaluate whether every requested data element is necessary rather than collecting information simply because it may be useful later.

Question 74.

A company wants to ensure that encrypted backups remain protected even if the backup media are stolen. What is MOST important?

1. Store the encryption key on the same unprotected media
   2. Protect encryption keys separately through strong key-management controls
   3. Disable backup verification
   4. Use shorter passwords for recovery accounts

Correct Answer: 2. Protect encryption keys separately through strong key-management controls

Explanation:

Encryption provides little protection if the attacker obtains the decryption key along with the encrypted media. Backup keys should therefore be securely generated, stored, controlled, rotated, and recovered through an appropriate key-management process. Key access should be limited and auditable. Separating key protection from the media helps preserve confidentiality even if the physical backup is lost or stolen.

Question 75.

Which activity is MOST useful for identifying possible attack paths before a new system is implemented?

1. Capacity planning
   2. User-interface testing
   3. Threat modeling
   4. Asset depreciation analysis

Correct Answer: 3. Threat modeling

Explanation:

Threat modeling evaluates assets, trust boundaries, attackers, potential attack paths, and security weaknesses while a system is still being designed. This enables architects to address risks before implementation decisions become expensive to change. Threat modeling complements vulnerability assessment and penetration testing performed later. It does not guarantee that every weakness will be identified, but it substantially improves design-time security analysis.

Question 76.

A security architecture depends on one hardware security module for all cryptographic operations. What is the PRIMARY architectural concern?

1. It may generate too many audit logs
   2. It may use strong encryption
   3. It may require trained administrators
   4. It represents a potential single point of failure**

Correct Answer: 4. It represents a potential single point of failure

Explanation:

If all cryptographic operations depend on one hardware security module, failure of that device could interrupt authentication, encryption, signing, or other critical functions. High-availability architectures may require redundant HSM capability, appropriate key synchronization or backup mechanisms, and tested failover. The resilience design must also preserve the security properties of the keys rather than weakening protection for availability.

Question 77.

Why should security architects prefer simple designs when two solutions provide equivalent security and business capability?

1. Simpler designs are often easier to understand, validate, maintain, and secure correctly
   2. Simple systems never contain vulnerabilities
   3. Complex designs cannot provide strong security
   4. Simplicity eliminates the need for monitoring

Correct Answer: 1. Simpler designs are often easier to understand, validate, maintain, and secure correctly

Explanation:

Unnecessary complexity can create hidden dependencies, configuration errors, inconsistent control behavior, and maintenance difficulties. When two designs meet the same requirements, the simpler architecture often reduces the number of potential failure points and makes security assumptions easier to review. Simplicity does not guarantee security, and some business requirements legitimately demand complex solutions, but complexity should be justified rather than added without benefit.

Question 78.

An organization uses a third party to process confidential customer data. Which architectural governance action is MOST important?

1. Assume the provider’s controls are sufficient
   2. Define security, privacy, incident, audit, and data-handling requirements in enforceable agreements
   3. Allow the provider unrestricted access to all internal systems
   4. Avoid monitoring the provider after onboarding

Correct Answer: 2. Define security, privacy, incident, audit, and data-handling requirements in enforceable agreements

Explanation:

Third-party processing introduces risks that must be addressed contractually and operationally. Agreements should define required security controls, permitted data use, access restrictions, incident notification, retention, destruction, audit rights, and responsibility boundaries. Ongoing assurance is also important because a provider’s security posture can change over time. Unwritten assumptions do not provide sufficient governance for sensitive information.

Question 79.

A company wants to prevent unauthorized software components from communicating directly with a critical database. Which architectural approach is BEST?

1. Permit all internal traffic because it is trusted
   2. Use only DNS filtering
   3. Enforce segmented network paths and allow only explicitly required application-to-database flows
   4. Disable database authentication

Correct Answer: 3. Enforce segmented network paths and allow only explicitly required application-to-database flows

Explanation:

Segmentation and explicit allow rules restrict database communication to approved application components and protocols. This limits attack paths and lateral movement if another internal system is compromised. Internal location alone should not imply trust. Database authentication should remain in place as another security layer. Combining network controls with application identity and authorization provides stronger defense in depth.

Question 80.

Which practice BEST supports an enterprise security architecture as business requirements, threats, and technologies change?

1. Freeze the architecture after initial approval
   2. Avoid documenting architecture assumptions
   3. Reassess architecture only after a major breach
   4. Continuously review risk, architecture assumptions, control effectiveness, and changing requirements**

Correct Answer: 4. Continuously review risk, architecture assumptions, control effectiveness, and changing requirements

Explanation:

Security architecture must evolve with the organization. New business models, technologies, threats, regulations, and dependencies can invalidate earlier assumptions or make existing controls insufficient. Periodic and event-driven architecture reviews help identify gaps before they become serious problems. Continuous improvement keeps the architecture aligned with current risk and business priorities rather than treating security design as a one-time activity.