View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 81.

A security architect is evaluating a new remote-access solution for privileged administrators. Which requirement should be prioritized MOST?

1. Strong authentication, restricted access paths, and detailed auditing
   2. Anonymous access during maintenance
   3. Shared administrator credentials
   4. Unrestricted access from any endpoint

Correct Answer: 1. Strong authentication, restricted access paths, and detailed auditing

Explanation:

Privileged remote access creates significant risk because compromise can lead directly to critical systems. The architecture should therefore use strong authentication, tightly controlled network paths, trusted administrative endpoints, least privilege, and protected logging. Shared credentials weaken accountability, while unrestricted or anonymous access increases attack surface. A well-designed privileged-access solution should make administrative activity both difficult to misuse and easy to trace.

Question 82.

A company wants to ensure that a single compromised application account cannot access every database in the environment. Which approach is BEST?

1. Use one shared database account
   2. Use separate service identities with narrowly scoped permissions
   3. Grant all application accounts database-administrator privileges
   4. Disable database authentication

Correct Answer: 2. Use separate service identities with narrowly scoped permissions

Explanation:

Separate application identities allow access to be limited to the specific databases, schemas, or functions each application needs. If one account is compromised, the attacker’s reach is constrained. This applies least privilege and reduces the blast radius of credential theft. Shared or broadly privileged accounts increase risk and make accountability more difficult.

Question 83.

Which architecture activity BEST identifies where encryption, authentication, and validation controls should be placed?

1. Asset depreciation analysis
   2. User-interface testing
   3. Trust-boundary and data-flow analysis
   4. Capacity planning

Correct Answer: 3. Trust-boundary and data-flow analysis

Explanation:

Trust-boundary and data-flow analysis shows where information moves between users, systems, networks, applications, and external parties that have different trust assumptions. These transitions are natural locations for controls such as authentication, authorization, input validation, encryption, and monitoring. Understanding the flow of sensitive information is therefore fundamental to deciding where security controls should be enforced.

Question 84.

A critical service must remain available if an entire availability zone fails. Which design BEST supports this objective?

1. Deploy all instances in one zone
   2. Store backups on the same server
   3. Increase the CPU capacity of one host
   4. Distribute redundant service components across independent zones**

Correct Answer: 4. Distribute redundant service components across independent zones

Explanation:

Placing redundant components across independent availability zones reduces the chance that a localized infrastructure failure will disable the entire service. The architecture should also consider load balancing, data replication, network independence, and tested failover. Increasing the capacity of a single host does not protect against zone-wide failure. Resilience should address the failure domain defined by the business continuity requirement.

Question 85.

Which principle should guide the amount of information collected by a system when only a subset is needed for business processing?

1. Data minimization
   2. Maximum privilege
   3. Default allow
   4. Open access

Correct Answer: 1. Data minimization

Explanation:

Data minimization means collecting and retaining only the information necessary for the defined business purpose. Reducing unnecessary data lowers privacy exposure, compliance burden, and potential breach impact. Sensitive information should not be collected merely because it may be useful someday. The architecture should align data collection with legitimate functional requirements and retention obligations.

Question 86.

An organization is implementing a hardware security module for cryptographic-key protection. What is the MOST important architectural concern for availability?

1. The HSM’s physical color
   2. Avoiding a single point of failure while preserving key security
   3. Using the same key for all applications
   4. Disabling audit logging

Correct Answer: 2. Avoiding a single point of failure while preserving key security

Explanation:

A hardware security module may become critical infrastructure if authentication, encryption, or signing services depend on it. Redundant HSM capability, secure key synchronization or backup, and tested failover can improve availability. However, resilience must not weaken key protection. The architecture should balance confidentiality and integrity of key material with the need to survive device or site failures.

Question 87.

A proposed application uses a single privileged service account for multiple unrelated functions. What is the PRIMARY concern?

1. The account name may be too long
   2. The service may generate additional logs
   3. Excessive privilege increases the impact of account compromise
   4. The application may require more storage

Correct Answer: 3. Excessive privilege increases the impact of account compromise

Explanation:

A broadly privileged service account creates a large blast radius. If it is compromised, an attacker may gain access to multiple systems or functions unrelated to the original application need. Separating identities and granting only required permissions improves least privilege, accountability, and containment. The architecture should avoid concentrating unnecessary power in one credential.

Question 88.

A security control fails and the system cannot determine whether a user is authorized. Which response is MOST appropriate for a highly confidential resource?

1. Allow access until the control recovers
   2. Grant temporary administrator access
   3. Ignore authorization for read operations
   4. Deny access until authorization can be verified**

Correct Answer: 4. Deny access until authorization can be verified

Explanation:

For a highly confidential resource, failure of the authorization mechanism should normally result in a protected state. Denying access prevents the failure from becoming an unintended authorization bypass. This reflects fail-secure behavior and fail-safe defaults. Availability requirements still matter, but the security response should align with the priority of confidentiality and the organization’s risk tolerance.

Question 89.

What is the MAIN security advantage of isolating management interfaces from general user networks?

1. It reduces attack surface and limits access to privileged control paths
   2. It eliminates the need for authentication
   3. It guarantees administrators cannot make errors
   4. It removes the need for monitoring

Correct Answer: 1. It reduces attack surface and limits access to privileged control paths

Explanation:

Management interfaces provide powerful capabilities and should not be broadly reachable from ordinary user networks. Segmentation, jump hosts, dedicated administrative networks, and strong authentication reduce exposure and make privileged access easier to control. This isolation does not replace authentication or monitoring, but it provides an important additional layer of protection.

Question 90.

A security architect is comparing two designs that provide equivalent functionality. Which choice is generally preferable when both satisfy security requirements?

1. The design with the greatest number of components
   2. The simpler design with fewer unnecessary dependencies
   3. The design that is harder to document
   4. The design with the most vendors

Correct Answer: 2. The simpler design with fewer unnecessary dependencies

Explanation:

Unnecessary complexity can introduce hidden dependencies, configuration errors, maintenance problems, and additional attack surface. When two solutions meet the same business and security requirements, a simpler design is often easier to understand, validate, operate, and secure. Complexity should be justified by a specific requirement rather than treated as inherently beneficial.

Question 91.

A security architect wants to protect a public API from excessive automated requests. Which control is MOST appropriate?

1. Disable authentication
   2. Allow unlimited requests from all clients
   3. Apply rate limiting and appropriate request controls
   4. Remove audit logging

Correct Answer: 3. Apply rate limiting and appropriate request controls

Explanation:

Rate limiting can reduce abuse, denial-of-service pressure, credential attacks, and excessive resource consumption by controlling how frequently clients may make requests. It should be combined with authentication, authorization, input validation, monitoring, and capacity protections. Removing authentication or allowing unlimited requests would increase rather than reduce the API’s exposure.

Question 92.

An organization outsources processing of sensitive data to a third party. Which architectural governance practice is MOST important?

1. Trust the provider without verification
   2. Avoid documenting security responsibilities
   3. Permit unrestricted provider access
   4. Establish contractual security requirements, assurance mechanisms, and responsibility boundaries**

Correct Answer: 4. Establish contractual security requirements, assurance mechanisms, and responsibility boundaries

Explanation:

Third-party processing creates shared security responsibilities that should be explicitly defined. Contracts and governance should address access, data handling, incident notification, privacy, audit rights, retention, destruction, and other applicable controls. Ongoing assurance helps confirm that the provider continues to meet requirements. Reliance on assumptions or informal agreements creates avoidable security gaps.

Question 93.

Why should threat modeling be performed early in the system-development lifecycle?

1. It allows architectural weaknesses and likely attack paths to be addressed before implementation becomes expensive to change
   2. It guarantees that no vulnerabilities will remain
   3. It eliminates the need for penetration testing
   4. It replaces risk management

Correct Answer: 1. It allows architectural weaknesses and likely attack paths to be addressed before implementation becomes expensive to change

Explanation:

Threat modeling helps identify assets, trust boundaries, likely attackers, abuse cases, and attack paths while the architecture is still flexible. Fixing design flaws early is generally less expensive than correcting them after deployment. Threat modeling complements rather than replaces later testing and ongoing risk management. It provides a structured way to build security into the design from the beginning.

Question 94.

A business requires a system to be restored within one hour after disruption while tolerating up to five minutes of data loss. Which statement is correct?

1. RTO is five minutes and RPO is one hour
   2. RTO is one hour and RPO is five minutes
   3. Both RTO and RPO are one hour
   4. Both RTO and RPO are five minutes

Correct Answer: 2. RTO is one hour and RPO is five minutes

Explanation:

The recovery time objective defines how quickly the service must be restored after a disruption, so the RTO is one hour. The recovery point objective defines the maximum acceptable amount of data loss, expressed as time, so the RPO is five minutes. These values guide architecture decisions related to replication, backups, standby environments, and recovery processes.

Question 95.

Which design BEST limits lateral movement after compromise of an internet-facing web server?

1. Put all systems in the same subnet
   2. Allow unrestricted east-west traffic
   3. Segment application tiers and permit only explicitly required communications
   4. Disable authentication between tiers

Correct Answer: 3. Segment application tiers and permit only explicitly required communications

Explanation:

Segmentation limits the ability of a compromised web server to reach application, database, administrative, or unrelated systems. Explicitly permitting only required traffic reduces potential attack paths and applies a default-deny philosophy. Authentication and authorization between components should remain in place as additional security layers. Flat networks increase the blast radius of compromise.

Question 96.

A security architect discovers that application encryption keys are embedded directly in source code. What is the BEST corrective action?

1. Keep the keys in source code but rename the variables
   2. Add comments warning developers not to copy them
   3. Use longer source-code files
   4. Move keys to an approved secure key-management mechanism**

Correct Answer: 4. Move keys to an approved secure key-management mechanism

Explanation:

Embedding cryptographic keys in source code makes them difficult to rotate and exposes them to developers, repositories, build systems, and anyone who gains code access. Keys should be generated, stored, accessed, rotated, and revoked through an approved key-management solution. Separating key material from application code reduces exposure and supports stronger lifecycle management.

Question 97.

What is the PRIMARY benefit of defining security architecture principles at the enterprise level?

1. They provide consistent guidance for security decisions across projects
   2. They eliminate the need for risk analysis
   3. They force every application to use identical technology
   4. They replace security policies entirely

Correct Answer: 1. They provide consistent guidance for security decisions across projects

Explanation:

Enterprise architecture principles establish common expectations for areas such as least privilege, segmentation, encryption, resilience, and secure administration. They help teams make consistent decisions and reduce repeated design errors. Principles should still be applied in a risk-based manner and do not remove the need for policies, standards, or project-specific analysis.

Question 98.

A system design requires one person to request a sensitive transaction and another person to approve it. Which security concept is MOST directly applied?

1. Fail open
   2. Separation of duties
   3. Data compression
   4. Network redundancy

Correct Answer: 2. Separation of duties

Explanation:

Separation of duties divides critical responsibilities so that a single individual cannot independently complete a sensitive process. Requiring one person to initiate a transaction and another to approve it reduces the risk of fraud, error, and abuse. This concept is closely related to dual control, particularly when multiple individuals must participate in a high-impact action.

Question 99.

An enterprise security architecture includes many legacy systems that cannot support modern authentication. What should the architect do FIRST?

1. Ignore the systems because they are old
   2. Expose them directly to the internet
   3. Assess the risk and design compensating controls around the legacy limitations
   4. Disable all monitoring

Correct Answer: 3. Assess the risk and design compensating controls around the legacy limitations

Explanation:

Legacy constraints do not remove the underlying security requirement. The architect should assess the risk created by weak authentication and determine whether compensating controls such as network isolation, controlled access gateways, stronger upstream authentication, monitoring, or reduced privileges can lower risk to an acceptable level. Replacement may be a long-term objective, but interim protection should be based on documented risk.

Question 100.

Which practice BEST demonstrates mature enterprise security architecture management?

1. Approve architectures once and never revisit them
   2. Allow undocumented exceptions whenever projects request them
   3. Review security only after breaches
   4. Maintain standards, assess designs, track exceptions and risks, and periodically reassess architecture effectiveness**

Correct Answer: 4. Maintain standards, assess designs, track exceptions and risks, and periodically reassess architecture effectiveness

Explanation:

Mature architecture management is continuous. Standards and principles provide direction, design reviews identify weaknesses, exception processes document justified deviations, and risk tracking creates accountability. Periodic reassessment is necessary because technologies, threats, regulations, and business requirements change over time. Treating architecture as a one-time approval process allows controls and assumptions to become outdated.