View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 101.

A security architect is evaluating whether a new application should use centralized or decentralized authorization. What should drive the decision MOST?

1. The application’s font choices
   2. Business requirements, trust boundaries, scale, and consistency needs
   3. Developer preference alone
   4. The number of office locations

Correct Answer: 2. Business requirements, trust boundaries, scale, and consistency needs

Explanation:

Authorization architecture should reflect the system’s business requirements, trust model, operational scale, and need for consistent policy enforcement. Centralized authorization can simplify governance and policy consistency, while decentralized enforcement may provide flexibility or resilience in some designs. The architect should evaluate tradeoffs such as latency, availability, policy synchronization, and administrative complexity. The decision should be risk-based rather than driven by cosmetic or personal preferences.

Question 102.

Which security architecture principle MOST directly supports denying access when no explicit permission exists?

1. Fail-safe defaults
   2. Open design
   3. Separation of duties
   4. Economy of mechanism

Correct Answer: 1. Fail-safe defaults

Explanation:

Fail-safe defaults mean access should be denied unless it is explicitly permitted. This reduces the chance that missing or incomplete rules create unintended access. The principle is widely applied in firewalls, authorization systems, and network controls through default-deny policies. Open design concerns avoiding dependence on secrecy, separation of duties distributes sensitive responsibilities, and economy of mechanism favors simpler designs.

Question 103.

A security architect discovers that multiple applications share the same highly privileged service account. What is the BEST redesign?

1. Increase the shared account’s privileges
   2. Disable logging for the account
   3. Assign separate application identities with least-privilege permissions
   4. Publish the password to all developers

Correct Answer: 3. Assign separate application identities with least-privilege permissions

Explanation:

Separate application identities improve containment, accountability, and least privilege. If one application is compromised, its service identity should not automatically provide access to unrelated systems or data. Individual identities also make it easier to audit usage and revoke access selectively. A shared privileged account increases the blast radius of compromise and complicates investigations because actions cannot be attributed cleanly.

Question 104.

A highly available application depends on a single DNS service with no redundancy. What is the PRIMARY architectural concern?

1. DNS may use too much bandwidth
   2. DNS names may be difficult to remember
   3. Users may prefer IP addresses
   4. DNS represents a single point of failure**

Correct Answer: 4. DNS represents a single point of failure

Explanation:

A highly available application can still fail if it relies on an unredundant supporting service. If the only DNS service becomes unavailable, users and application components may be unable to resolve required names even though the application servers remain healthy. Security and resilience architecture should identify critical dependencies and eliminate unnecessary single points of failure through appropriate redundancy and tested recovery mechanisms.

Question 105.

Which activity BEST helps a security architect understand where sensitive information enters, moves through, and leaves a system?

1. Data-flow analysis
   2. Hardware inventory counting
   3. Employee performance review
   4. Software licensing audit

Correct Answer: 1. Data-flow analysis

Explanation:

Data-flow analysis identifies how information moves among users, processes, applications, databases, external services, and networks. It helps architects locate trust boundaries and determine where encryption, validation, access control, logging, and other protections are needed. This is particularly important for sensitive or regulated information because security requirements may change as data crosses systems or organizational boundaries.

Question 106.

A business requires a critical application to continue operating even when one authentication server fails. Which approach is MOST appropriate?

1. Use one authentication server with more memory
   2. Deploy redundant authentication services and test failover
   3. Disable authentication during failures
   4. Allow anonymous access temporarily

Correct Answer: 2. Deploy redundant authentication services and test failover

Explanation:

Authentication can become a critical availability dependency. Redundant authentication services reduce the risk that failure of a single server prevents legitimate access. Failover should be tested so the organization knows that secondary components function correctly during disruption. Disabling authentication or permitting anonymous access would sacrifice security for availability and could create unacceptable risk.

Question 107.

A company is evaluating a SaaS provider that will process regulated information. Which issue should the security architect evaluate MOST carefully?

1. The provider’s office furniture
   2. The application’s color scheme
   3. Data protection responsibilities, contractual controls, and assurance evidence
   4. The number of sales representatives

Correct Answer: 3. Data protection responsibilities, contractual controls, and assurance evidence

Explanation:

When a SaaS provider processes regulated information, the organization still retains responsibilities for protecting that data. The architect should evaluate contractual requirements, privacy obligations, access controls, encryption, incident notification, retention, deletion, and available assurance evidence. Clear responsibility boundaries reduce the risk of control gaps. Marketing and cosmetic factors are not meaningful substitutes for security due diligence.

Question 108.

A system cannot validate a digital certificate because the trust service is unavailable. For a high-assurance transaction, what is the safest behavior?

1. Trust the certificate automatically
   2. Skip certificate validation temporarily
   3. Accept the transaction if the user requests it
   4. Reject or defer the transaction until trust can be established**

Correct Answer: 4. Reject or defer the transaction until trust can be established

Explanation:

High-assurance transactions should not proceed when the system cannot reliably validate the trust relationship. Automatically accepting an unverified certificate would weaken authentication and could expose the transaction to impersonation or interception. A fail-secure approach rejects or delays the transaction until certificate validity and trust can be confirmed. The availability tradeoff should be considered during architecture design.

Question 109.

What is the PRIMARY benefit of using a dedicated privileged-access workstation for administrators?

1. It reduces exposure of privileged credentials to ordinary user activity and threats
   2. It eliminates the need for logging
   3. It guarantees administrators cannot make mistakes
   4. It removes the need for network segmentation

Correct Answer: 1. It reduces exposure of privileged credentials to ordinary user activity and threats

Explanation:

Privileged-access workstations separate sensitive administrative activity from routine browsing, email, and productivity tasks. This reduces the chance that malware or phishing targeting a normal user environment captures privileged credentials or sessions. They should still be combined with strong authentication, segmentation, monitoring, and controlled administrative paths. Dedicated workstations improve isolation but do not replace other safeguards.

Question 110.

A security architect must protect data exchanged between two internal services that communicate across an untrusted network segment. Which control is MOST appropriate?

1. Network address translation only
   2. Authenticated encryption for the service-to-service communication
   3. Additional disk space
   4. Data compression only

Correct Answer: 2. Authenticated encryption for the service-to-service communication

Explanation:

Authenticated encryption can protect both confidentiality and integrity while also helping verify that the communication endpoint is legitimate. Internal services should not automatically trust a network simply because it belongs to the organization. If the communication crosses an untrusted or shared segment, secure transport should protect data against interception and modification. NAT and compression do not provide equivalent protection.

Question 111.

A security architect wants to minimize the impact of compromise of a web application. Which design is BEST?

1. Give the application broad access to all internal systems
   2. Use one account for every application tier
   3. Restrict the application to only required network paths and backend permissions
   4. Disable application logging

Correct Answer: 3. Restrict the application to only required network paths and backend permissions

Explanation:

Constraining both network connectivity and application permissions limits what an attacker can do after compromising the web application. The web tier should communicate only with required backend systems and use identities with narrowly scoped privileges. This combines segmentation and least privilege to reduce lateral movement and data exposure. Broad permissions would greatly increase the blast radius of compromise.

Question 112.

An organization wants evidence that sensitive administrative actions cannot be easily erased by the administrator performing them. Which design is BEST?

1. Store audit logs only on the administered server
   2. Allow administrators to delete their own logs
   3. Disable logging during maintenance
   4. Send logs to a separately protected centralized system**

Correct Answer: 4. Send logs to a separately protected centralized system

Explanation:

Separately protected centralized logging reduces the ability of an administrator or attacker controlling one system to erase all evidence of activity. Logs should be access-controlled, time-synchronized, monitored, and retained appropriately. Local logs can still be useful, but an independent copy strengthens accountability and supports investigations. Administrators should not have unrestricted ability to alter evidence of their own actions.

Question 113.

Which principle MOST directly supports designing security mechanisms to be as simple as practical?

1. Economy of mechanism
   2. Complete mediation
   3. Separation of privilege
   4. Psychological acceptability

Correct Answer: 1. Economy of mechanism

Explanation:

Economy of mechanism favors simple and understandable security designs. Unnecessary complexity can introduce hidden dependencies, implementation defects, inconsistent configuration, and maintenance problems. Simpler mechanisms are generally easier to analyze, test, and operate correctly. This does not mean security systems should be simplistic; necessary complexity may be justified, but it should serve a clear requirement.

Question 114.

A system must preserve transaction integrity even if one administrator becomes malicious. Which control is MOST appropriate?

1. Allow one administrator full control
   2. Require independent approval for high-risk transactions
   3. Disable transaction logs
   4. Use one shared privileged account

Correct Answer: 2. Require independent approval for high-risk transactions

Explanation:

Independent approval applies separation of duties and, in some cases, dual control. It reduces the chance that one malicious or compromised administrator can complete a high-risk transaction without oversight. The design can also include strong auditing and individual identities. Shared accounts or unrestricted authority would weaken both accountability and resistance to insider misuse.

Question 115.

A business continuity analysis determines that a service can tolerate four hours of downtime but only ten minutes of data loss. What are the correct objectives?

1. RTO ten minutes; RPO four hours
   2. RTO and RPO both four hours
   3. RTO four hours; RPO ten minutes
   4. RTO and RPO both ten minutes

Correct Answer: 3. RTO four hours; RPO ten minutes

Explanation:

The recovery time objective defines the maximum target time for restoring the service after disruption, so the RTO is four hours. The recovery point objective defines the acceptable amount of data loss measured in time, so the RPO is ten minutes. These objectives drive design decisions around replication, backup frequency, standby infrastructure, and recovery procedures.

Question 116.

A security architect finds that a business process depends on one external provider with no alternative. What architectural concern should be raised?

1. The provider may use a different logo
   2. The contract may be too long
   3. The provider may have too many employees
   4. The provider represents a concentration and availability risk**

Correct Answer: 4. The provider represents a concentration and availability risk

Explanation:

A single external provider can become a critical dependency. If that provider experiences an outage, security incident, legal restriction, or business failure, the organization’s service may be disrupted. The architect should evaluate alternatives, contingency plans, contractual protections, recovery options, and the business impact of provider failure. External dependencies should be included in resilience and risk analysis.

Question 117.

A security architect wants to reduce exposure created by unnecessary network services. What should be done?

1. Disable or remove services and ports that are not required
   2. Enable every available service
   3. Permit unrestricted inbound traffic
   4. Give all systems public addresses

Correct Answer: 1. Disable or remove services and ports that are not required

Explanation:

Unused services and ports expand attack surface without providing business value. Removing or disabling unnecessary functionality reduces opportunities for exploitation and makes systems easier to secure and monitor. This is a fundamental hardening practice. Required services should still be configured securely and restricted to the users, systems, and network paths that actually need them.

Question 118.

Which approach BEST supports secure federation between two organizations?

1. Share one generic account between all users
   2. Establish defined trust, strong identity assertions, appropriate validation, and limited authorization
   3. Disable authentication at the trust boundary
   4. Allow unrestricted access after federation succeeds

Correct Answer: 2. Establish defined trust, strong identity assertions, appropriate validation, and limited authorization

Explanation:

Federation extends identity trust across organizational boundaries, so the trust relationship must be explicit and controlled. Identity assertions should be validated, authentication assurance should match the risk, and authorization should remain limited to required resources. Federation should not imply unrestricted trust. Logging, certificate or key management, and procedures for terminating the trust relationship are also important architectural considerations.

Question 119.

A security architect discovers that a legacy system cannot encrypt sensitive traffic. What should be done FIRST?

1. Ignore the weakness because the system is old
   2. Expose the system directly to the internet
   3. Assess the risk and design compensating protection such as secure gateways or network isolation
   4. Disable all monitoring

Correct Answer: 3. Assess the risk and design compensating protection such as secure gateways or network isolation

Explanation:

Legacy limitations should be addressed through documented risk analysis rather than ignored. If the system cannot provide required cryptographic protection directly, compensating controls may include encrypted tunnels, secure proxies, segmentation, restricted access paths, or application gateways. Replacement may be the preferred long-term strategy, but interim safeguards should reduce exposure to an acceptable level based on business risk.

Question 120.

Which approach BEST demonstrates mature security architecture lifecycle management?

1. Approve the design once and never review it again
   2. Ignore changes in technology and threats
   3. Document only successful architecture decisions
   4. Reassess architecture when risks, business requirements, dependencies, or technologies materially change**

Correct Answer: 4. Reassess architecture when risks, business requirements, dependencies, or technologies materially change

Explanation:

Security architecture is not static. New threats, cloud services, acquisitions, regulations, business processes, and technology changes can invalidate earlier assumptions. Mature lifecycle management includes periodic and event-driven reassessment, architecture reviews, documented exceptions, risk tracking, and validation of control effectiveness. Reassessment keeps the security architecture aligned with the organization’s current operating environment.