View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 121.

A security architect is reviewing a new microservices design. Which architectural concern should be addressed FIRST?

1. The color scheme of each service dashboard
   2. Trust relationships, service identities, and permitted communication paths
   3. The number of developers assigned to each service
   4. The size of the source-code repository

Correct Answer: 2. Trust relationships, service identities, and permitted communication paths

Explanation:

Microservices introduce many service-to-service interactions, making trust and identity important architectural concerns. Each service should have a defined identity, narrowly scoped permissions, and only the network access required to perform its function. The architect should also understand where sensitive data flows and which trust boundaries exist. Cosmetic and staffing details do not meaningfully determine the security posture of the service architecture.

Question 122.

Which security principle requires that mechanisms protect themselves against unauthorized modification?

1. Least privilege
   2. Open design
   3. Tamper resistance and protected security mechanisms
   4. Data minimization

Correct Answer: 3. Tamper resistance and protected security mechanisms

Explanation:

Security controls must themselves be protected from unauthorized changes. If attackers can disable logging, modify access rules, alter security agents, or replace trusted configuration, the controls cannot be relied upon. Architectures should therefore protect administrative interfaces, configuration files, keys, and security components through access restrictions, integrity controls, monitoring, and appropriate separation. Least privilege helps support this goal but does not fully describe it.

Question 123.

A company wants administrators to access production servers only through a hardened intermediate system. What architectural component BEST fits this requirement?

1. Jump host or bastion system
   2. Public DNS server
   3. Content delivery network
   4. General-purpose user workstation

Correct Answer: 1. Jump host or bastion system

Explanation:

A jump host or bastion system provides a controlled administrative access path into sensitive environments. It can enforce strong authentication, session monitoring, logging, and network restrictions while reducing direct exposure of production management interfaces. The bastion itself should be hardened and closely monitored. General user workstations should not normally have unrestricted direct access to critical production systems.

Question 124.

A highly sensitive application depends on one encryption-key server. What is the PRIMARY architectural risk?

1. The key server may produce too many logs
   2. Encryption may increase processor usage
   3. Administrators may need additional training
   4. The key server may become a single point of failure**

Correct Answer: 4. The key server may become a single point of failure

Explanation:

If all cryptographic operations depend on one key-management component, failure of that component can make data or services unavailable even if the rest of the infrastructure remains healthy. High-assurance architectures should consider secure redundancy, backup, recovery, and tested failover while ensuring that key protection is not weakened. Resilience and security must be designed together.

Question 125.

A security architect wants to ensure that authentication and authorization decisions remain independent. Why is this useful?

1. It allows identity verification and access permission decisions to be controlled separately
   2. It eliminates the need for user identities
   3. It removes the need for audit logging
   4. It guarantees every authenticated user full access

Correct Answer: 1. It allows identity verification and access permission decisions to be controlled separately

Explanation:

Authentication establishes who a user or service is, while authorization determines what that identity may do. Separating these functions supports flexible policy enforcement and prevents the mistaken assumption that successful authentication automatically grants broad access. An architecture should verify identity strongly and then apply least-privilege authorization based on roles, attributes, context, or other approved policy criteria.

Question 126.

An organization is designing disaster recovery for a database with a five-minute RPO. Which capability is MOST likely required?

1. Monthly full backups only
   2. Frequent replication or backup mechanisms capable of meeting the five-minute data-loss target
   3. A single local backup stored beside the database
   4. No backup because the database is highly available

Correct Answer: 2. Frequent replication or backup mechanisms capable of meeting the five-minute data-loss target

Explanation:

A five-minute RPO means the organization cannot tolerate losing more than approximately five minutes of data. The recovery architecture must therefore capture changes frequently enough to meet that requirement, often through replication, continuous protection, or frequent transaction backups. High availability does not replace data recovery, and infrequent backups would not satisfy such a strict RPO.

Question 127.

A security architect finds that an application accepts data from an external partner without validating input. What is the MAIN risk?

1. Higher storage costs
   2. Slower network performance
   3. Malicious or malformed data may cross a trust boundary and affect internal systems
   4. The application may generate too few logs

Correct Answer: 3. Malicious or malformed data may cross a trust boundary and affect internal systems

Explanation:

External input should be treated as untrusted. Without validation, malformed or malicious data may trigger injection, parsing failures, logic abuse, or other vulnerabilities in internal components. Validation should occur at appropriate trust boundaries and be based on expected formats and values. The architect should not rely on the external partner to guarantee safe input.

Question 128.

An organization wants to avoid exposing internal services directly to external clients. Which architecture is MOST appropriate?

1. Place all internal services on public addresses
   2. Allow clients to connect directly to databases
   3. Remove network filtering
   4. Use a controlled gateway or proxy layer between external clients and internal services**

Correct Answer: 4. Use a controlled gateway or proxy layer between external clients and internal services

Explanation:

A gateway or proxy can provide a controlled trust boundary between external clients and internal services. It can enforce authentication, authorization, protocol validation, rate limiting, logging, and other protections before requests reach internal systems. Directly exposing internal services increases attack surface and makes policy enforcement more difficult. The gateway itself should also be hardened and resilient.

Question 129.

Why is configuration management important to security architecture?

1. It helps ensure approved security settings remain consistent and unauthorized changes are detected
   2. It eliminates all software vulnerabilities
   3. It replaces access control
   4. It prevents the need for system updates

Correct Answer: 1. It helps ensure approved security settings remain consistent and unauthorized changes are detected

Explanation:

Security architecture depends on controls being implemented as designed. Configuration management helps maintain approved baselines, detect drift, document changes, and reduce inconsistent security settings. Without configuration control, systems can gradually deviate from the intended architecture. It complements vulnerability management, access control, monitoring, and change management rather than replacing them.

Question 130.

A business wants to reduce the impact of compromise of one cloud workload identity. Which design is BEST?

1. Give every workload the same broad cloud role
   2. Assign separate workload identities with narrowly scoped permissions
   3. Disable cloud audit logging
   4. Use one permanent administrator credential for all workloads

Correct Answer: 2. Assign separate workload identities with narrowly scoped permissions

Explanation:

Separate workload identities reduce the blast radius of compromise by limiting each service to the cloud resources and actions it actually requires. This supports least privilege and improves accountability. Broad shared roles make it easier for an attacker who compromises one workload to reach unrelated systems. Cloud identities should also be monitored and rotated or managed through appropriate platform mechanisms.

Question 131.

Which architecture characteristic MOST supports nonrepudiation for high-value digital transactions?

1. Anonymous accounts
   2. Shared credentials
   3. Strong identity, protected audit evidence, and appropriate digital signatures
   4. Disabled transaction logging

Correct Answer: 3. Strong identity, protected audit evidence, and appropriate digital signatures

Explanation:

Nonrepudiation requires credible evidence linking an action or transaction to a specific party. Strong identity assurance, protected audit records, timestamps, and digital signatures can provide this evidence when properly implemented. Shared or anonymous credentials undermine attribution. The design must also protect signing keys and audit records from unauthorized alteration.

Question 132.

A security architect is designing a system in which policy enforcement must continue during a network partition. Which issue should be considered MOST carefully?

1. User-interface color
   2. Server rack placement only
   3. Number of application icons
   4. The tradeoff between local policy enforcement, consistency, and availability**

Correct Answer: 4. The tradeoff between local policy enforcement, consistency, and availability

Explanation:

During a network partition, centralized policy services may become unavailable. The architecture must decide whether local cached policies can be used, how stale they may become, and whether access should fail secure. These choices affect security, consistency, and availability. The correct design depends on data sensitivity, risk tolerance, and business requirements rather than cosmetic or physical details.

Question 133.

What is the MAIN advantage of using immutable infrastructure for security-sensitive workloads?

1. It can reduce configuration drift by replacing systems rather than modifying them in place
   2. It eliminates the need for patching
   3. It guarantees applications have no vulnerabilities
   4. It removes the need for access controls

Correct Answer: 1. It can reduce configuration drift by replacing systems rather than modifying them in place

Explanation:

Immutable infrastructure treats deployed systems as replaceable artifacts rather than environments that are continually modified. Updates are introduced by deploying new approved images or instances. This can reduce configuration drift and improve consistency, although the underlying images still require patching, vulnerability management, access control, and testing. Immutability is a useful architectural practice but not a complete security solution.

Question 134.

A business requires sensitive workloads to run only on approved managed devices. Which control BEST supports this requirement?

1. Anonymous authentication
   2. Device posture assessment integrated with access policy
   3. Shared passwords
   4. Open wireless access

Correct Answer: 2. Device posture assessment integrated with access policy

Explanation:

Device posture assessment can evaluate whether an endpoint meets security requirements such as managed status, encryption, patch level, endpoint protection, or certificate possession. Integrating device posture with access decisions allows the organization to restrict sensitive resources to trusted or compliant devices. This aligns with contextual and Zero Trust access models rather than relying solely on user identity.

Question 135.

An application is designed so that every component has direct access to every other component. What is the PRIMARY security weakness?

1. The architecture may use too much encryption
   2. The application may have too many users
   3. Compromise of one component can enable excessive lateral movement
   4. Logging may become too centralized

Correct Answer: 3. Compromise of one component can enable excessive lateral movement

Explanation:

Unrestricted east-west communication creates a large blast radius. If one component is compromised, an attacker may be able to reach many unrelated systems. Segmentation, service identities, least privilege, and explicit communication policies can reduce lateral movement. Components should communicate only with the services and resources required for their function.

Question 136.

A security architect is assessing whether to allow a legacy application exception to an enterprise standard. What should be done FIRST?

1. Approve the exception automatically because the application is old
   2. Ignore the enterprise standard
   3. Permanently disable monitoring for the application
   4. Evaluate the risk, business need, compensating controls, and duration of the exception**

Correct Answer: 4. Evaluate the risk, business need, compensating controls, and duration of the exception

Explanation:

Exceptions should be deliberate and risk-based. The architect should understand why the standard cannot be met, the risk introduced, available compensating controls, and whether the exception should expire or be reviewed later. Documented approval creates accountability. Automatically granting permanent exceptions allows technical debt and risk to accumulate without oversight.

Question 137.

Why should an enterprise architecture identify critical security dependencies such as identity, DNS, certificate services, and key management?

1. Failure of shared dependencies can affect many otherwise healthy applications
   2. Shared services are always insecure
   3. Applications should never use centralized services
   4. Dependencies eliminate the need for resilience planning

Correct Answer: 1. Failure of shared dependencies can affect many otherwise healthy applications

Explanation:

Applications may appear resilient while still depending on centralized services such as identity providers, DNS, certificate validation, or key management. Failure of one shared dependency can affect many systems simultaneously. Architects should identify these dependencies, evaluate concentration risk, provide appropriate redundancy, and test recovery behavior. Resilience must include supporting services, not just the application itself.

Question 138.

A security architect wants to ensure that only authorized software can be deployed to production. Which control is MOST appropriate?

1. Allow direct developer access to production servers
   2. Use a controlled deployment pipeline with approvals and integrity verification
   3. Share production administrator passwords with the development team
   4. Disable deployment logging

Correct Answer: 2. Use a controlled deployment pipeline with approvals and integrity verification

Explanation:

A controlled deployment pipeline can enforce code integrity, approval requirements, automated security checks, and separation between development and production. It reduces the need for broad direct administrative access and makes production changes more traceable. Integrity verification also helps ensure that deployed artifacts match approved versions. Logging should remain enabled to support accountability.

Question 139.

A system processes transactions that must not be altered undetected. Which security objective is MOST important?

1. Availability only
   2. Confidentiality only
   3. Integrity
   4. Convenience

Correct Answer: 3. Integrity

Explanation:

Integrity protects information and transactions against unauthorized or undetected modification. Controls may include cryptographic integrity protection, digital signatures, access controls, transaction validation, and protected audit logging. Confidentiality may also be necessary, but the stated requirement focuses specifically on detecting or preventing changes to transaction data. Architecture should align controls with the security objective that matters most to the business process.

Question 140.

Which practice BEST supports sustainable enterprise security architecture over time?

1. Design once and never reassess assumptions
   2. Permit permanent undocumented exceptions
   3. Review only technical controls after a breach
   4. Maintain standards, track dependencies and exceptions, reassess risk, and update architecture as requirements change**

Correct Answer: 4. Maintain standards, track dependencies and exceptions, reassess risk, and update architecture as requirements change

Explanation:

Enterprise security architecture must evolve as technologies, threats, regulations, dependencies, and business priorities change. Mature governance includes standards, architecture reviews, documented exceptions, dependency analysis, and periodic or event-driven risk reassessment. This allows the architecture to remain relevant instead of becoming outdated. Sustainable security depends on lifecycle management rather than one-time design approval.