View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 141.

A security architect is designing access to a sensitive application for both employees and contractors. What should determine their authorization MOST directly?

1. Employment status alone
   2. Business role, required privileges, and risk context
   3. Length of time with the organization
   4. Physical office location only

Correct Answer: 2. Business role, required privileges, and risk context

Explanation:

Authorization should be based on what each identity needs to perform legitimate business functions, not simply whether the user is an employee or contractor. Role, task, data sensitivity, and contextual risk should influence access decisions. Least privilege should be applied so users receive only the permissions necessary for their responsibilities. Employment category may be one input, but it should not be the sole basis for authorization.

Question 142.

Which architectural approach BEST reduces the risk that compromise of one API credential affects multiple applications?

1. Use a separate narrowly scoped credential for each application
   2. Use one shared credential everywhere
   3. Disable API authentication
   4. Store credentials in public repositories

Correct Answer: 1. Use a separate narrowly scoped credential for each application

Explanation:

Separate application credentials reduce the blast radius of compromise. If one API credential is exposed, the attacker should gain access only to the resources required by that application. Shared credentials make containment and revocation much harder and weaken accountability. Credentials should also be stored securely, rotated appropriately, and granted only the minimum permissions necessary.

Question 143.

A security architect is evaluating a new system that crosses several trust boundaries. Which control should be applied at EACH significant boundary?

1. Increased processor capacity
   2. Data compression
   3. Appropriate authentication, authorization, validation, and monitoring
   4. Reduced logging

Correct Answer: 3. Appropriate authentication, authorization, validation, and monitoring

Explanation:

Trust boundaries are points where data or requests move between components with different security assumptions. These locations should be protected with controls appropriate to the risk, such as authentication, authorization, input validation, encryption, and monitoring. The exact combination depends on the type of boundary and the sensitivity of the information. Hardware capacity and compression do not address trust-transition risk.

Question 144.

A critical system relies on one certificate authority for all authentication certificates. What should the security architect consider MOST carefully?

1. The CA logo
   2. The number of certificate templates
   3. The amount of disk space used by certificates
   4. Resilience, protection of signing keys, and recovery of the certificate service**

Correct Answer: 4. Resilience, protection of signing keys, and recovery of the certificate service

Explanation:

A certificate authority is a highly trusted security service. If it becomes unavailable, certificate issuance or validation processes may be disrupted; if its signing keys are compromised, trust in issued certificates may be undermined. The architecture should therefore address strong key protection, restricted administration, backup and recovery, redundancy where appropriate, and incident-response procedures for CA compromise.

Question 145.

Why should production systems use dedicated service accounts rather than personal administrator accounts for automated processes?

1. Dedicated identities improve accountability, lifecycle control, and least-privilege enforcement
   2. Personal accounts are always more secure
   3. Service accounts eliminate the need for passwords or keys
   4. Automated processes do not require authorization

Correct Answer: 1. Dedicated identities improve accountability, lifecycle control, and least-privilege enforcement

Explanation:

Automated services should have identities that are distinct from human administrator accounts. Dedicated service accounts can be scoped to specific permissions, monitored separately, and managed according to the application’s lifecycle. Personal accounts may be disabled when an employee leaves or may carry privileges unrelated to the service. Separating machine and human identities improves control and reduces unnecessary exposure.

Question 146.

An organization wants to protect sensitive application secrets used by containerized workloads. Which design is BEST?

1. Store secrets directly in container images
   2. Use an approved secrets-management service with controlled workload access
   3. Publish secrets in environment documentation
   4. Hard-code secrets into source code

Correct Answer: 2. Use an approved secrets-management service with controlled workload access

Explanation:

Secrets such as passwords, API keys, and tokens should be stored and retrieved through controlled mechanisms rather than embedded in code or images. A secrets-management service can provide access control, auditing, rotation, and secure distribution. Workloads should receive only the secrets they require. Hard-coded or broadly published secrets are difficult to rotate and can be exposed through repositories or image distribution.

Question 147.

A security architect must protect the integrity of software before it is deployed to production. Which control is MOST appropriate?

1. Allow developers to modify production binaries directly
   2. Disable change tracking
   3. Use signed or otherwise integrity-verified build artifacts in a controlled deployment process
   4. Permit unreviewed software packages

Correct Answer: 3. Use signed or otherwise integrity-verified build artifacts in a controlled deployment process

Explanation:

Integrity verification helps ensure that production software matches the approved build and has not been modified unexpectedly. A controlled pipeline can enforce approvals, testing, artifact signing, and verification before deployment. Direct changes to production or unreviewed packages weaken assurance and make it difficult to determine whether software is trustworthy. Deployment controls should also provide auditability.

Question 148.

A system must remain available if a single database node fails. Which design BEST supports the requirement?

1. One larger database server
   2. Daily offline backups only
   3. Manual reinstallation after failure
   4. Redundant database nodes with tested failover**

Correct Answer: 4. Redundant database nodes with tested failover

Explanation:

If service availability must survive a database-node failure, the architecture should avoid dependence on one database instance. Redundant nodes, appropriate replication, and tested failover can maintain service while a failed component is repaired. Backups remain important for recovery but do not provide immediate availability. Failover must be tested regularly to ensure the design works under real failure conditions.

Question 149.

What is the PRIMARY security benefit of limiting administrative interfaces to a dedicated management network?

1. It reduces exposure of privileged interfaces to ordinary user traffic
   2. It eliminates authentication requirements
   3. It prevents administrators from making errors
   4. It guarantees the network cannot be compromised

Correct Answer: 1. It reduces exposure of privileged interfaces to ordinary user traffic

Explanation:

Administrative interfaces provide powerful control and should have limited exposure. A dedicated management network reduces the number of systems capable of reaching those interfaces and helps isolate privileged traffic from normal user activity. The design should still use strong authentication, access control, logging, and endpoint protection. Segmentation reduces attack surface but does not eliminate all risks.

Question 150.

An organization is migrating from static passwords to certificate-based machine authentication. What architectural issue is MOST important?

1. User-interface design
   2. Certificate issuance, protection, renewal, revocation, and trust management
   3. Monitor size
   4. Employee training schedules only

Correct Answer: 2. Certificate issuance, protection, renewal, revocation, and trust management

Explanation:

Certificate-based authentication depends on a secure certificate lifecycle. The architecture must address how certificates are issued, how private keys are protected, how certificates are renewed before expiration, how compromised certificates are revoked, and how trust anchors are distributed. Failure in any of these areas can create availability or security problems even when the cryptographic algorithms themselves are strong.

Question 151.

A security architect wants to ensure that only approved data flows are allowed between application tiers. Which control BEST supports this goal?

1. Flat networking
   2. Default-allow firewall rules
   3. Explicit allow rules enforced between segmented tiers
   4. Anonymous service access

Correct Answer: 3. Explicit allow rules enforced between segmented tiers

Explanation:

Segmented tiers combined with explicit allow rules support a default-deny architecture. Only the traffic required for legitimate application operation should be permitted between web, application, database, and management zones. This reduces lateral movement and unnecessary exposure. Flat networks or broad allow rules make it easier for a compromised component to access unrelated systems.

Question 152.

A recovery plan meets the required RTO but cannot restore sufficiently recent data. Which objective is not being met?

1. Availability classification
   2. Mean time between failures
   3. Service level objective
   4. Recovery point objective**

Correct Answer: 4. Recovery point objective

Explanation:

RTO measures how quickly a service must be restored, while RPO measures how much data loss is acceptable. A system can meet its recovery-time target yet still fail the business requirement if the restored data is too old. Backup frequency, replication, and transaction-protection mechanisms should therefore be designed according to the required RPO as well as the RTO.

Question 153.

Which approach BEST supports secure decommissioning of a system that stored sensitive information?

1. Remove access, securely dispose of data, revoke credentials and keys, and update dependencies
   2. Leave all accounts active indefinitely
   3. Keep encryption keys publicly available
   4. Ignore connected systems

Correct Answer: 1. Remove access, securely dispose of data, revoke credentials and keys, and update dependencies

Explanation:

System decommissioning should address both technical and information-security concerns. Sensitive data should be retained or destroyed according to policy, access should be removed, credentials and certificates should be revoked, and dependent systems should be updated. Monitoring and inventory records should also reflect the retirement. Failing to complete these steps can leave orphaned accounts, exposed data, or unexpected dependencies.

Question 154.

An organization wants to make authorization decisions using user role, device health, location, and transaction sensitivity. Which access model BEST describes this approach?

1. Anonymous access
   2. Contextual or attribute-based access control
   3. Shared-account access
   4. Unrestricted role inheritance

Correct Answer: 2. Contextual or attribute-based access control

Explanation:

Attribute-based or contextual access control evaluates several characteristics when making authorization decisions. These may include user attributes, device posture, location, resource sensitivity, time, and transaction context. This approach can provide more granular decisions than relying on a static role alone. The policy should remain understandable, auditable, and aligned with least privilege.

Question 155.

A security architect learns that an application automatically trusts all requests from the internal network. What is the MAIN concern?

1. Internal users may experience slower performance
   2. The application may use too many certificates
   3. Network location is being treated as sufficient evidence of trust
   4. External users may have shorter passwords

Correct Answer: 3. Network location is being treated as sufficient evidence of trust

Explanation:

Internal networks can be compromised, and attackers may gain access through phishing, malware, stolen credentials, or vulnerable systems. Trusting requests solely because they originate internally creates excessive implicit trust. A stronger design verifies identity, device posture, authorization, and other context regardless of network location. This reflects modern Zero Trust principles.

Question 156.

A security architect is selecting a compensating control for a legacy system that cannot support multi-factor authentication. What should be done FIRST?

1. Disable all authentication
   2. Accept the risk automatically
   3. Expose the system to more users
   4. Evaluate the specific risk and select controls that reduce it to an acceptable level**

Correct Answer: 4. Evaluate the specific risk and select controls that reduce it to an acceptable level

Explanation:

Compensating controls should be chosen based on the risk created by the missing primary control. Depending on the environment, alternatives might include network isolation, access gateways, restricted source networks, stronger upstream authentication, session monitoring, or enhanced logging. The goal is to reduce residual risk to an acceptable level while planning longer-term remediation where appropriate.

Question 157.

What is the MAIN security value of maintaining an accurate inventory of system dependencies?

1. It helps architects understand impact, shared risks, and critical supporting services
   2. It guarantees all systems are patched
   3. It eliminates the need for disaster recovery
   4. It prevents all configuration errors

Correct Answer: 1. It helps architects understand impact, shared risks, and critical supporting services

Explanation:

Applications often depend on identity, DNS, networks, APIs, databases, key management, and third-party services. Accurate dependency information helps architects identify concentration risk, single points of failure, and cascading impact. It is also valuable for change planning and resilience design. Dependency inventories complement rather than replace vulnerability management or disaster recovery.

Question 158.

A security architect wants to reduce the possibility that unauthorized code reaches production. Which process is BEST?

1. Let developers copy binaries directly to production
   2. Use an approved CI/CD pipeline with access controls, testing, and deployment auditability
   3. Disable change approval
   4. Share production credentials with all developers

Correct Answer: 2. Use an approved CI/CD pipeline with access controls, testing, and deployment auditability

Explanation:

A controlled CI/CD pipeline can enforce build integrity, testing, approvals, separation of responsibilities, and traceability. This reduces direct production access and makes it more difficult for unreviewed code to bypass governance. The pipeline itself should also be protected because compromise of build or deployment infrastructure can affect many production systems.

Question 159.

Which architectural concern is MOST important when many applications rely on the same identity provider?

1. The provider’s interface color
   2. The number of user groups
   3. Concentration risk and resilience of the shared identity service
   4. The age of user accounts

Correct Answer: 3. Concentration risk and resilience of the shared identity service

Explanation:

A shared identity provider can improve consistency, but it can also become a critical dependency for many applications. An outage or compromise may have enterprise-wide impact. The architecture should therefore address redundancy, secure administration, strong monitoring, recovery, and alternative procedures where necessary. Shared security services should be treated as critical infrastructure.

Question 160.

Which practice BEST supports long-term effectiveness of an enterprise security architecture?

1. Never change an approved architecture
   2. Allow permanent undocumented exceptions
   3. Reassess only after major incidents
   4. Continuously review assumptions, risk, dependencies, standards, and control effectiveness**

Correct Answer: 4. Continuously review assumptions, risk, dependencies, standards, and control effectiveness

Explanation:

Enterprise security architecture must evolve with changing technologies, threats, business models, regulations, and dependencies. Continuous review helps identify outdated assumptions, ineffective controls, and emerging risks. Standards, exceptions, and architecture decisions should be maintained and periodically reassessed. Treating architecture as a living discipline helps keep security aligned with the organization’s current risk environment.