View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 241.

A security architect is designing a new federated identity solution between two enterprises. What should be established FIRST?

1. The trust model, identity assurance requirements, and allowed claims
   2. The user-interface theme
   3. The number of help-desk staff
   4. The physical location of every identity server

Correct Answer: 1. The trust model, identity assurance requirements, and allowed claims

Explanation:

Federation depends on clearly defined trust between identity providers and relying parties. The architect should determine what level of authentication assurance is required, which identity attributes may be exchanged, how assertions are validated, and how authorization decisions will use those claims. Key or certificate management, monitoring, and trust termination procedures should follow from this model. Cosmetic and staffing factors do not establish secure federation.

Question 242.

A highly sensitive application uses several cryptographic keys for different functions. Which design BEST limits the impact of one key being compromised?

1. Use the same key for encryption, signing, and authentication
   2. Separate keys by purpose and scope, and manage their lifecycles independently
   3. Store every key in application source code
   4. Never rotate any key

Correct Answer: 2. Separate keys by purpose and scope, and manage their lifecycles independently

Explanation:

Cryptographic keys should generally be separated according to purpose, system, and security domain. If one narrowly scoped key is compromised, other cryptographic functions can remain protected. Independent rotation and revocation also become easier. Using a single key for many purposes increases the blast radius of compromise and can weaken accountability. Strong key management includes generation, storage, access control, rotation, recovery, revocation, and destruction.

Question 243.

A security architect wants to identify whether a planned application redesign introduces new trust boundaries. Which activity is MOST useful?

1. Hardware-capacity testing
   2. License counting
   3. Updating data-flow and trust-boundary diagrams
   4. Changing server naming conventions

Correct Answer: 3. Updating data-flow and trust-boundary diagrams

Explanation:

Architecture changes can alter where information crosses between networks, applications, users, external services, or administrative domains. Updated data-flow and trust-boundary diagrams help the architect identify these transitions and determine whether new authentication, authorization, validation, encryption, or monitoring controls are required. Capacity and licensing reviews do not reveal changes in security trust assumptions.

Question 244.

An enterprise uses a single privileged-access gateway for every production environment. What is the PRIMARY architectural concern?

1. The gateway may use strong authentication
   2. Administrators may need training
   3. The gateway may create detailed logs
   4. It may become a critical concentration point and single point of failure**

Correct Answer: 4. It may become a critical concentration point and single point of failure

Explanation:

Centralized privileged-access gateways can strengthen security, but they also become important shared dependencies. Failure may prevent administrators from reaching production systems, while compromise may expose many environments. The architecture should therefore include strong hardening, monitoring, redundancy, secure recovery, and carefully controlled administration. Centralization creates value only when concentration risk is explicitly managed.

Question 245.

Which approach BEST reduces privilege accumulation when employees frequently change roles?

1. Periodically review access and remove permissions no longer required
   2. Allow users to retain all previous access indefinitely
   3. Give every user administrator rights
   4. Disable identity governance

Correct Answer: 1. Periodically review access and remove permissions no longer required

Explanation:

Role changes can cause users to accumulate permissions from previous responsibilities. Regular access reviews and timely deprovisioning help enforce least privilege throughout the identity lifecycle. Access should be adjusted when employees transfer, change duties, or leave the organization. Retaining unnecessary privileges increases the impact of credential compromise and insider misuse.

Question 246.

A security architect is evaluating whether an application can rely on cached authorization decisions during a temporary outage. What should drive the decision MOST?

1. The application’s color scheme
   2. Resource sensitivity, cache age, business impact, and risk tolerance
   3. The number of developers
   4. Server rack location

Correct Answer: 2. Resource sensitivity, cache age, business impact, and risk tolerance

Explanation:

Cached authorization can improve availability but may use stale permissions after access has been revoked or changed. The architect should determine which operations may safely rely on cached decisions, how long those decisions remain acceptable, and when the application must fail secure. Highly sensitive functions may require current authorization, while lower-risk operations may tolerate limited caching under controlled conditions.

Question 247.

A production application depends on an open-source library that is no longer maintained. What should the security architect do?

1. Ignore the issue because the application currently works
   2. Disable vulnerability monitoring
   3. Assess the dependency risk and establish replacement, mitigation, or containment measures
   4. Publish the library directly to the internet

Correct Answer: 3. Assess the dependency risk and establish replacement, mitigation, or containment measures

Explanation:

Unsupported software can accumulate unpatched vulnerabilities and create long-term supply-chain risk. The architect should evaluate the application’s dependency on the library, exposure, compensating controls, and available alternatives. Replacement or modernization may be the preferred long-term solution, while interim isolation or monitoring can reduce risk. Unsupported dependencies should be visible in risk and lifecycle management.

Question 248.

A critical database is replicated to a secondary region, but both regions depend on the same external network provider. What risk remains?

1. Database encryption may be too strong
   2. Replication may create audit logs
   3. Secondary storage may be larger
   4. A common network-provider failure could affect both regions**

Correct Answer: 4. A common network-provider failure could affect both regions

Explanation:

Geographic redundancy does not eliminate common-mode failures when supposedly independent environments share critical underlying dependencies. If both regions rely on one network provider, an outage at that provider could defeat the resilience design. Architects should map shared dependencies and, where justified, diversify network routes, providers, DNS, identity, and other critical services to achieve genuine independence.

Question 249.

What is the PRIMARY security benefit of using individual administrator accounts rather than a shared privileged account?

1. Actions can be attributed to specific administrators
   2. Passwords never need to change
   3. Authorization is no longer necessary
   4. Monitoring can be disabled

Correct Answer: 1. Actions can be attributed to specific administrators

Explanation:

Individual privileged identities improve accountability because actions can be tied to specific administrators. They also allow permissions to be assigned, revoked, and monitored independently. Shared accounts obscure responsibility and make investigations more difficult. Strong authentication, session controls, and protected audit logging should complement unique identities for sensitive administrative access.

Question 250.

A business wants to expose selected internal services to partners without giving partners broad network access. Which architecture is MOST appropriate?

1. Extend the internal network directly to every partner
   2. Use a controlled gateway or API layer with explicit authentication and authorization
   3. Disable partner authentication
   4. Place internal databases directly on the internet

Correct Answer: 2. Use a controlled gateway or API layer with explicit authentication and authorization

Explanation:

A controlled gateway creates a defined boundary between partners and internal systems. It can enforce authentication, authorization, request validation, rate limiting, encryption, and logging while exposing only approved services. Extending broad internal network access unnecessarily increases trust and attack surface. Partner access should be limited to the precise functions and data required for the business relationship.

Question 251.

A security architect finds that a service can modify its own security policy configuration. What is the MAIN concern?

1. The service may generate too many alerts
   2. Performance may improve
   3. Compromise of the service could allow it to weaken its own controls
   4. Policy files may use too much storage

Correct Answer: 3. Compromise of the service could allow it to weaken its own controls

Explanation:

Security mechanisms should be protected from the components they govern when practical. If a compromised service can modify its own authorization rules, logging settings, or other security policy, an attacker may disable controls and conceal activity. Policy administration should be restricted to trusted management paths, protected identities, and controlled change processes. Separation improves integrity of the enforcement environment.

Question 252.

A service must remain available during maintenance of one server. Which architecture BEST supports this requirement?

1. Shut down the entire service during maintenance
   2. Store backups only
   3. Use one very large server
   4. Deploy redundant nodes so traffic can continue through healthy components**

Correct Answer: 4. Deploy redundant nodes so traffic can continue through healthy components

Explanation:

Redundant nodes allow planned maintenance or individual server failure without taking the entire service offline. Load balancing, session management, data consistency, and failover behavior should be designed and tested according to availability requirements. Backups support recovery but do not provide immediate service continuity. Redundancy should also avoid hidden shared failure points.

Question 253.

Which practice BEST helps prevent sensitive information from remaining indefinitely in temporary processing locations?

1. Define retention and secure-deletion requirements for temporary data stores
   2. Keep all temporary files permanently
   3. Disable data classification
   4. Allow users to choose retention informally

Correct Answer: 1. Define retention and secure-deletion requirements for temporary data stores

Explanation:

Temporary files, caches, staging databases, and processing queues can contain sensitive information even when they are not considered primary data stores. Architecture should define how long such information may remain and how it is securely removed when no longer required. This supports data minimization and reduces the number of locations where sensitive data can be exposed.

Question 254.

An organization wants to prevent unauthorized devices from connecting to a sensitive administrative network. Which approach is BEST?

1. Trust every device on the internal network
   2. Require device authentication and posture validation before access
   3. Disable network access controls
   4. Use only a shared Wi-Fi password

Correct Answer: 2. Require device authentication and posture validation before access

Explanation:

Sensitive networks should validate both the user and the device where appropriate. Device certificates, managed-device status, endpoint security posture, and other controls can help ensure that only approved systems reach administrative resources. A shared password or internal network location alone provides weak assurance and may allow compromised or unmanaged devices to access privileged paths.

Question 255.

A security architect is evaluating a proposed direct connection between a public web server and a highly sensitive database. What is the BEST response?

1. Approve it because the web server needs data
   2. Disable database authentication
   3. Introduce a controlled application tier and restrict database access to required flows
   4. Place the database on the public internet

Correct Answer: 3. Introduce a controlled application tier and restrict database access to required flows

Explanation:

Direct access from an internet-facing system to a sensitive database increases risk. A layered architecture can separate the public web tier from application logic and the data tier, allowing the organization to enforce controls at each boundary. Database communication should be limited to approved application identities and required protocols. This supports segmentation and defense in depth.

Question 256.

A security architect is considering a permanent exception to a security standard because remediation is expensive. What should be done?

1. Approve the exception without documentation
   2. Ignore the risk
   3. Remove the system from the asset inventory
   4. Document the risk, compensating controls, owner, approval, and review or expiration date**

Correct Answer: 4. Document the risk, compensating controls, owner, approval, and review or expiration date

Explanation:

Security exceptions should not become unmanaged permanent weaknesses. The organization should understand the residual risk, document why the standard cannot currently be met, identify compensating controls, assign an accountable owner, and establish periodic review or expiration. Cost can influence risk decisions, but it does not eliminate the need for formal governance and accountability.

Question 257.

What is the MAIN architectural value of identifying shared dependencies across multiple applications?

1. It reveals concentration risk and potential cascading impact
   2. It eliminates the need for backup
   3. It prevents every outage
   4. It guarantees applications are secure

Correct Answer: 1. It reveals concentration risk and potential cascading impact

Explanation:

Several applications may depend on the same identity platform, DNS service, network provider, key manager, database, or external SaaS provider. Identifying these shared dependencies allows architects to understand how one failure or compromise might affect many services. This information supports resilience planning, risk prioritization, incident response, and investment decisions.

Question 258.

A secure development pipeline uses digital signatures on deployment artifacts. What should be protected MOST carefully?

1. Developer desktop wallpapers
   2. The private signing keys and signing process
   3. The names of build servers
   4. Public verification keys from authorized disclosure

Correct Answer: 2. The private signing keys and signing process

Explanation:

If an attacker obtains the private signing key or compromises the signing process, malicious software may appear legitimate because it carries a valid signature. Private keys should therefore be strongly protected, access should be limited, signing actions should be audited, and revocation procedures should exist. Public verification keys are intended to be distributed to systems that validate signatures.

Question 259.

A legacy system cannot support centralized logging. What should the security architect do?

1. Assume logging is unnecessary
   2. Disable all local logs
   3. Assess the monitoring gap and implement feasible compensating collection or oversight controls
   4. Exclude the system from incident response

Correct Answer: 3. Assess the monitoring gap and implement feasible compensating collection or oversight controls

Explanation:

A legacy limitation should trigger risk analysis rather than abandonment of the requirement. Depending on technical constraints, compensating controls might include log forwarding through an intermediary, network monitoring, local log collection with restricted access, or additional detection around the system. The residual gap should be documented, and modernization may be appropriate if the risk remains unacceptable.

Question 260.

Which practice BEST supports a mature security architecture program as the enterprise evolves?

1. Treat architecture decisions as permanent
   2. Allow undocumented exceptions
   3. Reassess only after security incidents
   4. Continuously review risks, dependencies, standards, exceptions, and changing business requirements**

Correct Answer: 4. Continuously review risks, dependencies, standards, exceptions, and changing business requirements

Explanation:

Security architecture must remain aligned with an environment that continually changes. New technologies, acquisitions, regulatory requirements, threats, and business processes can invalidate earlier assumptions. Mature programs therefore maintain architecture standards, track exceptions, reassess shared dependencies and risks, and update designs when conditions materially change. Continuous governance keeps architecture relevant and defensible over time.