View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 261.

A security architect is designing a privileged-access model for cloud administrators. Which control provides the STRONGEST reduction in standing privilege?

1. Permanent administrator roles assigned to all cloud engineers
   2. Just-in-time privileged access with approval and expiration
   3. Shared administrator accounts
   4. Passwords stored in team documentation

Correct Answer: 2. Just-in-time privileged access with approval and expiration

Explanation:

Just-in-time access reduces standing privilege by granting elevated permissions only when they are required and removing them automatically after a defined period. Approval, strong authentication, and session logging can further strengthen the process. Permanent privileged roles increase exposure because powerful permissions remain available even when they are not needed. Shared accounts also weaken accountability and make it harder to attribute administrative activity to a specific individual.

Question 262.

Which architectural principle BEST supports evaluating every request based on current identity and policy rather than trusting a prior network location?

1. Continuous verification
   2. Open design
   3. Data minimization
   4. Maximum availability

Correct Answer: 1. Continuous verification

Explanation:

Continuous verification is a key concept in modern Zero Trust architectures. It assumes that network location alone should not establish ongoing trust. Access decisions should consider current identity assurance, device posture, session context, resource sensitivity, and other relevant factors. This reduces the risk that an attacker who gains access to an internal network automatically inherits broad trust. The approach complements least privilege and explicit authorization.

Question 263.

A security architect is reviewing an application that stores encryption keys in the same database as encrypted records. What is the MAIN concern?

1. The database may require more storage
   2. The keys may expire too quickly
   3. Compromise of the database may expose both ciphertext and the keys needed to decrypt it
   4. Encryption may slow application performance

Correct Answer: 3. Compromise of the database may expose both ciphertext and the keys needed to decrypt it

Explanation:

Encryption provides limited protection if the encrypted data and its decryption keys are protected by the same trust boundary and access controls. An attacker who compromises that database may obtain both. Keys should normally be separated and protected through a dedicated key-management mechanism or hardware-backed service. Access, rotation, revocation, backup, and recovery should also be addressed throughout the key lifecycle.

Question 264.

An enterprise application requires communication with a third-party service over the internet. Which design BEST protects the connection?

1. Send sensitive data in plaintext because the provider is trusted
   2. Rely only on IP address filtering
   3. Disable server authentication to improve availability
   4. Use authenticated encrypted transport and validate the remote service identity**

Correct Answer: 4. Use authenticated encrypted transport and validate the remote service identity

Explanation:

Traffic crossing an untrusted network should be protected against interception, modification, and impersonation. Authenticated encryption can provide confidentiality and integrity, while certificate or equivalent identity validation helps ensure the application is communicating with the intended third party. Network filtering can be an additional control, but it does not replace cryptographic protection or strong endpoint authentication.

Question 265.

What is the PRIMARY purpose of an architecture security review before implementation?

1. Identify design-level risks while they are still easier and less costly to correct
   2. Replace all later security testing
   3. Guarantee the system will have no vulnerabilities
   4. Approve every requested exception automatically

Correct Answer: 1. Identify design-level risks while they are still easier and less costly to correct

Explanation:

Architecture reviews provide an opportunity to identify trust issues, missing controls, resilience weaknesses, data-protection gaps, and risky dependencies before implementation decisions become difficult to change. They complement, rather than replace, later activities such as code review, vulnerability assessment, and penetration testing. Early identification can reduce remediation cost and improve alignment between business requirements and security controls.

Question 266.

An organization is designing a service that must tolerate the loss of one encryption-key-management node. Which approach is MOST appropriate?

1. Store all keys in plaintext as a backup
   2. Use secure redundant key-management components with protected replication and tested failover
   3. Disable encryption during outages
   4. Keep only one key server and increase its CPU capacity

Correct Answer: 2. Use secure redundant key-management components with protected replication and tested failover

Explanation:

Key-management infrastructure can become a critical dependency for encryption, signing, and authentication services. Redundancy can improve availability, but replication and failover must preserve the confidentiality and integrity of key material. Plaintext backup or disabling encryption would introduce unacceptable security risk. The architecture should combine strong protection of keys with tested resilience mechanisms.

Question 267.

A security architect discovers that different business units independently manage privileged accounts with inconsistent controls. What is the BEST architectural response?

1. Allow each team to continue without common standards
   2. Disable auditing to reduce complexity
   3. Establish enterprise privileged-access standards and centralized governance where practical
   4. Require all administrators to share one account

Correct Answer: 3. Establish enterprise privileged-access standards and centralized governance where practical

Explanation:

Inconsistent privileged-access practices can create uneven security and make enterprise risk difficult to manage. Common standards for authentication, approval, session control, credential storage, logging, and account lifecycle improve consistency. Centralized governance does not necessarily require one technical platform, but it should establish clear expectations and accountability across business units. Shared accounts would reduce traceability and should generally be avoided.

Question 268.

A security architect is designing an application that must continue processing low-risk requests when the central identity service is unavailable. What should be defined?

1. A blanket rule allowing every request
   2. A permanent bypass of authentication
   3. An anonymous administrator account
   4. Explicit degraded-mode behavior with clearly limited permissions and duration**

Correct Answer: 4. Explicit degraded-mode behavior with clearly limited permissions and duration

Explanation:

If business requirements justify continued operation during an identity-service outage, degraded-mode behavior should be explicitly designed rather than improvised. The architect should define which low-risk operations remain available, what cached identity or authorization data may be used, how long it remains valid, and which sensitive functions must stop. This balances availability with security and prevents an outage from turning into broad unauthorized access.

Question 269.

Which design BEST limits the impact of compromise of a software build server?

1. Separate build, signing, and production deployment privileges and protect the pipeline with strong controls
   2. Allow the build server unrestricted production administrator access
   3. Store all signing keys on the build server in plaintext
   4. Disable pipeline logging

Correct Answer: 1. Separate build, signing, and production deployment privileges and protect the pipeline with strong controls

Explanation:

A build server is a high-value software-supply-chain target. Separating responsibilities reduces the chance that compromise of one component automatically enables malicious code to be signed and deployed. Signing keys should be strongly protected, production deployment should require controlled authorization, and pipeline activity should be logged. Defense in depth within the delivery process helps limit the impact of any single compromise.

Question 270.

An application stores sensitive session tokens in browser-accessible storage even though client-side scripts do not require them. What security principle suggests a safer design?

1. Maximum privilege
   2. Minimize exposure of sensitive data and credentials
   3. Default allow
   4. High availability only

Correct Answer: 2. Minimize exposure of sensitive data and credentials

Explanation:

Sensitive credentials and tokens should be exposed only to the components that legitimately require them. If client-side scripts do not need access, the architecture should use mechanisms that reduce script exposure and lower the risk from client-side compromise. This reflects data minimization and least-exposure principles. The exact implementation depends on the application model and threat environment.

Question 271.

A security architect is reviewing a proposed active-active architecture across two sites. What should be verified MOST carefully?

1. Both sites use identical server colors
   2. Every administrator prefers the same interface
   3. The sites do not share hidden dependencies that could fail simultaneously
   4. Both sites have the same number of user accounts

Correct Answer: 3. The sites do not share hidden dependencies that could fail simultaneously

Explanation:

Two sites may appear independent yet depend on the same carrier, DNS service, identity provider, storage platform, certificate infrastructure, or cloud control plane. These common dependencies can defeat an active-active design during a major failure. Architects should map shared dependencies and test failover scenarios to confirm that redundancy actually provides the resilience required by the business.

Question 272.

A business wants to verify that a partner’s security posture remains acceptable after onboarding. Which governance approach is BEST?

1. Perform due diligence only before the contract begins
   2. Assume contractual language guarantees continuous compliance
   3. Stop monitoring after the first successful audit
   4. Use ongoing assurance, reporting, and periodic reassessment throughout the relationship**

Correct Answer: 4. Use ongoing assurance, reporting, and periodic reassessment throughout the relationship

Explanation:

Third-party risk changes over time as providers alter technology, personnel, subcontractors, and operational practices. Initial due diligence is important but insufficient for long-term assurance. Contracts should support ongoing reporting and assessment rights, while the organization periodically reviews whether controls continue to meet requirements. Significant incidents or changes should also trigger reassessment.

Question 273.

A security architect wants to reduce the chance that a compromised user account can initiate unusually high-risk transactions. Which design is MOST appropriate?

1. Require additional verification or approval for high-risk actions
   2. Give all users permanent high-value transaction rights
   3. Disable transaction monitoring
   4. Use only a username for authentication

Correct Answer: 1. Require additional verification or approval for high-risk actions

Explanation:

Step-up authentication, transaction signing, approval workflows, or other risk-based controls can provide additional assurance for sensitive actions. A user who is sufficiently authenticated for ordinary activity may still require stronger verification before performing a high-value transaction. This limits the damage from compromised sessions or credentials and aligns security controls with transaction risk.

Question 274.

Which metric should MOST directly drive the maximum acceptable frequency of data replication to a disaster-recovery site?

1. Recovery time objective
   2. Recovery point objective
   3. Mean time to repair
   4. Maximum number of administrators

Correct Answer: 2. Recovery point objective

Explanation:

RPO defines how much data loss the business can tolerate after an outage. A smaller RPO requires more frequent replication or backup so recovered data is sufficiently current. RTO addresses how quickly the service must be restored rather than how much data may be lost. Both metrics influence resilience design, but replication frequency is most directly tied to the RPO.

Question 275.

A security architect discovers that an application accepts authorization claims from an external identity provider without verifying their signature. What is the PRIMARY risk?

1. Authentication may take longer
   2. More logs may be generated
   3. Attackers could forge or modify claims and obtain unauthorized access
   4. Certificates may expire less often

Correct Answer: 3. Attackers could forge or modify claims and obtain unauthorized access

Explanation:

Federated identity assertions must be validated before they are trusted. Signature verification helps confirm that the assertion came from the expected identity provider and was not altered in transit. The relying application should also validate issuer, audience, timing, and other relevant conditions. Accepting unsigned or unverified claims can allow attackers to fabricate identities or privileges.

Question 276.

An organization wants to retire an old application that has several service accounts and API credentials. What should the decommissioning process include?

1. Leave credentials active in case the application returns
   2. Keep all integrations unchanged
   3. Remove the application from monitoring only
   4. Revoke credentials, remove access, address retained data, and update dependent systems**

Correct Answer: 4. Revoke credentials, remove access, address retained data, and update dependent systems

Explanation:

Secure decommissioning includes more than shutting down servers. Service accounts, API keys, certificates, trust relationships, firewall rules, data stores, backups, monitoring, and downstream integrations should be reviewed. Unused credentials and network paths can become hidden attack opportunities. Data should be retained or securely destroyed according to policy and legal requirements, and asset inventories should reflect retirement.

Question 277.

What is the MAIN reason to maintain architecture decision records for major security choices?

1. They preserve the rationale, assumptions, alternatives, and risk decisions behind the architecture
   2. They eliminate the need for future reviews
   3. They guarantee the original decision remains correct forever
   4. They replace technical documentation

Correct Answer: 1. They preserve the rationale, assumptions, alternatives, and risk decisions behind the architecture

Explanation:

Architecture decision records provide context that diagrams alone may not capture. They help future teams understand why a particular control or pattern was chosen, which alternatives were considered, and which assumptions supported the decision. When conditions change, this information makes reassessment easier. Decision records complement technical documentation and governance rather than replacing them.

Question 278.

A security architect wants to prevent sensitive workloads from running on unapproved infrastructure. Which approach is BEST?

1. Allow workloads to run anywhere as long as they start successfully
   2. Enforce workload placement and platform-attestation policies before execution
   3. Disable infrastructure inventory
   4. Trust network location alone

Correct Answer: 2. Enforce workload placement and platform-attestation policies before execution

Explanation:

Sensitive workloads may require approved hardware, managed environments, trusted images, or specific security controls. Placement policy and attestation can help verify that workloads run only on infrastructure meeting defined trust requirements. This provides stronger assurance than network location alone. The exact mechanisms vary by platform, but the architectural objective is to bind workload execution to approved conditions.

Question 279.

A business application relies on several external SaaS services. What should the security architect include in continuity planning?

1. Only internal server backups
   2. Only application source-code recovery
   3. External service dependencies, provider outages, alternative processes, and contractual recovery commitments
   4. The SaaS provider’s marketing roadmap only

Correct Answer: 3. External service dependencies, provider outages, alternative processes, and contractual recovery commitments

Explanation:

Business continuity can be disrupted by external providers even when internal systems are healthy. Architects should understand which SaaS services are critical, what outages would mean for the business, what provider recovery commitments exist, and whether alternative providers or manual procedures are available. External dependencies must be included in resilience design and business-impact analysis.

Question 280.

Which approach BEST characterizes mature security architecture governance?

1. Security decisions are made independently by each project with no enterprise oversight
   2. Exceptions never expire and require no owner
   3. Architecture is reviewed only after major failures
   4. Principles, standards, decisions, dependencies, exceptions, and risks are continuously governed and reassessed**

Correct Answer: 4. Principles, standards, decisions, dependencies, exceptions, and risks are continuously governed and reassessed

Explanation:

Mature governance treats architecture as a living enterprise discipline. Principles and standards establish direction, decision records preserve rationale, exceptions are documented and reviewed, and dependencies and risks are monitored over time. Business requirements, threats, technology, and regulation evolve, so architecture must be reassessed accordingly. Continuous governance helps prevent security design from becoming outdated or inconsistent.