View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 341.

A security architect is designing a new multi-tenant application. Which architectural concern should be addressed MOST carefully?

1. Tenant isolation and prevention of unauthorized cross-tenant access
   2. The color scheme selected by each tenant
   3. The number of developers assigned to the project
   4. The physical size of the database servers

Correct Answer: 1. Tenant isolation and prevention of unauthorized cross-tenant access

Explanation:

Multi-tenant systems must ensure that one tenant cannot access another tenant’s data, identities, or administrative functions. Strong logical isolation, authorization, data partitioning, encryption, and monitoring may all contribute to this objective. The architect should also examine shared infrastructure and management planes for cross-tenant attack paths. Cosmetic and staffing factors do not address the central security risk created by shared application infrastructure.

Question 342.

An organization wants to reduce exposure from long-lived cloud API credentials. Which design is BEST?

1. Store permanent keys in source code
   2. Use short-lived credentials issued through workload identity mechanisms
   3. Share one API key across all applications
   4. Disable API authentication

Correct Answer: 2. Use short-lived credentials issued through workload identity mechanisms

Explanation:

Short-lived credentials reduce the useful lifetime of stolen authentication material and can eliminate the need to distribute permanent secrets to applications. Workload identity mechanisms can issue credentials dynamically based on an authenticated service identity. The resulting permissions should still be narrowly scoped according to least privilege. Long-lived shared keys create greater exposure and are more difficult to rotate safely.

Question 343.

A security architect wants to understand how compromise of a shared message broker could affect the enterprise. Which activity is MOST useful?

1. Reviewing interface colors
   2. Counting broker administrator accounts only
   3. Mapping application dependencies on the shared broker
   4. Increasing broker storage capacity

Correct Answer: 3. Mapping application dependencies on the shared broker

Explanation:

Dependency mapping shows which business applications rely on the message broker and helps the architect understand potential cascading impact from failure or compromise. Shared middleware can create concentration risk even when individual applications appear independently resilient. Understanding dependencies supports resilience planning, segmentation, access control, incident response, and prioritization of security investment.

Question 344.

A highly sensitive application depends on a centralized authorization service. Which design is MOST appropriate if the authorization service becomes unavailable?

1. Automatically grant all requested access
   2. Permit administrator access without verification
   3. Disable authentication temporarily
   4. Follow predefined fail-secure behavior for sensitive operations**

Correct Answer: 4. Follow predefined fail-secure behavior for sensitive operations

Explanation:

Authorization-service failure should not become an automatic path to unauthorized access. For sensitive operations, the safest design normally denies access until policy can be verified. Carefully controlled cached authorization may be acceptable for selected lower-risk functions, but this behavior must be explicitly designed. The architecture should balance availability requirements with the confidentiality and integrity impact of stale or unavailable authorization.

Question 345.

Why should security architects identify where administrative privileges are permanently assigned?

1. Standing privilege increases the window in which compromised accounts can be abused
   2. Permanent privileges always improve productivity
   3. Standing privilege eliminates the need for authentication
   4. Privileged accounts cannot be compromised

Correct Answer: 1. Standing privilege increases the window in which compromised accounts can be abused

Explanation:

Permanent privileged access remains available even when the administrator is not actively performing sensitive work. This creates a larger opportunity for attackers who compromise the account. Just-in-time privilege, approval workflows, dedicated administrative identities, and automatic expiration can reduce this exposure. Privileged access should be assigned only when required and monitored closely.

Question 346.

An enterprise is designing an encrypted data archive that must be retained for many years. Which cryptographic concern is MOST important?

1. The graphical design of the archive interface
   2. Long-term key lifecycle, algorithm suitability, and recoverability
   3. The number of archive administrators only
   4. Whether the archive uses compression

Correct Answer: 2. Long-term key lifecycle, algorithm suitability, and recoverability

Explanation:

Long-term archives may outlive individual encryption keys, cryptographic algorithms, products, and administrators. The architecture should therefore address secure key retention, escrow or recovery where appropriate, rotation, migration to stronger algorithms, and destruction when retention ends. Data that remains encrypted but whose keys are lost may become permanently unavailable, while obsolete algorithms may eventually provide insufficient protection.

Question 347.

A development team wants direct administrative access to production databases for troubleshooting. What is the BEST architectural response?

1. Grant permanent administrator access to all developers
   2. Share the database administrator password
   3. Provide controlled, time-limited privileged access with auditing when justified
   4. Disable database logging during troubleshooting

Correct Answer: 3. Provide controlled, time-limited privileged access with auditing when justified

Explanation:

Troubleshooting may occasionally require privileged production access, but that does not justify permanent broad permissions. A controlled process can grant temporary access after appropriate approval and strong authentication, then remove it automatically. Detailed logging or session monitoring supports accountability. This balances operational needs with least privilege and separation between development and production environments.

Question 348.

A company operates two disaster-recovery sites, but both depend on the same cloud-based DNS provider. What should the architect recognize?

1. DNS cannot affect disaster recovery
   2. The sites are fully independent because they are geographically separated
   3. The provider automatically guarantees availability
   4. The shared DNS dependency creates a common-mode failure risk**

Correct Answer: 4. The shared DNS dependency creates a common-mode failure risk

Explanation:

Geographically separate sites may still fail together if they depend on the same critical external service. A DNS-provider outage or compromise could prevent users or systems from reaching either recovery site. Architects should evaluate shared dependencies such as DNS, network carriers, identity providers, certificate services, and cloud control planes when determining whether redundancy is genuinely independent.

Question 349.

Which approach BEST protects sensitive administrative actions performed through a web management console?

1. Strong authentication, restricted network access, session controls, and protected audit logging
   2. Anonymous access from the corporate network
   3. A hidden URL with no additional controls
   4. Shared administrator credentials

Correct Answer: 1. Strong authentication, restricted network access, session controls, and protected audit logging

Explanation:

Administrative consoles are high-value targets because they can provide extensive control over systems and data. Strong authentication, limited reachability, session protection, authorization, and independent logging reduce exposure and improve accountability. A hidden URL is not a meaningful security control, while shared credentials make it difficult to attribute administrative actions to a specific person.

Question 350.

An organization wants to ensure that authorization policies are applied consistently across many applications. Which architecture is MOST appropriate?

1. Let every application define unrelated access rules with no governance
   2. Establish centralized policy governance with consistent enforcement mechanisms
   3. Remove authorization from internal applications
   4. Use network location as the only access criterion

Correct Answer: 2. Establish centralized policy governance with consistent enforcement mechanisms

Explanation:

Centralized policy governance can promote consistent access decisions, reduce duplicated logic, and simplify updates across applications. Enforcement may occur centrally or through distributed policy enforcement points, but rules should be governed consistently. Availability and performance requirements must also be considered so the policy architecture does not create an unacceptable single point of failure.

Question 351.

A security architect discovers that production containers are built from unverified public images. What is the MAIN risk?

1. The images may be larger than necessary
   2. Developers may use different naming conventions
   3. Malicious or vulnerable components may enter the production supply chain
   4. Container logs may increase

Correct Answer: 3. Malicious or vulnerable components may enter the production supply chain

Explanation:

Unverified container images can contain known vulnerabilities, malicious software, outdated dependencies, or unauthorized modifications. Secure architecture should use approved registries, signed or integrity-verified images, vulnerability scanning, provenance information, and controlled build processes. Trust should be established through verifiable controls rather than assuming that an image is safe because it is publicly available.

Question 352.

A business requires a critical system to recover within two hours and tolerate no more than ten minutes of data loss. Which statement is correct?

1. RTO is ten minutes and RPO is two hours
   2. Both RTO and RPO are two hours
   3. Both RTO and RPO are ten minutes
   4. RTO is two hours and RPO is ten minutes**

Correct Answer: 4. RTO is two hours and RPO is ten minutes

Explanation:

The recovery time objective defines how quickly the system must be restored, so the RTO is two hours. The recovery point objective defines the maximum acceptable data loss measured in time, so the RPO is ten minutes. These requirements influence standby capacity, automation, replication, backup frequency, and recovery procedures. Both should be validated through realistic recovery testing.

Question 353.

What is the PRIMARY reason to protect architecture diagrams that show internal trust boundaries and privileged management paths?

1. They may reveal sensitive information useful for planning attacks
   2. Diagrams cannot be shared with administrators
   3. Security architecture should always remain secret to function
   4. Diagrams replace access controls

Correct Answer: 1. They may reveal sensitive information useful for planning attacks

Explanation:

Architecture diagrams can contain detailed information about management networks, trust relationships, critical systems, and security controls. They should therefore be classified and shared according to legitimate need. However, the security of the architecture should not depend solely on keeping the design secret. Strong controls must remain effective even if an attacker learns significant details about the system.

Question 354.

A security architect is designing workload access to a cloud database. Which control BEST supports least privilege?

1. Give every workload the database administrator role
   2. Grant each workload only the specific database permissions it requires
   3. Disable database authorization
   4. Share one unrestricted service account

Correct Answer: 2. Grant each workload only the specific database permissions it requires

Explanation:

Workload permissions should correspond to legitimate application functions. A reporting service may need read access, while a transaction service may require limited write operations. Giving every workload administrator rights unnecessarily increases the impact of compromise. Separate identities and narrowly scoped permissions also improve accountability and make access easier to revoke or modify independently.

Question 355.

A security architect learns that a critical third-party provider can terminate service with little notice. What is the MOST important response?

1. Ignore the contractual risk because the provider is reputable
   2. Increase internal server capacity only
   3. Develop an exit strategy, data-portability plan, and alternative business process
   4. Disable third-party monitoring

Correct Answer: 3. Develop an exit strategy, data-portability plan, and alternative business process

Explanation:

Third-party dependency risk includes more than security incidents and outages. Provider termination, financial failure, strategic change, or contract disputes can also disrupt operations. An exit strategy should address data retrieval, migration, replacement services, authentication dependencies, and continuity procedures. Planning before a crisis reduces concentration risk and supports business resilience.

Question 356.

An organization uses cached credentials to maintain service during an identity outage. What is the PRIMARY security risk?

1. Cached credentials always improve confidentiality
   2. Caching eliminates the need for identity management
   3. Cached data cannot be compromised
   4. Revoked or changed access may remain usable until the cache expires**

Correct Answer: 4. Revoked or changed access may remain usable until the cache expires

Explanation:

Credential or authorization caching can improve availability, but it creates a window in which stale access decisions remain effective. If an account is disabled or permissions are revoked, a disconnected system may continue allowing access based on cached information. The architecture should define cache lifetime, invalidation behavior, protected storage, and which operations require current verification.

Question 357.

Why should a security architect document assumptions behind a major architecture decision?

1. Assumptions can later be reassessed when business or technical conditions change
   2. Assumptions never change once documented
   3. Documentation eliminates future architecture reviews
   4. Assumptions replace security requirements

Correct Answer: 1. Assumptions can later be reassessed when business or technical conditions change

Explanation:

Architecture decisions often depend on assumptions about threats, data sensitivity, availability, technology, cost, and external services. Over time, those assumptions may no longer be valid. Documenting them makes future reassessment easier and helps new architects understand why a design was chosen. Decision records support lifecycle governance rather than freezing architecture permanently.

Question 358.

A security architect wants to reduce the risk of unauthorized changes to cloud infrastructure. Which approach is BEST?

1. Permit direct console changes by all developers
   2. Use controlled infrastructure-as-code deployment with review, integrity, and audit controls
   3. Disable cloud audit logs
   4. Share one administrator account across teams

Correct Answer: 2. Use controlled infrastructure-as-code deployment with review, integrity, and audit controls

Explanation:

Infrastructure as code can make cloud configuration changes repeatable, reviewable, and traceable. A controlled pipeline can enforce peer review, testing, approval, and integrity checks before deployment. Direct console changes should be restricted or reconciled to prevent configuration drift. The pipeline and its credentials are themselves critical security assets and should be strongly protected.

Question 359.

A high-value transaction system requires evidence that an approved transaction was not altered after authorization. Which control is MOST appropriate?

1. Data compression
   2. Increased storage redundancy
   3. Cryptographic integrity protection and protected transaction audit records
   4. Anonymous transaction submission

Correct Answer: 3. Cryptographic integrity protection and protected transaction audit records

Explanation:

Integrity controls help detect unauthorized modification of transaction data after approval. Digital signatures, message authentication codes, or comparable cryptographic mechanisms can protect transaction contents, while protected audit records provide evidence of the approval and processing sequence. Identity assurance and key protection are also important when signatures are used to establish accountability or nonrepudiation.

Question 360.

Which practice BEST reflects mature enterprise security architecture governance?

1. Approve designs once and never revisit them
   2. Allow undocumented security exceptions indefinitely
   3. Review architecture only after major incidents
   4. Continuously govern architecture decisions, dependencies, standards, risks, exceptions, and control effectiveness**

Correct Answer: 4. Continuously govern architecture decisions, dependencies, standards, risks, exceptions, and control effectiveness

Explanation:

Enterprise security architecture must evolve with changing threats, regulations, business priorities, technologies, and dependencies. Mature governance maintains principles and standards, records important decisions, manages exceptions, tracks residual risk, and reassesses control effectiveness. Continuous review prevents outdated assumptions or temporary exceptions from becoming permanent weaknesses and keeps the architecture aligned with current organizational needs.