View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 221.

A security architect is reviewing a new application that uses several external APIs. What should be evaluated FIRST?

1. The graphical design of each API portal
   2. Trust boundaries, data sensitivity, authentication, and permitted transactions
   3. The number of developers maintaining each API
   4. The physical location of every API server

Correct Answer: 2. Trust boundaries, data sensitivity, authentication, and permitted transactions

Explanation:

External APIs cross organizational and technical trust boundaries. The architect should first determine what data is exchanged, who is allowed to call each API, which operations are permitted, and what business impact could result from misuse. These requirements drive controls such as authentication, authorization, encryption, input validation, rate limiting, and monitoring. Cosmetic or staffing details do not provide the risk context necessary for sound architecture decisions.

Question 222.

Which design BEST limits the impact of compromise of one application service account?

1. Grant the account only the minimum permissions required for that application
   2. Give all applications the same administrator account
   3. Disable service authentication
   4. Use one shared credential for all database access

Correct Answer: 1. Grant the account only the minimum permissions required for that application

Explanation:

Least privilege limits the blast radius of account compromise. A service account should have access only to the systems, data, and operations needed for its application function. Shared or broadly privileged accounts make compromise more damaging and reduce accountability. Separate identities also allow permissions to be revoked or changed independently when applications are modified or retired.

Question 223.

A security architect wants to determine whether a design has excessive implicit trust between components. Which activity is MOST useful?

1. Capacity planning
   2. Software licensing review
   3. Threat modeling and trust-boundary analysis
   4. User-interface testing

Correct Answer: 3. Threat modeling and trust-boundary analysis

Explanation:

Threat modeling and trust-boundary analysis reveal where systems, users, applications, and external parties rely on assumptions of trust. These activities can expose unnecessary trust relationships, broad communication paths, weak authentication, or insufficient authorization. The architect can then introduce segmentation, stronger identity controls, validation, or explicit policy enforcement. Capacity and interface testing do not identify excessive trust relationships effectively.

Question 224.

A critical security service is deployed in one data center with no alternate site. What is the PRIMARY architectural concern?

1. It may generate too many logs
   2. It may require specialized administrators
   3. It may use strong encryption
   4. A site-level outage could make the service unavailable**

Correct Answer: 4. A site-level outage could make the service unavailable

Explanation:

A critical service located entirely in one site is vulnerable to facility-level failures such as power loss, fire, cooling failure, natural disaster, or major network disruption. If business requirements demand higher resilience, the architecture should consider geographic redundancy, replicated data, independent connectivity, and tested failover. Component redundancy inside the same site may not protect against a complete site outage.

Question 225.

Why should administrative interfaces use separate network paths from ordinary user traffic when practical?

1. To reduce exposure of privileged interfaces and strengthen access control
   2. To eliminate authentication requirements
   3. To remove the need for audit logs
   4. To guarantee administrators cannot make mistakes

Correct Answer: 1. To reduce exposure of privileged interfaces and strengthen access control

Explanation:

Administrative interfaces provide powerful capabilities and should not be broadly reachable from ordinary user networks. Dedicated management networks, jump hosts, or controlled access gateways can reduce attack surface and help protect privileged sessions. These measures should be combined with strong authentication, endpoint security, authorization, and protected logging. Segmentation reduces exposure but does not replace other controls.

Question 226.

An organization wants to prevent expired certificates from causing unexpected application outages. Which capability is MOST important?

1. Longer application passwords
   2. Certificate inventory, monitoring, and automated renewal
   3. Reduced logging
   4. Anonymous fallback authentication

Correct Answer: 2. Certificate inventory, monitoring, and automated renewal

Explanation:

Certificate-based systems depend on effective lifecycle management. Organizations should know which certificates exist, who owns them, when they expire, and how they are renewed. Automated renewal and expiration monitoring reduce the risk of service disruption caused by forgotten certificates. Revocation, private-key protection, and trust-anchor management are also important parts of a mature certificate architecture.

Question 227.

A security architect discovers that a build pipeline can deploy code to production without any integrity verification. What should be added?

1. Shared production passwords
   2. Direct developer access to production servers
   3. Artifact signing or integrity verification before deployment
   4. Disabled change records

Correct Answer: 3. Artifact signing or integrity verification before deployment

Explanation:

Integrity verification helps ensure that the software deployed to production is the same artifact that passed the approved build and testing process. Signing or comparable integrity controls can detect unauthorized modification between build and deployment. The deployment pipeline should also enforce access control, approvals, logging, and separation of duties. Direct production access would weaken rather than improve software assurance.

Question 228.

A business requires a transaction system to remain available if one database node fails. Which design is MOST appropriate?

1. One larger database server
   2. Daily backups only
   3. Manual rebuild after failure
   4. Redundant database nodes with tested failover**

Correct Answer: 4. Redundant database nodes with tested failover

Explanation:

High availability requires avoiding single points of failure in critical processing components. Redundant database nodes can continue serving transactions when one node fails, provided replication and failover mechanisms work correctly. Failover must be tested regularly rather than assumed. Backups remain necessary for recovery but do not provide the same immediate availability as resilient database architecture.

Question 229.

What is the MAIN security benefit of centralized secrets management?

1. It provides controlled storage, access, rotation, and auditing for sensitive credentials
   2. It eliminates authentication
   3. It allows secrets to be published in source code
   4. It removes the need for service identities

Correct Answer: 1. It provides controlled storage, access, rotation, and auditing for sensitive credentials

Explanation:

Centralized secrets management reduces the need to hard-code passwords, API keys, tokens, and other sensitive values in source code or configuration files. It can enforce access policies, provide audit trails, automate rotation, and deliver secrets only to authorized workloads. This improves credential lifecycle management and helps reduce exposure through repositories, deployment artifacts, and administrative access.

Question 230.

A security architect must decide whether a user may access sensitive data based on identity, device posture, location, and transaction type. Which access-control approach is BEST?

1. Anonymous access
   2. Attribute-based or contextual access control
   3. Shared-account access
   4. Static network-location trust only

Correct Answer: 2. Attribute-based or contextual access control

Explanation:

Attribute-based or contextual access control evaluates multiple characteristics when making authorization decisions. These may include identity, device condition, location, resource sensitivity, time, transaction value, or other contextual factors. This supports granular and adaptive authorization. Policies should still be understandable, auditable, and aligned with least privilege so complexity does not create unexpected access.

Question 231.

A critical application stores audit logs only on the same server where the application runs. What is the PRIMARY concern?

1. Logs may use too much storage
   2. Logs may contain timestamps
   3. An attacker who compromises the server may alter or delete the evidence
   4. Users may see too many alerts

Correct Answer: 3. An attacker who compromises the server may alter or delete the evidence

Explanation:

If the only audit records are stored locally, an attacker with sufficient control over the application server may be able to erase evidence of malicious activity. Forwarding security logs to a separately protected system improves integrity and accountability. Centralized logs should have restricted modification rights, synchronized timestamps, appropriate retention, and monitoring so they remain useful during investigations.

Question 232.

A highly confidential system cannot reach its centralized authorization service. Which default behavior is generally safest?

1. Grant administrator access
   2. Allow all previously known users
   3. Ignore authorization checks
   4. Deny sensitive access until authorization can be verified**

Correct Answer: 4. Deny sensitive access until authorization can be verified

Explanation:

For highly confidential resources, failure of the authorization mechanism should generally result in a protected state. Allowing access without reliable authorization can create an unintended bypass. The architecture may support carefully controlled cached policy for selected low-risk functions, but such behavior must be explicitly designed. Sensitive operations should default to denial when authorization cannot be confirmed.

Question 233.

Which activity BEST helps an architect identify common-mode failures in a resilience design?

1. Mapping dependencies and shared infrastructure across redundant components
   2. Increasing server memory
   3. Changing application colors
   4. Adding more user accounts

Correct Answer: 1. Mapping dependencies and shared infrastructure across redundant components

Explanation:

Two components may appear redundant yet still depend on the same power source, network provider, identity service, DNS platform, storage system, or data center. Mapping these dependencies helps reveal common-mode failures that could defeat apparent redundancy. Resilience architecture should seek independence across critical supporting services when business requirements justify it.

Question 234.

An organization wants its backup environment to survive compromise of production administrator credentials. Which control is MOST appropriate?

1. Use the same unrestricted administrator accounts for backup and production
   2. Separate backup administration and maintain protected immutable or isolated copies
   3. Keep every backup continuously writable from production
   4. Disable backup-access logging

Correct Answer: 2. Separate backup administration and maintain protected immutable or isolated copies

Explanation:

If production administrators can modify or delete all recovery copies, compromise of those accounts can destroy both production data and backups. Separation of duties, isolated or immutable copies, distinct credentials, and protected logging can reduce this risk. Recovery procedures should also be tested regularly to confirm that protected backups can be restored successfully.

Question 235.

A system retains highly sensitive customer records long after the business and legal retention period ends. Which security principle is MOST directly violated?

1. Defense in depth
   2. Complete mediation
   3. Data minimization and lifecycle management
   4. High availability

Correct Answer: 3. Data minimization and lifecycle management

Explanation:

Sensitive information should be retained only as long as necessary for legitimate business, legal, and regulatory requirements. Keeping data indefinitely increases the amount of information exposed in a breach and raises privacy and compliance risk. Security architecture should therefore include retention schedules, secure deletion mechanisms, ownership, and controls that enforce the complete information lifecycle.

Question 236.

A security architect is reviewing a central identity platform used by nearly every enterprise application. What should be treated as the HIGHEST resilience concern?

1. The interface color
   2. The number of user groups
   3. Password-reset page design
   4. The identity platform’s concentration risk and dependency across applications**

Correct Answer: 4. The identity platform’s concentration risk and dependency across applications

Explanation:

A centralized identity service can simplify security, but it becomes a critical shared dependency. Failure or compromise may affect access to a large portion of the enterprise. The architecture should address redundancy, secure administration, key protection, monitoring, geographic resilience where necessary, and tested recovery. Shared security services should receive resilience protections proportional to their enterprise-wide impact.

Question 237.

Which control BEST prevents unapproved code from bypassing the normal software-release process?

1. Restrict direct production access and require deployment through a controlled pipeline
   2. Share administrator accounts among developers
   3. Allow emergency changes without logging
   4. Disable code-review requirements

Correct Answer: 1. Restrict direct production access and require deployment through a controlled pipeline

Explanation:

A controlled deployment pipeline enforces approvals, testing, integrity verification, and traceability. Restricting direct production modification makes it harder to bypass these controls. Emergency procedures may still be necessary, but they should be authorized, logged, and reviewed. Shared accounts and untracked changes weaken accountability and increase the risk of unauthorized software reaching production.

Question 238.

A digital-signature system is intended to provide strong nonrepudiation. Which factor is MOST important?

1. Every user shares the same signing key
   2. Private signing keys are strongly bound to individual identities and securely protected
   3. Signing keys are stored in public repositories
   4. Transaction logging is disabled

Correct Answer: 2. Private signing keys are strongly bound to individual identities and securely protected

Explanation:

Nonrepudiation requires reliable evidence that a specific individual or entity performed a signing action. If private keys are shared, poorly protected, or not strongly linked to identities, that evidence becomes weak. Strong identity verification, secure private-key custody, trusted timestamps, signature validation, and protected audit records all contribute to meaningful nonrepudiation.

Question 239.

A legacy platform cannot meet a new enterprise security standard. What should the architect do FIRST?

1. Hide the platform from risk reporting
   2. Grant a permanent undocumented exception
   3. Assess the gap, determine the risk, and identify compensating controls or remediation
   4. Disable monitoring of the platform

Correct Answer: 3. Assess the gap, determine the risk, and identify compensating controls or remediation

Explanation:

Security exceptions should be risk-based and documented. The architect should understand exactly how the legacy platform differs from the standard, what risk that creates, and whether compensating controls can reduce the risk sufficiently. A remediation or replacement plan may also be appropriate. Permanent undocumented exceptions allow risk and technical debt to accumulate without accountability.

Question 240.

Which practice BEST supports an effective enterprise security architecture over its full lifecycle?

1. Review architecture only after incidents
   2. Keep all original assumptions permanently
   3. Permit exceptions without expiration or ownership
   4. Periodically reassess risks, dependencies, standards, exceptions, and control effectiveness**

Correct Answer: 4. Periodically reassess risks, dependencies, standards, exceptions, and control effectiveness

Explanation:

Security architecture must evolve as business objectives, threats, regulations, technologies, and dependencies change. Periodic and event-driven reviews help identify assumptions that are no longer valid and controls that no longer provide sufficient protection. Mature lifecycle management also tracks exceptions, assigns ownership, and reassesses residual risk so architecture remains aligned with the organization’s current environment.