View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 281.

A security architect is designing access to a highly sensitive analytics platform. Which approach BEST reduces standing administrative privilege?

1. Just-in-time privileged access with approval, strong authentication, and automatic expiration
   2. Permanent global administrator rights for all support staff
   3. Shared administrator accounts
   4. Unrestricted access from any managed workstation

Correct Answer: 1. Just-in-time privileged access with approval, strong authentication, and automatic expiration

Explanation:

Just-in-time access limits privileged permissions to the period in which they are actually needed. Requiring approval and strong authentication adds further assurance, while automatic expiration prevents privileges from remaining active indefinitely. Permanent administrative assignments increase the attack surface and the consequences of credential compromise. Shared accounts also weaken accountability because actions cannot be reliably attributed to a specific administrator.

Question 282.

A business application relies on a centralized identity provider. Which design BEST reduces the availability risk created by this dependency?

1. Disable authentication during outages
   2. Implement resilient identity services with tested failover and defined degraded-mode behavior
   3. Allow permanent anonymous access
   4. Store user passwords inside every application

Correct Answer: 2. Implement resilient identity services with tested failover and defined degraded-mode behavior

Explanation:

A centralized identity provider can become a critical shared dependency for many applications. Redundant components and tested failover reduce the risk of authentication outages, while clearly defined degraded-mode behavior ensures applications respond predictably if the service becomes unavailable. Bypassing authentication during failures would introduce serious risk. Resilience should preserve appropriate security rather than trading away identity verification.

Question 283.

A security architect is reviewing an internal API that trusts every request from the corporate network. What is the MAIN concern?

1. API responses may be too large
   2. The API may generate too many logs
   3. Network location is being treated as sufficient proof of trust
   4. Developers may need additional training

Correct Answer: 3. Network location is being treated as sufficient proof of trust

Explanation:

Internal networks can be compromised through phishing, malware, stolen credentials, or vulnerable systems. Trusting requests solely because they originate from an internal network creates excessive implicit trust. A stronger design verifies identity, authorization, and other relevant context for each request. This aligns with Zero Trust principles and reduces the risk that an attacker who reaches the internal network gains broad access automatically.

Question 284.

A critical application uses one hardware security module for every cryptographic function. What is the PRIMARY architectural risk?

1. The HSM may create too many audit records
   2. Administrators may need specialized training
   3. Cryptographic operations may consume processor resources
   4. The HSM may become a single point of failure**

Correct Answer: 4. The HSM may become a single point of failure

Explanation:

If authentication, signing, encryption, or key management all depend on one HSM, failure of that device could affect multiple critical functions. The architecture should consider secure redundancy, protected key synchronization, backup, and tested failover. Availability improvements must preserve the confidentiality and integrity of key material. A resilient design should avoid compromising cryptographic security merely to provide redundancy.

Question 285.

Which security architecture principle BEST supports removing unnecessary services and interfaces from a system?

1. Minimize attack surface
   2. Maximum privilege
   3. Default allow
   4. Open access

Correct Answer: 1. Minimize attack surface

Explanation:

Every unnecessary service, port, interface, account, and feature creates another potential attack path. Removing or disabling functionality that is not required reduces opportunities for exploitation and simplifies security monitoring. Required services should still be configured securely and restricted to authorized users and systems. Attack-surface reduction is a foundational hardening and architecture principle.

Question 286.

An organization is implementing federation with an external partner. What should be defined MOST clearly?

1. The partner’s office layout
   2. Trust scope, assurance requirements, claims, authorization mappings, and trust termination procedures
   3. The number of developers at the partner
   4. The graphical appearance of the login page

Correct Answer: 2. Trust scope, assurance requirements, claims, authorization mappings, and trust termination procedures

Explanation:

Federation extends identity trust across organizational boundaries. The architecture should define which identities are trusted, what authentication assurance is acceptable, which claims may be exchanged, how claims map to permissions, and how the trust relationship can be revoked. Certificates, keys, monitoring, and incident procedures should also be governed. Ambiguous trust relationships can easily result in excessive or unintended access.

Question 287.

A security architect discovers that software packages are downloaded directly from public repositories during production builds. Which control would BEST reduce supply-chain risk?

1. Disable build logging
   2. Allow developers to use any package source
   3. Use approved repositories with integrity, provenance, and vulnerability verification
   4. Store signing keys in the build script

Correct Answer: 3. Use approved repositories with integrity, provenance, and vulnerability verification

Explanation:

Public software repositories can contain compromised, malicious, or vulnerable packages. Approved internal or controlled repositories can enforce integrity checking, provenance, dependency review, and vulnerability scanning before packages are used in production builds. Software-supply-chain controls should also protect the build pipeline itself. Storing signing keys directly in scripts would introduce another serious weakness.

Question 288.

A business requires a service to remain available after failure of an entire cloud region. Which design BEST meets the requirement?

1. Deploy multiple instances in one availability zone
   2. Store backups only in the primary region
   3. Increase the number of virtual machines in the same region
   4. Use geographically separate regional capacity with replicated data and tested failover**

Correct Answer: 4. Use geographically separate regional capacity with replicated data and tested failover

Explanation:

Regional resilience requires infrastructure outside the affected region. Multiple instances within one region may protect against individual server or zone failures but may not survive a regional outage. Multi-region processing, data replication, independent networking, and tested failover can provide stronger resilience. The design should be based on business RTO and RPO requirements and should account for shared dependencies.

Question 289.

Why should highly privileged administrator sessions be recorded or strongly audited?

1. To improve accountability and support investigation of sensitive actions
   2. To eliminate the need for authentication
   3. To allow administrators to share accounts safely
   4. To guarantee no unauthorized action can occur

Correct Answer: 1. To improve accountability and support investigation of sensitive actions

Explanation:

Privileged users can make high-impact changes, so their activity should be attributable and reviewable. Session recording or detailed auditing can support investigations, deter misuse, and help verify that administrative actions followed policy. These controls should be protected from tampering. Auditing complements rather than replaces strong authentication, authorization, and separation of duties.

Question 290.

A security architect needs to ensure that only approved devices access a sensitive SaaS application. Which control is MOST appropriate?

1. Shared passwords
   2. Device posture assessment integrated with access policy
   3. Anonymous access from internal networks
   4. Static IP filtering only

Correct Answer: 2. Device posture assessment integrated with access policy

Explanation:

Device posture checks can determine whether an endpoint is managed, encrypted, patched, protected by endpoint controls, or otherwise compliant with enterprise requirements. Integrating this information with access policy enables conditional authorization based on both user identity and device trust. Static network location alone provides weaker assurance because compromised or unmanaged devices may still connect from approved networks.

Question 291.

A production system accepts configuration updates from an automated management platform. What is MOST important to protect?

1. The system’s screen resolution
   2. The management platform’s user-interface theme
   3. Integrity and authentication of management commands and configuration sources
   4. The number of configuration files

Correct Answer: 3. Integrity and authentication of management commands and configuration sources

Explanation:

An automated management platform can make large-scale changes, so compromise of its commands or configuration sources can affect many systems at once. Strong authentication, authorization, integrity verification, protected communication, and logging are essential. The architecture should also restrict who may alter management policies and should provide rollback or recovery options for harmful changes.

Question 292.

A security architect finds that a failover environment has never been tested. What is the MAIN concern?

1. Testing might generate audit logs
   2. The environment may use different hardware
   3. Users may be unfamiliar with the secondary site
   4. The organization does not know whether the recovery design will work when needed**

Correct Answer: 4. The organization does not know whether the recovery design will work when needed

Explanation:

Redundant infrastructure provides little assurance if failover has never been exercised. Configuration drift, missing dependencies, access issues, data-replication problems, or procedural gaps may prevent successful recovery. Testing validates both technical capability and operational procedures. Recovery exercises should be designed around defined RTO and RPO requirements and should include critical supporting dependencies.

Question 293.

Which action BEST supports secure retirement of an application that used external API keys and certificates?

1. Revoke credentials, remove trust relationships, address retained data, and update dependent systems
   2. Leave all credentials active indefinitely
   3. Keep unused firewall rules for convenience
   4. Stop monitoring without changing access**

Correct Answer: 1. Revoke credentials, remove trust relationships, address retained data, and update dependent systems

Explanation:

Decommissioning must include the security artifacts associated with the application. API keys, certificates, service accounts, firewall rules, trust relationships, and stored data should all be reviewed. Unused credentials and network paths can become hidden attack opportunities. The asset inventory and dependent systems should also be updated so that retired applications no longer influence active operations.

Question 294.

A security architect is deciding how frequently to rotate a sensitive cryptographic key. What should drive the decision MOST?

1. The user’s preferred schedule
   2. Key purpose, exposure risk, cryptoperiod requirements, and operational impact
   3. The number of administrators
   4. The physical size of the key-management server

Correct Answer: 2. Key purpose, exposure risk, cryptoperiod requirements, and operational impact

Explanation:

Key rotation should be based on risk and cryptographic policy rather than an arbitrary schedule. The architect should consider how the key is used, the sensitivity and volume of protected data, likelihood of exposure, regulatory requirements, and the operational complexity of rotation. Different keys may justify different cryptoperiods. Rotation must also be supported by reliable deployment and recovery procedures.

Question 295.

A business wants stronger assurance for wire transfers above a defined amount. Which control is MOST appropriate?

1. Allow every authenticated user to approve high-value transfers
   2. Disable transaction monitoring
   3. Require step-up authentication or independent approval for high-risk transactions
   4. Use shorter session timeouts only

Correct Answer: 3. Require step-up authentication or independent approval for high-risk transactions

Explanation:

High-value transactions justify stronger controls than routine activity. Step-up authentication can require additional proof of identity, while independent approval can apply separation of duties or dual control. These mechanisms reduce the chance that a stolen session or single compromised account can authorize a major transfer. Transaction risk should influence authentication and authorization strength.

Question 296.

A centralized security service is unavailable, but an application has cached policy information. What should determine whether cached policy may be used?

1. The color of the application interface
   2. The number of active users
   3. The administrator’s personal preference
   4. Data sensitivity, policy age, operation risk, and defined fail-secure requirements**

Correct Answer: 4. Data sensitivity, policy age, operation risk, and defined fail-secure requirements

Explanation:

Cached policy may improve availability, but it can become stale after permissions change or are revoked. The architecture should explicitly define how long cached decisions remain valid and which operations may rely on them. Highly sensitive actions may require current authorization and should fail securely if verification is unavailable. Lower-risk operations may tolerate limited cached policy under documented conditions.

Question 297.

What is the MAIN benefit of maintaining accurate architecture dependency diagrams?

1. They help identify shared services, trust boundaries, cascading risks, and resilience requirements
   2. They eliminate the need for testing
   3. They guarantee no system will fail
   4. They replace configuration management

Correct Answer: 1. They help identify shared services, trust boundaries, cascading risks, and resilience requirements

Explanation:

Dependency diagrams show how applications rely on networks, identity systems, databases, DNS, certificate services, key management, and external providers. This helps architects identify concentration risk, hidden single points of failure, and potential cascading impact. Diagrams also support change planning and incident analysis. They should be maintained as the environment evolves so that architectural decisions remain based on current information.

Question 298.

An organization wants to ensure that only authorized software images can run in a sensitive computing environment. Which control is BEST?

1. Allow arbitrary images if they start successfully
   2. Require signed, approved images and verify integrity before execution
   3. Disable image inventory
   4. Trust any image stored on an internal server

Correct Answer: 2. Require signed, approved images and verify integrity before execution

Explanation:

Image signing and integrity verification provide assurance that workloads originate from an approved build process and have not been tampered with. The architecture should also control who can sign images, protect signing keys, and maintain trusted repositories. Internal storage location alone does not establish software trust. Integrity controls reduce the risk of unauthorized or modified workloads running in sensitive environments.

Question 299.

A security architect discovers that two supposedly independent recovery sites depend on the same DNS provider. What is the MAIN issue?

1. DNS may use too much bandwidth
   2. The sites may have different IP ranges
   3. The shared DNS provider creates a common-mode failure risk
   4. Both sites may generate identical logs

Correct Answer: 3. The shared DNS provider creates a common-mode failure risk

Explanation:

Recovery sites can appear independent while sharing critical external dependencies. If both depend on one DNS provider, a provider outage or compromise may affect both sites simultaneously and defeat the resilience strategy. Architects should identify shared dependencies and determine whether diversification, alternate resolution mechanisms, or other contingency measures are required based on business continuity objectives.

Question 300.

Which approach BEST reflects mature enterprise security architecture practice?

1. Treat every approved design as permanent
   2. Permit undocumented exceptions indefinitely
   3. Review architecture only after incidents
   4. Continuously govern standards, decisions, dependencies, exceptions, risks, and architecture effectiveness**

Correct Answer: 4. Continuously govern standards, decisions, dependencies, exceptions, risks, and architecture effectiveness

Explanation:

Security architecture must adapt as business processes, technologies, regulations, external dependencies, and threats evolve. Mature practice includes maintaining standards, documenting design decisions, governing exceptions, reviewing shared dependencies, tracking residual risk, and measuring whether controls continue to meet requirements. Continuous governance keeps architecture aligned with the organization’s current risk environment instead of allowing past assumptions to remain unchallenged.