View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 321.

A security architect is reviewing a design that allows administrators to approve their own high-risk production changes. What is the BEST corrective action?

1. Increase administrator privileges
   2. Introduce independent approval through separation of duties
   3. Disable change logging
   4. Allow emergency changes without review

Correct Answer: 2. Introduce independent approval through separation of duties

Explanation:

Separation of duties reduces the risk that one individual can initiate and approve a sensitive action without oversight. High-risk production changes should normally involve independent review or approval, especially when they affect critical security controls. This approach helps reduce fraud, mistakes, and misuse of privilege. Logging should remain enabled so the organization can verify who requested, approved, and implemented each change.

Question 322.

A security architect is assessing a new internet-facing application. Which activity should occur FIRST?

1. Identify assets, trust boundaries, threats, and security requirements
   2. Purchase the firewall appliance
   3. Configure production user accounts
   4. Perform post-deployment penetration testing

Correct Answer: 1. Identify assets, trust boundaries, threats, and security requirements

Explanation:

Architecture should begin with understanding what needs protection and why. Identifying assets, data flows, trust boundaries, threats, business requirements, and risk helps determine the necessary security controls. Selecting technology before defining these requirements may result in gaps or unnecessary complexity. Penetration testing is valuable later, but it does not replace design-time security analysis.

Question 323.

A critical application relies on one centralized secrets-management platform. What should the architect evaluate MOST carefully?

1. The appearance of the secrets-management console
   2. The number of application developers
   3. Resilience, administrative protection, and recovery of the secrets platform
   4. The length of secret names

Correct Answer: 3. Resilience, administrative protection, and recovery of the secrets platform

Explanation:

A centralized secrets platform may become a critical dependency for many applications. An outage can prevent workloads from accessing credentials, while compromise may expose sensitive secrets across the enterprise. The architecture should therefore address redundancy, access control, auditing, backup, recovery, and privileged administration. Critical shared services require strong protection against both availability failures and security compromise.

Question 324.

A service must deny unauthorized access even when its policy database is unavailable. Which design principle is MOST applicable?

1. Default allow
   2. Shared authentication
   3. Open access
   4. Fail-secure behavior**

Correct Answer: 4. Fail-secure behavior

Explanation:

Fail-secure design ensures that a security-control failure does not automatically grant access. If the policy database cannot be reached, the system should move toward a protected state, especially for sensitive operations. Some low-risk functions may use carefully controlled cached policy if explicitly designed, but the default should not become unrestricted access. This approach reflects fail-safe security principles.

Question 325.

What is the MAIN security benefit of separating application tiers into different network zones?

1. It limits unnecessary communication and reduces lateral movement
   2. It eliminates authentication requirements
   3. It guarantees confidentiality automatically
   4. It removes the need for host security controls

Correct Answer: 1. It limits unnecessary communication and reduces lateral movement

Explanation:

Segmentation allows the architect to enforce which systems may communicate and through which protocols. If one tier is compromised, properly configured boundaries can limit the attacker’s ability to move to application, database, or administrative systems. Segmentation should be combined with identity, authorization, endpoint security, and monitoring. It is an important defense-in-depth control rather than a complete security solution by itself.

Question 326.

A company wants to use certificates for service-to-service authentication. Which capability is MOST important for long-term reliability?

1. Manually tracking certificates in spreadsheets
   2. Automated certificate issuance, renewal, revocation, and inventory management
   3. Using certificates with no expiration
   4. Sharing private keys between services

Correct Answer: 2. Automated certificate issuance, renewal, revocation, and inventory management

Explanation:

Large-scale certificate use requires effective lifecycle management. Automated issuance and renewal reduce outage risk, while inventory and revocation capabilities help respond to compromise and retirement. Private keys should remain protected and should not be shared unnecessarily. Certificates with unlimited validity would increase exposure and make lifecycle governance more difficult.

Question 327.

A security architect wants to ensure that a compromised build server cannot immediately deploy malicious software to production. Which design is BEST?

1. Give the build server unrestricted production administrator access
   2. Store deployment credentials in build scripts
   3. Separate build, signing, approval, and deployment privileges
   4. Disable deployment logs

Correct Answer: 3. Separate build, signing, approval, and deployment privileges

Explanation:

Separating responsibilities creates multiple control points in the software-delivery process. Compromise of the build server should not automatically provide signing authority or production deployment capability. Independent approvals, protected signing keys, artifact integrity verification, and controlled deployment reduce supply-chain risk. This is an application of defense in depth and separation of duties.

Question 328.

An enterprise has redundant data centers, but both depend on the same power utility substation. What architectural issue exists?

1. Too many backup systems
   2. Excessive encryption
   3. Too much network segmentation
   4. A common-mode failure risk**

Correct Answer: 4. A common-mode failure risk

Explanation:

Redundancy is effective only when supposedly independent components do not share critical failure points. Two data centers that rely on the same power infrastructure may fail simultaneously during a utility disruption. Architects should identify shared power, network, DNS, identity, storage, and provider dependencies when evaluating resilience. Hidden common dependencies can undermine otherwise strong recovery designs.

Question 329.

Why should privileged service accounts be reviewed periodically?

1. To confirm that permissions still reflect current business and technical requirements
   2. To ensure privileges always increase over time
   3. To eliminate logging
   4. To make credentials permanent

Correct Answer: 1. To confirm that permissions still reflect current business and technical requirements

Explanation:

Service accounts can accumulate unnecessary permissions as applications evolve. Periodic review helps ensure that access remains aligned with current requirements and that obsolete privileges are removed. This supports least privilege and reduces the potential impact of credential compromise. The review should also consider account ownership, credential rotation, usage, and whether the account is still required.

Question 330.

A security architect is designing an external partner portal. What should be MOST important when defining federation access?

1. Allowing every partner the same permissions
   2. Mapping trusted identity claims to narrowly scoped authorization
   3. Disabling assertion validation
   4. Trusting all requests from partner networks

Correct Answer: 2. Mapping trusted identity claims to narrowly scoped authorization

Explanation:

Federation proves or communicates identity attributes, but authorization still determines what the partner may access. Trusted claims should be validated and mapped to the minimum permissions required for the partner’s role. Network origin alone should not imply trust. The architecture should also define assurance levels, key or certificate management, logging, and procedures for terminating the federation relationship.

Question 331.

An application receives signed software updates from a vendor. What should the application verify before installation?

1. Only the file name
   2. Only the download size
   3. Signature validity, trusted signer, and package integrity
   4. The vendor’s marketing website

Correct Answer: 3. Signature validity, trusted signer, and package integrity

Explanation:

Signed updates are useful only if the system verifies the signature against a trusted signer and confirms package integrity. This helps detect tampering and unauthorized packages. The architecture should also address trusted-key distribution, certificate or key revocation, and secure update transport. File names and sizes do not provide meaningful assurance that software is legitimate.

Question 332.

A system must restore service within 45 minutes after a disaster. Which metric defines this requirement?

1. Recovery point objective
   2. Mean time between failures
   3. Data-retention period
   4. Recovery time objective**

Correct Answer: 4. Recovery time objective

Explanation:

RTO defines how quickly a service must be restored after disruption. A 45-minute target therefore represents the recovery time objective. RPO addresses the amount of data loss the business can tolerate. Architects use both metrics to determine suitable standby capacity, replication, backup, automation, and recovery procedures.

Question 333.

What is the MAIN security reason for restricting direct database access by end users?

1. It allows application-layer controls to mediate and limit data operations
   2. It guarantees database availability
   3. It eliminates encryption requirements
   4. It prevents all application vulnerabilities

Correct Answer: 1. It allows application-layer controls to mediate and limit data operations

Explanation:

Applications can enforce business logic, validation, authorization, and logging before requests reach sensitive databases. Broad direct access may bypass those controls and expose data or administrative functions unnecessarily. Database permissions should also be scoped according to least privilege. Restricting direct access reduces attack surface and helps preserve separation between user interaction and backend data management.

Question 334.

A third-party provider processes sensitive customer information. Which contractual requirement is MOST important for incident response?

1. The provider’s branding guidelines
   2. Defined security-incident notification obligations and timelines
   3. The number of provider employees
   4. The location of the provider’s sales team

Correct Answer: 2. Defined security-incident notification obligations and timelines

Explanation:

The organization needs timely information when a provider experiences a security incident that may affect its data or services. Contracts should define what constitutes a reportable incident, how quickly notification must occur, required information, cooperation expectations, and responsibilities during investigation and recovery. Without explicit terms, delays or ambiguity can impair the organization’s own response obligations.

Question 335.

A security architect discovers that a legacy system stores passwords using obsolete cryptographic protection. What should be done FIRST?

1. Ignore the issue because the system is legacy
   2. Disable all monitoring
   3. Assess the exposure and define remediation or compensating controls
   4. Publish the passwords for easier recovery

Correct Answer: 3. Assess the exposure and define remediation or compensating controls

Explanation:

Legacy weaknesses should be addressed through documented risk analysis. The architect should understand the sensitivity of the accounts, exposure of the credential store, available upgrade options, and compensating controls such as stronger upstream authentication, network isolation, or restricted access. A modernization or replacement plan may be required if residual risk remains unacceptable.

Question 336.

A security architect is designing local authorization caching for a distributed application. What is the MOST important security concern?

1. Cache files may use disk space
   2. The application may start more quickly
   3. Users may prefer cached access
   4. Cached permissions may remain valid after access has been revoked**

Correct Answer: 4. Cached permissions may remain valid after access has been revoked

Explanation:

Authorization caching improves resilience and performance, but stale policy can create security risk. If a user’s access is revoked centrally, a distributed service may continue honoring an old cached decision. The architecture should define cache lifetime, invalidation behavior, high-risk operations that require current authorization, and fail-secure behavior when the central service is unavailable.

Question 337.

Why is it important to identify dependencies on DNS, identity, and certificate services during architecture design?

1. Failure of shared services can disrupt otherwise healthy applications
   2. Shared services should never be used
   3. These services eliminate the need for recovery planning
   4. Applications cannot operate with centralized services

Correct Answer: 1. Failure of shared services can disrupt otherwise healthy applications

Explanation:

Applications often depend on shared infrastructure that is not obvious from the primary application diagram. DNS, identity, certificate validation, key management, and networking can all become critical points of failure. Identifying these dependencies helps architects evaluate concentration risk, redundancy, recovery requirements, and cascading impact. Resilience planning should encompass supporting services as well as application servers.

Question 338.

A company wants to prevent unmanaged endpoints from accessing a sensitive application even when the user’s password is correct. Which approach is BEST?

1. Trust all internal IP addresses
   2. Combine user authentication with device posture or device identity requirements
   3. Disable endpoint security checks
   4. Allow access from any browser

Correct Answer: 2. Combine user authentication with device posture or device identity requirements

Explanation:

User identity alone may not provide enough assurance for highly sensitive applications. Device posture or device identity can confirm that the endpoint is managed, patched, encrypted, or otherwise compliant. Combining these signals supports contextual access control and Zero Trust principles. Network location should not be treated as sufficient proof that an endpoint is trustworthy.

Question 339.

A security architecture exception has remained open for several years without reassessment. What is the MAIN governance concern?

1. The documentation may be too detailed
   2. The exception may generate too many reports
   3. The original risk assumptions and compensating controls may no longer be valid
   4. The system may have too many owners

Correct Answer: 3. The original risk assumptions and compensating controls may no longer be valid

Explanation:

Exceptions should be temporary or periodically reassessed. Business use, threats, technology, and available remediation options change over time. A risk that was once acceptable may no longer be tolerable, and compensating controls may have degraded. Effective governance assigns ownership and review dates so exceptions do not silently become permanent architectural weaknesses.

Question 340.

Which practice BEST demonstrates mature enterprise security architecture management?

1. Treat architecture as a one-time project deliverable
   2. Allow each business unit to ignore enterprise standards
   3. Maintain undocumented exceptions indefinitely
   4. Continuously govern architecture decisions, risks, dependencies, standards, and exceptions**

Correct Answer: 4. Continuously govern architecture decisions, risks, dependencies, standards, and exceptions

Explanation:

Mature security architecture is an ongoing enterprise discipline. Architecture decisions should be documented, standards maintained, exceptions governed, dependencies understood, and risks periodically reassessed. Business requirements, threats, technologies, and regulations change, so static architecture can become obsolete. Continuous governance keeps security controls aligned with current organizational needs and risk tolerance.