View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 361.

A security architect is reviewing a new application that will process regulated data across several cloud services. What should be established FIRST?

1. The preferred cloud provider’s user-interface theme
   2. The business, regulatory, data-protection, and trust-boundary requirements
   3. The number of virtual machines to deploy
   4. The final penetration-testing date

Correct Answer: 2. The business, regulatory, data-protection, and trust-boundary requirements

Explanation:

Architecture should begin by establishing the requirements that security controls must satisfy. For regulated data, this includes business objectives, information classification, legal obligations, privacy requirements, trust boundaries, residency considerations, availability needs, and acceptable risk. These requirements guide decisions about identity, encryption, logging, network controls, and cloud-service selection. Choosing implementation details before defining the requirements can produce an architecture that is technically sophisticated but poorly aligned with business and compliance needs.

Question 362.

An organization wants to ensure that a compromised web tier cannot directly administer its database servers. Which control is BEST?

1. Separate application and management paths, allowing only required database traffic from the application tier
   2. Give the web servers database-administrator credentials
   3. Place all tiers in one unrestricted security zone
   4. Disable database authentication

Correct Answer: 1. Separate application and management paths, allowing only required database traffic from the application tier

Explanation:

Application traffic and administrative traffic should be separated when practical. The web or application tier should be allowed to perform only the database operations required for service delivery and should not have access to management interfaces. Segmentation, dedicated administrative paths, separate identities, and least-privilege permissions reduce lateral movement after compromise. Broad database-administrator access would significantly increase the impact of a web-tier breach.

Question 363.

A security architect discovers that an application uses one symmetric encryption key for every customer and every dataset. What is the PRIMARY concern?

1. Key rotation may take less time
   2. Encryption performance may improve
   3. Compromise of one key would expose a very large amount of protected data
   4. The application may generate fewer logs

Correct Answer: 3. Compromise of one key would expose a very large amount of protected data

Explanation:

Using one encryption key across many customers and datasets creates a large cryptographic blast radius. If that key is compromised, a significant amount of information may become exposed simultaneously. Separating keys by tenant, purpose, environment, or data class can reduce this impact. The architecture should also define secure generation, storage, rotation, revocation, backup, and destruction procedures appropriate to the sensitivity and operational requirements.

Question 364.

A critical application is deployed across two regions, but both regions depend on one external identity provider. What is the MOST important resilience concern?

1. Both regions may use the same interface design
   2. The application may have too many user accounts
   3. Identity federation may reduce password usage
   4. Failure of the shared identity provider could affect both regions simultaneously**

Correct Answer: 4. Failure of the shared identity provider could affect both regions simultaneously

Explanation:

Regional application redundancy does not guarantee end-to-end resilience when both regions depend on the same critical identity service. A provider outage, network failure, or identity-platform compromise could make both regions inaccessible. Architects should identify shared dependencies and assess concentration risk, fallback behavior, contractual availability, and recovery options. Supporting services must be included in resilience analysis, not only application compute and storage.

Question 365.

Which principle BEST supports requiring explicit authorization before a new network flow is permitted between security zones?

1. Default deny
   2. Open design
   3. Data minimization
   4. Maximum privilege

Correct Answer: 1. Default deny

Explanation:

A default-deny approach blocks communication unless a specific rule explicitly permits it. This reduces accidental exposure and ensures that new flows are considered intentionally before access is granted. It is commonly applied to firewalls, security groups, access-control policies, and service-to-service communication. Default allow creates a greater risk that missing or incomplete rules leave resources unnecessarily reachable.

Question 366.

A security architect is designing a privileged-access system. Which feature BEST supports accountability?

1. Shared administrator accounts
   2. Individual privileged identities with protected session and activity logging
   3. Anonymous emergency access
   4. Disabled audit records

Correct Answer: 2. Individual privileged identities with protected session and activity logging

Explanation:

Individual privileged identities allow sensitive administrative activity to be attributed to a specific person. Protected audit logs or session records provide evidence of what actions were performed and when. This supports investigations, deterrence, and governance. Shared or anonymous accounts make attribution difficult and weaken accountability. Strong authentication and least-privilege authorization should complement unique administrative identities.

Question 367.

A security architect is evaluating a distributed application that caches authorization decisions. What should be controlled MOST carefully?

1. The application’s color scheme
   2. The physical location of every server
   3. Cache lifetime, invalidation, and which actions may rely on stale authorization data
   4. The number of user-interface screens

Correct Answer: 3. Cache lifetime, invalidation, and which actions may rely on stale authorization data

Explanation:

Authorization caching can improve resilience and performance, but stale permissions create risk. A user’s access may have been revoked centrally while a distributed component still permits activity based on an old decision. The architecture should specify cache duration, invalidation methods, fail-secure behavior, and high-risk actions that require current authorization. Security sensitivity should determine how much stale policy is acceptable.

Question 368.

A company wants its recovery environment to withstand compromise of the primary production administrators. Which design is BEST?

1. Use the same unrestricted administrator credentials in both environments
   2. Keep all recovery systems continuously writable from production
   3. Disable recovery-environment auditing
   4. Separate recovery administration and protect recovery copies from routine production access**

Correct Answer: 4. Separate recovery administration and protect recovery copies from routine production access

Explanation:

Recovery environments should not automatically inherit the same compromise paths as production. Separate administrative identities, isolated or immutable backups, distinct access controls, and protected logging can reduce the chance that compromised production credentials destroy recovery capability. This is particularly important for ransomware scenarios. Recovery should be tested regularly to confirm that separation does not prevent legitimate restoration when needed.

Question 369.

Why should a security architect identify which applications depend on a centralized key-management service?

1. To understand concentration risk and the impact of key-management failure
   2. To eliminate the need for cryptographic controls
   3. To avoid documenting application dependencies
   4. To ensure every application uses the same key

Correct Answer: 1. To understand concentration risk and the impact of key-management failure

Explanation:

A centralized key-management platform can become a critical shared dependency. Failure may prevent applications from decrypting data, establishing secure sessions, or performing signing operations. Compromise may have broad security implications. Mapping dependencies helps determine required redundancy, recovery objectives, administrative protections, and the potential enterprise-wide impact of an outage or security incident.

Question 370.

A business wants to ensure that only compliant managed devices can access a high-value application. Which approach is MOST appropriate?

1. Trust all devices on the internal network
   2. Integrate device identity and posture checks into access-control decisions
   3. Require only a username
   4. Allow unrestricted browser access

Correct Answer: 2. Integrate device identity and posture checks into access-control decisions

Explanation:

Device identity and posture can provide assurance that the endpoint is managed, patched, encrypted, and protected by required security controls. Combining these signals with user authentication enables contextual access decisions and supports Zero Trust principles. Internal network location alone is insufficient because compromised or unmanaged devices can exist inside trusted networks. The exact posture requirements should align with application sensitivity and organizational risk.

Question 371.

A security architect discovers that a software-signing key is stored on the same build server that creates production packages. What is the MAIN concern?

1. Build performance may decrease
   2. The signing key may expire too quickly
   3. Compromise of the build server could enable malicious software to be signed as trusted
   4. Package sizes may increase

Correct Answer: 3. Compromise of the build server could enable malicious software to be signed as trusted

Explanation:

A signing key establishes trust in production artifacts. If the build server and signing key share the same trust boundary, compromise of the server may allow an attacker to alter software and sign the malicious artifact as legitimate. Stronger architectures separate signing authority, protect keys using dedicated cryptographic controls, and require controlled approval or verification before signing and deployment.

Question 372.

An organization requires a service to remain operational during maintenance of any single server. Which design BEST meets this requirement?

1. Perform maintenance only once per year
   2. Use a larger single server
   3. Keep a backup image but no standby capacity
   4. Use redundant nodes with load distribution and tested failover**

Correct Answer: 4. Use redundant nodes with load distribution and tested failover

Explanation:

Redundant nodes allow one server to be removed for maintenance without taking the entire service offline. Load balancing, session handling, data consistency, and failover must be designed so remaining nodes can continue processing. Backups support recovery but do not provide immediate service continuity. The architecture should also examine shared dependencies that could undermine apparent server-level redundancy.

Question 373.

Which action BEST reduces the amount of sensitive production data exposed in nonproduction environments?

1. Use masked, minimized, tokenized, or synthetic data where practical
   2. Copy the complete production database into every test environment
   3. Give all developers production access
   4. Disable test-environment logging

Correct Answer: 1. Use masked, minimized, tokenized, or synthetic data where practical

Explanation:

Development and testing teams often do not require complete sensitive production datasets. Masking, tokenization, minimization, or synthetic data can preserve useful test characteristics while reducing privacy and breach exposure. Nonproduction environments may have broader access and less restrictive controls than production, making unnecessary copies of sensitive data particularly risky. Data use should align with legitimate testing requirements.

Question 374.

A business requires a maximum of 20 minutes of data loss following a major outage. Which requirement does this describe?

1. Recovery time objective
   2. Recovery point objective
   3. Mean time to recovery
   4. Availability percentage

Correct Answer: 2. Recovery point objective

Explanation:

The recovery point objective specifies how much data loss the organization can tolerate, usually expressed as a time interval. An RPO of 20 minutes means backup or replication mechanisms should allow recovery to a point no more than about 20 minutes before the disruption. RTO addresses how quickly the system itself must be restored. Both requirements should be incorporated into continuity and recovery architecture.

Question 375.

A security architect is reviewing an API gateway that authenticates clients but performs no authorization. What is the MAIN concern?

1. The gateway may use too much bandwidth
   2. Authentication becomes unnecessary
   3. Authenticated clients may be able to perform actions they are not permitted to perform
   4. Logging becomes impossible

Correct Answer: 3. Authenticated clients may be able to perform actions they are not permitted to perform

Explanation:

Authentication proves or establishes the identity of a client, but it does not determine what that client is allowed to do. Authorization must restrict access to approved operations and resources. A client with valid credentials should not automatically receive broad API access. Depending on the design, authorization may be enforced at the gateway, backend service, or both, but it must exist somewhere appropriate in the request path.

Question 376.

A security architect is reviewing a proposed permanent firewall exception for a legacy application. What is the BEST governance approach?

1. Approve it without documentation
   2. Allow the application owner to decide alone
   3. Never review the exception again
   4. Document the risk, compensating controls, owner, approval, and review date**

Correct Answer: 4. Document the risk, compensating controls, owner, approval, and review date

Explanation:

Exceptions should be controlled risk decisions rather than informal permanent deviations. The organization should document why the standard cannot be met, what risk is introduced, which compensating controls apply, who accepts the residual risk, and when the exception will be reviewed. Periodic reassessment prevents temporary legacy constraints from becoming unmanaged long-term weaknesses.

Question 377.

Why should an architect document external dependencies such as SaaS platforms, identity providers, and network carriers?

1. They can create shared operational and security risks outside direct organizational control
   2. External services can never fail
   3. Documentation eliminates contractual risk
   4. External providers do not affect architecture

Correct Answer: 1. They can create shared operational and security risks outside direct organizational control

Explanation:

External services may be essential to business operations even though the organization does not directly control their infrastructure. Provider outages, security incidents, contractual changes, or service termination can therefore affect internal applications. Documenting these dependencies supports concentration-risk analysis, continuity planning, contract requirements, exit strategies, and incident response.

Question 378.

A security architect wants to prevent direct unauthorized changes to cloud infrastructure. Which approach is BEST?

1. Give every developer permanent administrator access
   2. Use controlled infrastructure-as-code deployment with review and audit controls
   3. Disable configuration monitoring
   4. Allow unlogged console changes

Correct Answer: 2. Use controlled infrastructure-as-code deployment with review and audit controls

Explanation:

Infrastructure as code can provide consistent, reviewable, and traceable cloud configuration changes. A controlled pipeline may enforce peer review, testing, approvals, integrity verification, and audit records before deployment. Direct console changes should be restricted or detected because they can bypass governance and create configuration drift. The pipeline and deployment identities should also receive strong protection.

Question 379.

A high-value transaction must provide evidence that it was authorized by a specific individual and not modified afterward. Which combination BEST supports this requirement?

1. Anonymous access and local logs
   2. Shared credentials and encryption only
   3. Strong identity, protected signing keys, digital signatures, and tamper-resistant audit evidence
   4. Network segmentation only

Correct Answer: 3. Strong identity, protected signing keys, digital signatures, and tamper-resistant audit evidence

Explanation:

Strong identity establishes who performed the action, while protected private keys and digital signatures can bind that identity to the transaction and provide integrity evidence. Trusted timestamps and protected audit records strengthen attribution and investigation. Shared credentials weaken nonrepudiation because several people could perform the same action. Network segmentation alone does not provide transaction-level evidence.

Question 380.

Which approach BEST characterizes mature enterprise security architecture?

1. Security architecture ends after initial system deployment
   2. Temporary exceptions become permanent automatically
   3. Architecture assumptions are never revisited
   4. Architecture decisions, dependencies, standards, risks, exceptions, and control effectiveness are continuously governed**

Correct Answer: 4. Architecture decisions, dependencies, standards, risks, exceptions, and control effectiveness are continuously governed

Explanation:

Enterprise security architecture is a lifecycle discipline rather than a one-time design activity. Business requirements, technology, threats, regulations, and dependencies continually change. Mature governance maintains architecture principles, documents major decisions, reviews exceptions, tracks residual risk, validates critical dependencies, and reassesses whether controls still meet requirements. Continuous governance keeps architecture aligned with the organization’s evolving risk environment.