View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 21.

A security architect is designing a new payment-processing environment. Which action should occur BEFORE selecting specific security products?

1. Define business, security, compliance, and risk requirements
   2. Purchase the most widely used firewall
   3. Configure production logging
   4. Conduct a post-implementation penetration test

Correct Answer: 1. Define business, security, compliance, and risk requirements

Explanation:

Security products should be selected only after the architect understands what the environment must protect and which risks must be addressed. Business objectives, regulatory obligations, data sensitivity, availability requirements, and organizational risk tolerance all influence the security architecture. Choosing technologies too early can lead to controls that are poorly aligned with actual requirements. Penetration testing and production configuration occur later in the lifecycle, after the architecture and implementation have been established.

Question 22.

An organization wants to reduce the possibility that one administrator can make an unauthorized high-risk change without oversight. Which control is MOST appropriate?

1. Single sign-on
   2. Separation of duties
   3. Data replication
   4. Network address translation

Correct Answer: 2. Separation of duties

Explanation:

Separation of duties divides sensitive responsibilities among multiple individuals so that one person cannot independently complete a high-risk process. For example, one administrator may request a privileged change while another approves it. This helps reduce fraud, error, and misuse of administrative authority. Single sign-on improves authentication convenience, while replication and NAT address different technical concerns. Separation of duties directly supports governance over sensitive administrative actions.

Question 23.

A security architect must design controls for an application containing highly confidential intellectual property. Which factor should have the GREATEST influence on the architecture?

1. User-interface design
   2. Vendor market share
   3. Business impact and information classification
   4. Number of application developers

Correct Answer: 3. Business impact and information classification

Explanation:

Information classification and business impact help determine the level of confidentiality, integrity, and availability protection required. Highly sensitive intellectual property may justify stronger authentication, encryption, segmentation, monitoring, and access restrictions than lower-value data. Vendor popularity or team size should not override risk-based requirements. A security architect should trace control selection back to the value of the assets and the consequences of compromise.

Question 24.

Which architecture BEST protects an internal database from direct internet exposure?

1. Place the database and web server in the same public subnet
   2. Allow inbound internet traffic directly to the database
   3. Disable network filtering between application tiers
   4. Separate web, application, and database tiers with controlled communication between them**

Correct Answer: 4. Separate web, application, and database tiers with controlled communication between them

Explanation:

Tiered segmentation limits the systems that can communicate directly with sensitive backend services. An internet-facing web tier can be separated from application and database tiers, with only necessary traffic allowed between them. This reduces attack paths and supports defense in depth. Exposing the database directly or placing all components in the same unrestricted segment would increase the impact of a compromised internet-facing system.

Question 25.

A company wants security controls to continue protecting critical resources even if one mechanism fails. Which architectural principle BEST supports this requirement?

1. Defense in depth
   2. Shared accounts
   3. Default allow
   4. Single-point enforcement

Correct Answer: 1. Defense in depth

Explanation:

Defense in depth uses multiple complementary safeguards so that the failure of one control does not leave the asset completely unprotected. For example, identity controls, network segmentation, endpoint protection, application authorization, encryption, and monitoring can work together. Shared accounts and default-allow policies weaken security. A single control creates a potential single point of failure, which is the opposite of layered protection.

Question 26.

Which security design principle requires an account to receive only the access needed to perform its assigned function?

1. Fail-safe defaults
   2. Least privilege
   3. Open design
   4. Complete mediation

Correct Answer: 2. Least privilege

Explanation:

Least privilege limits users, processes, and services to the minimum permissions required for legitimate tasks. This reduces the damage that can result from mistakes, malicious activity, or account compromise. Privileges should also be reviewed and removed when they are no longer needed. Although fail-safe defaults and complete mediation are important security principles, least privilege specifically addresses limiting the scope of granted access.

Question 27.

A security architect is reviewing a proposed cloud solution. Which issue is MOST important for determining who must implement specific security controls?

1. The cloud provider’s office locations
   2. The graphical design of the administration portal
   3. The shared-responsibility model for the selected cloud service
   4. The number of customer support representatives

Correct Answer: 3. The shared-responsibility model for the selected cloud service

Explanation:

The shared-responsibility model defines which security responsibilities belong to the cloud provider and which remain with the customer. The division varies among infrastructure, platform, and software service models. Architects must understand responsibility for identity, configuration, data protection, operating systems, network controls, logging, and other safeguards. Ambiguous ownership can leave critical controls unimplemented, making this an essential cloud architecture consideration.

Question 28.

A critical service must continue operating after the loss of an entire primary data center. Which design BEST supports this objective?

1. Store backups in the same data center
   2. Add a second server in the same rack
   3. Use one highly powerful production server
   4. Implement geographically separated recovery or redundant processing capability**

Correct Answer: 4. Implement geographically separated recovery or redundant processing capability

Explanation:

A site-wide outage can affect power, networking, facilities, and all systems located within the same data center. Geographic separation reduces this common-mode failure risk. Depending on recovery requirements, organizations may use active-active, active-passive, or other resilient designs across sites. Local redundancy protects against individual component failures but may not survive a complete data-center outage.

Question 29.

Which action BEST supports secure management of cryptographic keys?

1. Define controlled generation, storage, rotation, revocation, and destruction procedures
   2. Store all private keys in plaintext for easy recovery
   3. Use one encryption key permanently for all systems
   4. Email keys to administrators when needed

Correct Answer: 1. Define controlled generation, storage, rotation, revocation, and destruction procedures

Explanation:

Cryptographic security depends heavily on key management. Even strong algorithms can be undermined if keys are exposed, reused indefinitely, or poorly controlled. A sound architecture addresses the full key lifecycle, including generation, distribution, secure storage, rotation, recovery where appropriate, revocation, and destruction. Key access should be restricted and auditable. Storing or transmitting private keys insecurely creates a serious compromise risk.

Question 30.

An organization wants to reduce its reliance on trusted internal network locations when making access decisions. Which architecture is MOST appropriate?

1. Flat internal networking
   2. Zero Trust architecture
   3. Perimeter-only filtering
   4. Anonymous internal access

Correct Answer: 2. Zero Trust architecture

Explanation:

Zero Trust does not automatically trust users or devices simply because they are inside the corporate network. Access decisions are based on identity, device condition, context, policy, and resource sensitivity. Continuous verification and least-privilege access are central ideas. A flat network or perimeter-only model can provide excessive implicit trust once an attacker enters the internal environment.

Question 31.

A security architect is designing an administrative interface for highly sensitive infrastructure. Which control BEST reduces the risk of exposing the interface to unauthorized users?

1. Allow access from any internet address
   2. Use only a complex URL
   3. Restrict management access to authorized administrative networks and strong authentication
   4. Disable audit logging

Correct Answer: 3. Restrict management access to authorized administrative networks and strong authentication

Explanation:

Sensitive management interfaces should have limited exposure and require strong authentication. Restricting administrative access to controlled networks, secure access paths, or approved management systems reduces attack surface. Multi-factor authentication and detailed logging can provide additional protection. A hidden URL is not a meaningful access control, while broad internet exposure and disabled logging increase risk.

Question 32.

An organization is designing a system where failure of an access-control component must not unintentionally grant access. Which behavior is MOST appropriate?

1. Default allow
   2. Shared authentication
   3. Anonymous fallback
   4. Fail secure**

Correct Answer: 4. Fail secure

Explanation:

Fail-secure design means that when a security mechanism fails, the system moves toward a protected state rather than granting unauthorized access. For access control, this usually means denying requests when policy cannot be evaluated reliably. The exact implementation must consider availability requirements, but granting access automatically during a security-control failure can create serious exposure. This principle is closely related to fail-safe defaults.

Question 33.

Which activity BEST helps an architect identify trust boundaries within a new application?

1. Data-flow and component interaction analysis
   2. Reviewing employee vacation schedules
   3. Counting source-code files
   4. Measuring processor utilization

Correct Answer: 1. Data-flow and component interaction analysis

Explanation:

Trust boundaries occur where data, processes, users, or systems move between areas with different security assumptions or levels of trust. Data-flow analysis helps architects see where information enters, leaves, or crosses between application components, networks, users, and external services. These transitions are important locations for authentication, authorization, validation, encryption, and monitoring controls. Operational metrics such as processor utilization do not identify trust boundaries.

Question 34.

What is the MAIN security purpose of strong authentication for privileged administrators?

1. Increase network bandwidth
   2. Reduce the likelihood that stolen or guessed credentials alone enable privileged access
   3. Eliminate authorization policies
   4. Replace audit logging

Correct Answer: 2. Reduce the likelihood that stolen or guessed credentials alone enable privileged access

Explanation:

Privileged accounts can make high-impact changes, so authentication assurance should generally be stronger than for ordinary access. Multi-factor authentication, protected administrative channels, and dedicated privileged identities can reduce the likelihood that a single compromised password results in administrative access. Authentication does not replace authorization or auditing; all three contribute to controlling and monitoring privileged activity.

Question 35.

A security architect wants to minimize the amount of sensitive personal data stored by an application. Which principle is being applied?

1. Defense in depth
   2. Nonrepudiation
   3. Data minimization
   4. High availability

Correct Answer: 3. Data minimization

Explanation:

Data minimization means collecting, processing, and retaining only the information necessary for a legitimate purpose. Reducing the amount of sensitive data stored can decrease privacy exposure and the impact of a breach. It can also reduce compliance and protection requirements. Defense in depth and high availability address different architectural concerns, while nonrepudiation focuses on providing evidence that an action occurred.

Question 36.

Which design is MOST appropriate when an organization requires an independent record of administrator actions?

1. Disable privileged logging
   2. Allow administrators to modify their own logs freely
   3. Store logs only on the administered system
   4. Send security logs to a protected centralized logging system**

Correct Answer: 4. Send security logs to a protected centralized logging system

Explanation:

Centralized protected logging makes it more difficult for an administrator or attacker who compromises one system to erase all evidence of activity. Logs should be access-controlled, time-synchronized, monitored, and retained according to organizational requirements. Keeping the only copy locally increases the risk of tampering or loss. Independent logging strengthens accountability, investigations, and security monitoring.

Question 37.

What is the BEST reason to conduct threat modeling during architecture design?

1. Identify likely attack paths and select controls before implementation is complete
   2. Replace all penetration testing permanently
   3. Determine employee compensation
   4. Guarantee that no vulnerabilities will remain

Correct Answer: 1. Identify likely attack paths and select controls before implementation is complete

Explanation:

Threat modeling helps teams understand assets, trust boundaries, potential attackers, attack paths, and security weaknesses while the system is still being designed. Discovering risks early makes it easier and less expensive to address them through architecture changes. Threat modeling complements rather than replaces later security testing. It improves design quality but cannot guarantee that every vulnerability will be identified or eliminated.

Question 38.

A business requires an application to recover within two hours after a major outage. Which requirement does this MOST directly describe?

1. Recovery point objective
   2. Recovery time objective
   3. Maximum data classification
   4. Mean time between failures

Correct Answer: 2. Recovery time objective

Explanation:

The recovery time objective, or RTO, describes the target amount of time within which a system or business process should be restored after a disruption. A two-hour recovery requirement therefore defines an RTO. By contrast, the recovery point objective concerns the acceptable amount of data loss measured in time. Architects use both values to design suitable resilience, backup, replication, and recovery capabilities.

Question 39.

A business can tolerate no more than 15 minutes of transaction data loss after a disaster. Which metric does this define?

1. Mean time to repair
   2. Recovery time objective
   3. Recovery point objective
   4. Service level agreement duration

Correct Answer: 3. Recovery point objective

Explanation:

The recovery point objective, or RPO, specifies how much data loss the organization can tolerate, usually expressed as a period of time. An RPO of 15 minutes means recovery mechanisms should generally allow the organization to restore data to a point no more than 15 minutes before the disruption. This requirement influences backup and replication frequency. RTO, by contrast, addresses how quickly service must be restored.

Question 40.

Which approach BEST supports long-term security architecture governance?

1. Allow every project to define security independently
   2. Review security only after incidents
   3. Avoid documenting accepted risks
   4. Maintain architecture standards, conduct design reviews, document exceptions, and track risk decisions**

Correct Answer: 4. Maintain architecture standards, conduct design reviews, document exceptions, and track risk decisions

Explanation:

Effective architecture governance provides consistent principles and standards while allowing justified exceptions through a controlled process. Design reviews help identify security issues before implementation, and documented exceptions ensure that deviations are consciously evaluated rather than overlooked. Tracking accepted risks provides accountability and supports future reassessment. Governance should remain active throughout the system lifecycle rather than occurring only after security incidents.