View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 381.

A security architect is designing an enterprise authorization model for applications that require different levels of assurance. What should be established FIRST?

1. The business actions, resource sensitivity, and required authorization assurance
   2. A single administrator role for every application
   3. The visual layout of each access-control screen
   4. The number of servers hosting the policy engine

Correct Answer: 1. The business actions, resource sensitivity, and required authorization assurance

Explanation:

Authorization architecture should begin with understanding what users and workloads need to do, which resources are sensitive, and what level of assurance is required for each action. These requirements guide decisions about RBAC, ABAC, contextual controls, approval workflows, and policy enforcement. Selecting a technical model before understanding business risk can lead to either excessive privilege or unnecessarily complex controls.

Question 382.

A critical application depends on both DNS and a centralized identity provider. What is the BEST way to assess its true availability architecture?

1. Measure only application-server uptime
   2. Include DNS, identity, network, and other shared dependencies in the resilience analysis
   3. Ignore external dependencies because they are managed separately
   4. Assume redundant application servers guarantee availability

Correct Answer: 2. Include DNS, identity, network, and other shared dependencies in the resilience analysis

Explanation:

Application availability depends on the entire service chain, not just application servers. DNS, identity, network connectivity, certificates, key management, and external providers can all become critical dependencies. A resilient architecture identifies these services, evaluates their failure modes, and determines whether redundancy and recovery are sufficient to meet business requirements. Ignoring dependencies can create hidden single points of failure.

Question 383.

A security architect discovers that several applications share the same long-lived API credential. What is the MAIN concern?

1. Credential rotation will require fewer changes
   2. The applications may generate fewer logs
   3. Compromise of the shared credential could expose multiple applications and reduce accountability
   4. API traffic may become slower

Correct Answer: 3. Compromise of the shared credential could expose multiple applications and reduce accountability

Explanation:

Shared long-lived credentials create unnecessary concentration risk. If the credential is stolen, an attacker may gain access to every application that uses it, and logs may not clearly identify which workload performed a particular action. Separate workload identities, narrowly scoped permissions, and short-lived credentials reduce blast radius and improve accountability. Credential lifecycle management should also include secure rotation and revocation.

Question 384.

An organization requires high-value transactions to remain blocked if an authorization dependency fails. Which design principle BEST supports this requirement?

1. Default allow
   2. Maximum availability
   3. Open access
   4. Fail-secure behavior**

Correct Answer: 4. Fail-secure behavior

Explanation:

Fail-secure behavior ensures that a control failure does not automatically permit sensitive activity. If authorization cannot be verified for a high-value transaction, the system should deny or defer the operation rather than bypass policy. Lower-risk functions may have different continuity requirements, but sensitive actions should have explicit protected failure behavior defined during architecture design.

Question 385.

Which control BEST reduces the risk that a compromised administrator workstation will expose permanent cloud administrator privileges?

1. Just-in-time privilege elevation using a dedicated administrative session
   2. Permanent global administrator assignment
   3. Shared privileged accounts
   4. Disabling privileged-session logging

Correct Answer: 1. Just-in-time privilege elevation using a dedicated administrative session

Explanation:

Just-in-time privilege reduces standing access by granting elevated permissions only when necessary. Using a dedicated administrative session or privileged-access workstation further separates sensitive activity from ordinary email and browsing. Strong authentication, approval, expiration, and logging can strengthen the design. Permanent global privileges provide attackers with a much larger window for abuse if an administrator account or device is compromised.

Question 386.

A security architect is designing encryption for a multi-tenant service. Which approach BEST limits the impact of a cryptographic key compromise?

1. Use one global key for all tenants and purposes
   2. Separate keys by appropriate tenant, purpose, or security domain
   3. Store all keys beside the encrypted data
   4. Never rotate encryption keys

Correct Answer: 2. Separate keys by appropriate tenant, purpose, or security domain

Explanation:

Key separation reduces cryptographic blast radius. If one tenant-specific or purpose-specific key is compromised, other protected datasets may remain secure. The exact separation model should balance security with operational complexity. Keys should also be protected in a dedicated management system with appropriate rotation, revocation, backup, access control, and audit capabilities.

Question 387.

A security architect wants to reduce supply-chain risk in a containerized environment. Which control is MOST effective before deployment?

1. Allow any image from a public registry
   2. Disable vulnerability scanning
   3. Require approved, signed or integrity-verified images from trusted repositories
   4. Give containers permanent administrator credentials

Correct Answer: 3. Require approved, signed or integrity-verified images from trusted repositories

Explanation:

Container images should originate from controlled sources and be checked for integrity, provenance, and known vulnerabilities before execution. Image signing or comparable verification helps detect tampering and unauthorized builds. Trusted registries, controlled pipelines, scanning, and admission policies can reinforce this process. Public availability alone does not establish that an image is safe or appropriate for production.

Question 388.

Two geographically separate data centers use different network providers but rely on the same centralized certificate authority. What risk should the architect evaluate?

1. Geographic separation is unnecessary
   2. Multiple network providers reduce confidentiality
   3. Certificates cannot affect availability
   4. The certificate authority may remain a common dependency across both sites**

Correct Answer: 4. The certificate authority may remain a common dependency across both sites

Explanation:

Geographic and carrier diversity improve resilience, but shared security services can still create common-mode failure. If applications depend on one certificate authority or validation infrastructure, an outage or compromise may affect both locations. Architects should identify these dependencies and determine whether redundancy, offline recovery, hierarchical PKI design, or alternative validation mechanisms are necessary to meet business requirements.

Question 389.

What is the MAIN purpose of protecting the management plane separately from the data plane?

1. To reduce exposure of privileged control functions to ordinary workload traffic
   2. To eliminate all network security controls
   3. To allow anonymous administrative access
   4. To improve graphical performance

Correct Answer: 1. To reduce exposure of privileged control functions to ordinary workload traffic

Explanation:

The management plane provides powerful configuration and administrative capabilities, while the data plane handles normal workload traffic. Separating them can reduce attack paths and limit the ability of a compromised workload to reach administrative interfaces. Strong authentication, authorization, restricted management networks, and protected logging should reinforce this separation. The approach helps contain compromise and supports defense in depth.

Question 390.

A business requires the capability to revoke access immediately when an employee leaves. Which architectural capability is MOST important?

1. Permanent local accounts in every application
   2. Centralized identity lifecycle and rapid deprovisioning integrated with applications
   3. Shared departmental credentials
   4. Manual account review once per year

Correct Answer: 2. Centralized identity lifecycle and rapid deprovisioning integrated with applications

Explanation:

Rapid termination of access depends on reliable identity lifecycle processes and applications that honor account disablement or revocation promptly. Centralized provisioning and deprovisioning can reduce the chance that orphaned accounts remain active across multiple systems. Cached credentials and local accounts should also be considered because they may delay revocation. Timely deprovisioning supports least privilege throughout the identity lifecycle.

Question 391.

A security architect discovers that the organization has no inventory of software components used in critical applications. What risk does this create?

1. Applications may have too many user accounts
   2. Network segmentation becomes impossible
   3. Vulnerable or compromised dependencies may be difficult to identify and remediate
   4. Applications cannot use encryption

Correct Answer: 3. Vulnerable or compromised dependencies may be difficult to identify and remediate

Explanation:

Without an accurate inventory of software components and dependencies, the organization may not know which applications are affected when a library or package is found vulnerable or compromised. A software bill of materials or equivalent dependency inventory can improve vulnerability response, supply-chain visibility, and lifecycle management. Inventory alone is not sufficient, but it enables informed security decisions and faster impact analysis.

Question 392.

A critical service has backups but no documented restoration procedure. What is the PRIMARY concern?

1. Backup files may consume storage
   2. Backups may contain encryption
   3. Users may need additional training
   4. The organization may not be able to restore the service within required recovery objectives**

Correct Answer: 4. The organization may not be able to restore the service within required recovery objectives

Explanation:

Backups provide value only if they can be restored successfully and within business recovery requirements. Restoration procedures should define dependencies, credentials, keys, sequencing, validation, and responsibilities. Regular recovery testing can reveal problems before an actual incident. Simply creating backup copies does not demonstrate that the organization can meet its RTO or RPO.

Question 393.

Which design BEST supports privacy when an application does not require full customer identifiers for analytics?

1. Use tokenized, pseudonymized, or minimized data where appropriate
   2. Copy every customer attribute into the analytics environment
   3. Disable access logging
   4. Give analysts production administrator access

Correct Answer: 1. Use tokenized, pseudonymized, or minimized data where appropriate

Explanation:

Analytics workloads should receive only the information necessary for their purpose. Tokenization, pseudonymization, masking, aggregation, and minimization can reduce privacy exposure while preserving analytical utility. The architecture should consider whether reidentification is possible and apply appropriate access controls. Copying unnecessary identifiers increases the impact of compromise and expands compliance obligations without adding business value.

Question 394.

A security architect is designing service-to-service authentication for short-lived cloud workloads. Which method is MOST appropriate?

1. Permanent passwords stored in configuration files
   2. Dynamically issued workload credentials tied to verified service identities
   3. One shared administrator token
   4. Anonymous communication between services

Correct Answer: 2. Dynamically issued workload credentials tied to verified service identities

Explanation:

Short-lived workloads are well suited to dynamic identity mechanisms that issue temporary credentials after verifying the workload’s identity. This reduces the need to distribute permanent secrets and limits the useful lifetime of stolen credentials. Permissions should remain narrowly scoped, and credential issuance should be logged and governed. Long-lived shared secrets create unnecessary exposure and difficult rotation challenges.

Question 395.

An organization is considering an exception that would allow a legacy system to bypass multifactor authentication. What should the security architect do?

1. Approve it automatically because the system is old
   2. Remove the system from security monitoring
   3. Assess the risk, define compensating controls, identify an owner, and establish review or expiration
   4. Allow all users to share one password

Correct Answer: 3. Assess the risk, define compensating controls, identify an owner, and establish review or expiration

Explanation:

A security exception should be a formal risk decision. The architect should determine the impact of bypassing the standard, identify compensating controls such as restricted network access or stronger upstream authentication, and document residual risk. The exception should have an accountable owner and a review or expiration date so it does not silently become permanent.

Question 396.

A security architect is evaluating a DDoS resilience design for an internet-facing service. Which approach is MOST appropriate?

1. Rely only on the application’s local firewall
   2. Disable rate limiting
   3. Increase database permissions
   4. Combine upstream protection, capacity planning, rate controls, and graceful degradation**

Correct Answer: 4. Combine upstream protection, capacity planning, rate controls, and graceful degradation

Explanation:

Large distributed denial-of-service attacks may overwhelm connectivity before traffic reaches local controls. Effective architecture may therefore use upstream filtering or scrubbing, content-delivery or edge services, capacity planning, rate limiting, and graceful degradation. The exact design should reflect threat exposure and business requirements. Availability protection is strongest when multiple layers address both network and application-level exhaustion.

Question 397.

What is the MAIN security value of maintaining a traceability matrix from requirements to controls and validation activities?

1. It helps demonstrate that security requirements are implemented and tested
   2. It eliminates the need for architecture documentation
   3. It guarantees no vulnerabilities exist
   4. It replaces risk management

Correct Answer: 1. It helps demonstrate that security requirements are implemented and tested

Explanation:

Traceability links business and security requirements to specific architectural controls, implementation mechanisms, and validation evidence. This helps architects identify requirements that have not been addressed or controls that lack a clear purpose. It also supports reviews, audits, and change impact analysis. Traceability strengthens governance but does not eliminate the need for risk management or technical testing.

Question 398.

A business is integrating a newly acquired company into its enterprise environment. Which security architecture approach is BEST initially?

1. Immediately grant full network trust between both organizations
   2. Maintain controlled boundaries while assessing identities, assets, dependencies, and risks before deeper integration
   3. Disable monitoring to simplify migration
   4. Share all privileged credentials between both companies

Correct Answer: 2. Maintain controlled boundaries while assessing identities, assets, dependencies, and risks before deeper integration

Explanation:

Mergers and acquisitions introduce unknown systems, identities, technical debt, and security assumptions. Immediate unrestricted trust can allow weaknesses in one environment to affect the other. A staged architecture maintains controlled boundaries while inventory, identity, data, connectivity, and security posture are assessed. Integration can then proceed deliberately based on verified requirements and risk.

Question 399.

A security architect wants to determine whether a proposed design introduces a single point of failure through shared infrastructure. Which activity is MOST useful?

1. Reviewing application branding
   2. Counting source-code files
   3. Dependency and failure-domain analysis
   4. Increasing storage capacity

Correct Answer: 3. Dependency and failure-domain analysis

Explanation:

Dependency and failure-domain analysis reveals whether supposedly redundant components share power, networks, identity providers, DNS, storage, cloud control planes, or other infrastructure. These common dependencies can cause simultaneous failure and undermine resilience. Mapping them allows the architect to decide where additional independence, diversity, or recovery capability is required to meet business objectives.

Question 400.

Which practice BEST reflects a mature ISSAP-level security architecture program?

1. Treat every approved architecture as permanently correct
   2. Allow business units to create undocumented security exceptions
   3. Review architecture only when a major incident occurs
   4. Continuously govern requirements, decisions, dependencies, standards, risks, exceptions, and control effectiveness**

Correct Answer: 4. Continuously govern requirements, decisions, dependencies, standards, risks, exceptions, and control effectiveness

Explanation:

Mature security architecture is an ongoing discipline that remains aligned with changing business objectives, technologies, threats, regulations, and external dependencies. Principles and standards provide consistency, architecture decisions preserve rationale, and governed exceptions provide accountability. Continuous reassessment of risks and control effectiveness helps ensure that designs remain appropriate throughout their lifecycle rather than becoming outdated after initial approval.