View Full ISC CISSP-ISSAP Exam Dumps and Practice Test Dumps

 

Question 161.

A security architect is designing access to highly sensitive administrative APIs. Which approach BEST reduces the attack surface?

1. Expose the APIs publicly and rely only on passwords
   2. Restrict access to approved administrative paths and require strong authentication
   3. Allow anonymous access from internal networks
   4. Disable audit logging

Correct Answer: 2. Restrict access to approved administrative paths and require strong authentication

Explanation:

Sensitive administrative APIs should not be broadly exposed. Restricting them to trusted management networks, controlled access gateways, or approved administrative hosts reduces the number of systems that can reach them. Strong authentication and detailed logging should also be used. Relying only on passwords or internal network location creates unnecessary risk. Administrative interfaces should be treated as high-value targets and protected with layered controls.

Question 162.

Which security principle BEST supports limiting a user to only the resources needed for current job responsibilities?

1. Least privilege
   2. Open design
   3. Availability
   4. Fail open

Correct Answer: 1. Least privilege

Explanation:

Least privilege requires users, services, and processes to receive only the permissions necessary to perform authorized functions. Access should be reviewed when roles change and removed when no longer required. This reduces the impact of mistakes, insider misuse, and credential compromise. Open design and availability address different concerns, while fail-open behavior can increase exposure during failures.

Question 163.

A security architect is assessing a payment application that accepts input from external clients. Which control is MOST important at the application boundary?

1. Additional CPU capacity
   2. Data compression
   3. Strong input validation and authorization
   4. Reduced logging

Correct Answer: 3. Strong input validation and authorization

Explanation:

External input crosses a trust boundary and should be treated as untrusted. Strong validation helps ensure that only expected data formats and values are accepted, while authorization ensures that clients can perform only permitted actions. These controls reduce the risk of injection, malformed input, and unauthorized transaction manipulation. Hardware capacity does not address the underlying trust-boundary risk.

Question 164.

A critical application depends on one external identity provider. What should the security architect consider MOST carefully?

1. The provider’s website design
   2. The number of help-desk agents
   3. User-interface customization options
   4. Concentration risk, resilience, and recovery options**

Correct Answer: 4. Concentration risk, resilience, and recovery options

Explanation:

An external identity provider can become a critical dependency. If it becomes unavailable or compromised, access to many applications may be affected. The architect should evaluate redundancy, contractual commitments, fallback options, incident response, and the business impact of provider failure. Shared identity services can improve consistency, but they also create concentration risk that must be addressed through resilience planning.

Question 165.

Why is it important to separate production and development environments?

1. It reduces the risk that development activity or credentials directly affect production systems
   2. It eliminates the need for testing
   3. It guarantees developers cannot make mistakes
   4. It removes the need for change control

Correct Answer: 1. It reduces the risk that development activity or credentials directly affect production systems

Explanation:

Separation between production and development reduces the chance that test data, experimental code, development credentials, or insecure configurations directly affect live systems. It also supports stronger access control and change governance. Developers may still require controlled deployment capabilities, but production access should be limited and auditable. Environment separation is an important defense-in-depth and governance practice.

Question 166.

A business requires a system to recover within 30 minutes after a failure. What does this requirement define?

1. Recovery point objective
   2. Recovery time objective
   3. Maximum tolerable data classification
   4. Mean time between failures

Correct Answer: 2. Recovery time objective

Explanation:

The recovery time objective, or RTO, specifies how quickly a system or business process must be restored after disruption. A requirement to recover within 30 minutes therefore defines an RTO. The recovery point objective, or RPO, addresses the maximum acceptable amount of data loss measured in time. Both values influence architecture choices for redundancy, replication, backup, and recovery.

Question 167.

A security architect wants to ensure that a compromised application cannot use its credentials to access unrelated cloud resources. Which design is BEST?

1. Give every application the same cloud role
   2. Use a permanent administrator key
   3. Assign narrowly scoped workload identities to each application
   4. Disable cloud audit logging

Correct Answer: 3. Assign narrowly scoped workload identities to each application

Explanation:

Separate workload identities with narrowly scoped permissions reduce the blast radius of compromise. If one application is breached, its identity should allow access only to the resources it legitimately requires. Shared or broadly privileged roles increase lateral movement and make accountability more difficult. Cloud identity architecture should follow least privilege and use platform-managed mechanisms where possible.

Question 168.

A security architect discovers that a business process relies on one network path between two data centers. What is the PRIMARY concern?

1. The path may be too fast
   2. The link may use encryption
   3. The route may be documented
   4. It represents a single point of failure**

Correct Answer: 4. It represents a single point of failure

Explanation:

If a critical process depends on one network path, failure of that path can disrupt service even if servers and applications remain healthy. Resilient architecture should consider independent network routes, provider diversity, and tested failover where the business requirement justifies it. Redundancy should reduce common-mode failure rather than simply duplicating components that depend on the same underlying path.

Question 169.

What is the PRIMARY benefit of applying a default-deny policy between network security zones?

1. Only explicitly approved communication is permitted
   2. All internal traffic is automatically trusted
   3. Authentication is no longer necessary
   4. Security monitoring can be disabled

Correct Answer: 1. Only explicitly approved communication is permitted

Explanation:

Default deny blocks communication unless a specific rule authorizes it. This reduces unintended exposure and limits lateral movement between security zones. It supports least privilege at the network layer by allowing only required protocols and destinations. Authentication and monitoring remain important complementary controls. A default-allow approach can expose services when rules are incomplete or incorrectly configured.

Question 170.

An organization wants to protect highly sensitive cryptographic keys from application administrators. Which approach is MOST appropriate?

1. Store keys in shared configuration files
   2. Use a dedicated key-management or hardware security mechanism with restricted access
   3. Embed keys in application source code
   4. Email keys to administrators when needed

Correct Answer: 2. Use a dedicated key-management or hardware security mechanism with restricted access

Explanation:

Sensitive keys should be protected separately from the applications and administrators that use cryptographic services. A dedicated key-management system or hardware security module can enforce strong access controls, key lifecycle management, auditing, and secure storage. Embedding keys in code or configuration exposes them to unnecessary users and systems. Separation of key custody improves both confidentiality and governance.

Question 171.

Which architecture technique BEST reduces the risk of unauthorized modifications to production software?

1. Allow developers to edit production files directly
   2. Disable version control
   3. Use a controlled build and deployment pipeline with integrity verification
   4. Share production administrator accounts

Correct Answer: 3. Use a controlled build and deployment pipeline with integrity verification

Explanation:

A controlled deployment pipeline can enforce code review, testing, approvals, artifact integrity, and traceability before software reaches production. This reduces direct human modification of production systems and makes changes easier to audit. The pipeline itself should be protected because compromise of build or deployment infrastructure can affect many systems. Shared production accounts weaken accountability and should be avoided.

Question 172.

A business wants to ensure that compromise of a user workstation does not immediately expose privileged administrator credentials. Which design BEST supports this goal?

1. Use the same workstation for all activities
   2. Store administrator passwords in browser autofill
   3. Share one administrator account
   4. Use dedicated privileged-access workstations or controlled administrative sessions**

Correct Answer: 4. Use dedicated privileged-access workstations or controlled administrative sessions

Explanation:

Separating privileged administration from ordinary user activity reduces exposure of powerful credentials to phishing, browsing threats, email malware, and general endpoint compromise. Dedicated administrative workstations, jump hosts, session controls, and strong authentication can provide this isolation. The architecture should also include logging and network restrictions. Using the same endpoint for routine and privileged activities increases the attack surface.

Question 173.

Why should an enterprise security architecture maintain documented trust relationships with external organizations?

1. To understand what is trusted, under what conditions, and which controls govern that trust
   2. To eliminate all contracts
   3. To allow unlimited partner access
   4. To avoid authentication between organizations

Correct Answer: 1. To understand what is trusted, under what conditions, and which controls govern that trust

Explanation:

External trust relationships can provide access to identities, data, APIs, or internal services. They should be explicitly documented so the organization understands which parties are trusted, the scope of that trust, how authentication and authorization work, and how the relationship can be monitored or terminated. Undocumented trust can persist unnoticed and create significant exposure if partners or requirements change.

Question 174.

A security architect needs to protect backups from ransomware that compromises production administrator accounts. Which approach is BEST?

1. Keep all backups mounted writable from production systems
   2. Use isolated or immutable backup copies with separately controlled access
   3. Store only one backup copy
   4. Allow every administrator to delete backups

Correct Answer: 2. Use isolated or immutable backup copies with separately controlled access

Explanation:

If production administrators or systems can freely modify all backups, ransomware or compromised privileged accounts may destroy both primary data and recovery copies. Isolated, offline, or immutable backups with separate access controls can reduce this risk. Recovery copies should also be tested regularly. Backup architecture should account for malicious compromise as well as accidental failure.

Question 175.

A security architect is evaluating whether a system should store an additional sensitive data field that is not required for its primary function. Which principle applies MOST directly?

1. Complete mediation
   2. Defense in depth
   3. Data minimization
   4. High availability

Correct Answer: 3. Data minimization

Explanation:

Data minimization requires organizations to collect and retain only information necessary for legitimate purposes. If a sensitive field does not support the application’s required function, storing it introduces additional privacy and security risk without corresponding value. Reducing unnecessary data can lower breach impact, simplify compliance, and decrease the number of controls required to protect sensitive information.

Question 176.

A security architect wants an application to remain secure if a centralized authorization service is temporarily unreachable. What must be defined explicitly?

1. Application color standards
   2. User-interface layout
   3. The size of each server
   4. Fail-secure behavior and any acceptable local policy-caching rules**

Correct Answer: 4. Fail-secure behavior and any acceptable local policy-caching rules

Explanation:

When centralized authorization becomes unavailable, the application needs a predefined response. Depending on business and security requirements, it may deny access or use carefully controlled cached authorization data for a limited period. The architecture should specify how stale cached policy may become and which operations remain permitted. Undefined behavior during dependency failures can create either security gaps or unnecessary outages.

Question 177.

What is the MAIN benefit of threat modeling a proposed architecture before implementation?

1. It identifies potential attack paths and design weaknesses while changes are still easier to make
   2. It guarantees there will be no vulnerabilities
   3. It replaces penetration testing permanently
   4. It eliminates risk acceptance

Correct Answer: 1. It identifies potential attack paths and design weaknesses while changes are still easier to make

Explanation:

Threat modeling analyzes assets, attackers, trust boundaries, and possible abuse paths during design. Identifying weaknesses early gives architects an opportunity to modify the design before implementation makes those changes more expensive. Threat modeling complements later testing and operational monitoring rather than replacing them. It improves assurance but cannot guarantee that every vulnerability has been identified.

Question 178.

A third-party SaaS provider will retain customer information after contract termination unless instructed otherwise. What should the architect ensure?

1. Data is retained forever by default
   2. Contractual requirements define return, retention, and secure deletion of data
   3. The provider chooses retention without oversight
   4. Backups are excluded from all data-handling requirements

Correct Answer: 2. Contractual requirements define return, retention, and secure deletion of data

Explanation:

Data lifecycle obligations should continue through contract termination. Agreements should specify what happens to primary data, replicas, backups, keys, and access credentials when the relationship ends. Retention requirements may be driven by business or legal obligations, but unnecessary copies should not remain indefinitely. Explicit contractual terms reduce ambiguity and help ensure that sensitive information is handled consistently.

Question 179.

A company is designing a high-value transaction system. Which control BEST supports detection of unauthorized transaction modification?

1. Increased storage capacity
   2. Anonymous user accounts
   3. Integrity verification using cryptographic mechanisms and protected audit records
   4. Disabled monitoring

Correct Answer: 3. Integrity verification using cryptographic mechanisms and protected audit records

Explanation:

Transaction integrity requires the organization to detect or prevent unauthorized modification. Cryptographic integrity mechanisms, digital signatures, message authentication, and protected audit logs can provide evidence that data has not been altered improperly. Authentication and authorization are also important, but the stated requirement focuses specifically on protecting transaction integrity and detecting unauthorized changes.

Question 180.

Which practice BEST supports a mature security architecture program across a large enterprise?

1. Allow each project to make undocumented security exceptions
   2. Review architecture only after production deployment
   3. Freeze standards permanently
   4. Maintain principles and standards, review designs, manage exceptions, reassess risk, and track architecture effectiveness**

Correct Answer: 4. Maintain principles and standards, review designs, manage exceptions, reassess risk, and track architecture effectiveness

Explanation:

A mature security architecture program combines governance with continuous improvement. Enterprise principles and standards provide consistency, design reviews identify issues before deployment, and documented exceptions create accountability when requirements cannot be met exactly. Risk and control effectiveness should be reassessed as technologies, threats, regulations, and business needs change. Security architecture should therefore function as an ongoing lifecycle discipline.