CASE Security Architecture & Design 2

Question 1

Zero trust architecture is based on which foundational principle?

Accepted Answer

Never trust, always verify — regardless of network location or prior authentication

Answer

Trust all traffic originating from inside the corporate network perimeter

Answer

Trust authenticated users for the duration of their session

Answer

Apply strong perimeter controls to prevent all internal threats

Question 2

The 'complete mediation' security principle requires that:

Accepted Answer

Every access request to every object be checked against the authorization policy each time

Answer

All communications between services be encrypted end-to-end

Answer

All security-relevant decisions be recorded in an immutable audit log

Answer

Users authenticate using at least two independent factors

Question 3

When designing secure microservices architecture, which security concern is most unique compared to monolithic applications?

Accepted Answer

Securing service-to-service communication with mutual authentication and authorization

Answer

Authenticating end users through login forms

Answer

Encrypting sensitive data stored in databases

Answer

Performing input validation on user-supplied data

Question 4

What is the primary security benefit of incorporating an API gateway into an application architecture?

Accepted Answer

It centralizes security controls such as authentication, rate limiting, and input validation at a single entry point

Answer

It eliminates the need for HTTPS by providing transport-layer security

Answer

It stores and rotates API keys automatically within a hardware security module

Answer

It increases API response performance by caching frequent requests

Question 5

Security controls are broadly categorized by function. Which category describes controls designed to detect security events after they occur?

Accepted Answer

Detective controls

Answer

Preventive controls

Answer

Corrective controls

Answer

Deterrent controls

Question 6

Running application containers with minimal OS capabilities and dropping unnecessary Linux capabilities is an application of which security architecture principle?

Accepted Answer

Principle of least privilege

Answer

Defense in depth

Answer

Security through obscurity

Answer

Fail-safe defaults

Question 7

At which phase of the SDLC is threat modeling most effective and least costly to address the identified risks?

Accepted Answer

During the design phase, before coding begins

Answer

After deployment to production during a live security audit

Answer

During user acceptance testing after features are implemented

Answer

During incident response when a vulnerability is exploited