CASE Security Architecture & Design 2 — Questions and Answers
Question 1: Zero trust architecture is based on which foundational principle?
- Trust all traffic originating from inside the corporate network perimeter
- Never trust, always verify — regardless of network location or prior authentication (Correct answer)
- Trust authenticated users for the duration of their session
- Apply strong perimeter controls to prevent all internal threats
Correct answer: Never trust, always verify — regardless of network location or prior authentication
Zero trust eliminates implicit trust based on network location, requiring continuous verification of identity and device posture for every access request.
Question 2: The 'complete mediation' security principle requires that:
- All communications between services be encrypted end-to-end
- Every access request to every object be checked against the authorization policy each time (Correct answer)
- All security-relevant decisions be recorded in an immutable audit log
- Users authenticate using at least two independent factors
Correct answer: Every access request to every object be checked against the authorization policy each time
Complete mediation prevents cached or assumed permissions by ensuring each access attempt is freshly validated against the current access control policy.
Question 3: When designing secure microservices architecture, which security concern is most unique compared to monolithic applications?
- Authenticating end users through login forms
- Encrypting sensitive data stored in databases
- Securing service-to-service communication with mutual authentication and authorization (Correct answer)
- Performing input validation on user-supplied data
Correct answer: Securing service-to-service communication with mutual authentication and authorization
Microservices introduce internal service-to-service API calls that must be authenticated and authorized, a communication path that does not exist in monolithic applications.
Question 4: What is the primary security benefit of incorporating an API gateway into an application architecture?
- It eliminates the need for HTTPS by providing transport-layer security
- It centralizes security controls such as authentication, rate limiting, and input validation at a single entry point (Correct answer)
- It stores and rotates API keys automatically within a hardware security module
- It increases API response performance by caching frequent requests
Correct answer: It centralizes security controls such as authentication, rate limiting, and input validation at a single entry point
An API gateway acts as a single choke point where security policies can be consistently enforced for all backend services without duplicating logic in each service.
Question 5: Security controls are broadly categorized by function. Which category describes controls designed to detect security events after they occur?
- Preventive controls
- Detective controls (Correct answer)
- Corrective controls
- Deterrent controls
Correct answer: Detective controls
Detective controls (e.g., intrusion detection systems, log monitoring) identify security events that have occurred rather than preventing them beforehand.
Question 6: Running application containers with minimal OS capabilities and dropping unnecessary Linux capabilities is an application of which security architecture principle?
- Defense in depth
- Security through obscurity
- Principle of least privilege (Correct answer)
- Fail-safe defaults
Correct answer: Principle of least privilege
Applying least privilege to containers limits the damage an attacker can cause if a container is compromised, since it lacks unnecessary system-level access.
Question 7: At which phase of the SDLC is threat modeling most effective and least costly to address the identified risks?
- After deployment to production during a live security audit
- During the design phase, before coding begins (Correct answer)
- During user acceptance testing after features are implemented
- During incident response when a vulnerability is exploited
Correct answer: During the design phase, before coding begins
Performing threat modeling during design allows architectural security decisions to be made and changed before code is written, when changes are cheapest.
CASE Security Architecture & Design 2
Zero trust architecture is based on which foundational principle?