CASE Security Architecture & Design 3

Question 1

SABSA (Sherwood Applied Business Security Architecture) is primarily used to:

Accepted Answer

Develop risk-driven enterprise security architectures that are aligned to business objectives

Answer

Provide a structured penetration testing methodology for web applications

Answer

Certify security professionals in application security engineering

Answer

Define cryptographic standards and algorithm selection criteria

Question 2

In a Data Flow Diagram (DFD) used for security architecture and threat modeling, what do 'external entities' represent?

Accepted Answer

People, organizations, or external systems that interact with the application from outside its boundary

Answer

Database tables that store sensitive application data

Answer

Network firewalls and intrusion detection systems

Answer

Internal processes that transform or compute data within the application

Question 3

What is the primary purpose of a security reference architecture?

Accepted Answer

To provide a reusable, validated template of security patterns organizations can adapt for their specific context

Answer

To document historical security incidents for organizational learning

Answer

To eliminate the need for penetration testing by pre-validating the design

Answer

To serve as a centralized repository for security policies and compliance documents

Question 4

The 'economy of mechanism' design principle in security architecture recommends:

Accepted Answer

Keeping security designs as simple as possible to reduce the probability of implementation flaws

Answer

Using the strongest and most complex encryption algorithms available

Answer

Distributing security controls across many separate components for resilience

Answer

Centralizing all security decisions in a dedicated security service

Question 5

In cloud security architecture, the shared responsibility model primarily defines:

Accepted Answer

The division of security responsibilities between the cloud service provider and the customer

Answer

How encryption keys are jointly managed between the cloud provider and the customer

Answer

How multiple tenants securely share physical cloud infrastructure

Answer

The process for sharing security assessment reports between cloud parties

Question 6

Which application security architecture pattern specifically prevents SQL injection by ensuring user-supplied data is never interpreted as SQL code?

Accepted Answer

Parameterized queries (prepared statements) that separate SQL code from data

Answer

Network segmentation between the application and database tiers

Answer

Role-based access control restricting database user permissions

Answer

Web application firewall rules blocking common attack signatures

Question 7

The 'open design' principle in security architecture (related to Kerckhoffs's principle) states that:

Accepted Answer

Security should not depend on the secrecy of the design itself, but only on the secrecy of keys or credentials

Answer

Security system designs should be publicly documented to enable community peer review

Answer

All application source code must be open source to allow external security audits

Answer

All security controls must be visible and transparent to end users