CASE Security Architecture & Design 3

Question 1

SABSA (Sherwood Applied Business Security Architecture) is primarily used to:

Accepted Answer

Develop risk-driven enterprise security architectures that are aligned to business objectives

Answer

SABSA is an enterprise security architecture framework that maps security requirements to business needs through a layered contextual-to-component model.

Question 2

In a Data Flow Diagram (DFD) used for security architecture and threat modeling, what do 'external entities' represent?

Accepted Answer

People, organizations, or external systems that interact with the application from outside its boundary

Answer

External entities are actors outside the system boundary (users, third-party systems) and represent the origin or destination of data, typically located at trust boundaries.

Question 3

What is the primary purpose of a security reference architecture?

Accepted Answer

To provide a reusable, validated template of security patterns organizations can adapt for their specific context

Answer

Security reference architectures provide proven, reusable blueprints that speed up secure design and reduce the risk of repeating known architectural mistakes.

Question 4

The 'economy of mechanism' design principle in security architecture recommends:

Accepted Answer

Keeping security designs as simple as possible to reduce the probability of implementation flaws

Answer

Economy of mechanism (keep it simple) holds that simpler security designs are easier to verify, audit, and implement correctly, resulting in fewer exploitable flaws.

Question 5

In cloud security architecture, the shared responsibility model primarily defines:

Accepted Answer

The division of security responsibilities between the cloud service provider and the customer

Answer

The shared responsibility model specifies which security controls are managed by the cloud provider (infrastructure) versus those that remain the customer's obligation (applications, data).

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Security Architecture & Design 3