CASP+ Enterprise Security Architecture 2 — Questions and Answers
Question 1: A large enterprise wants to implement defense-in-depth. Which combination of controls BEST represents this strategy?
- A single next-generation firewall at the perimeter
- Network segmentation, endpoint detection, and application-layer controls working together (Correct answer)
- Redundant firewalls from the same vendor
- A unified threat management appliance at the network edge
Correct answer: Network segmentation, endpoint detection, and application-layer controls working together
Defense-in-depth layers multiple independent controls so that failure of any single layer does not result in a full compromise.
Question 2: Which design principle BEST limits privilege escalation within an enterprise architecture?
- Giving all administrators a single shared admin account
- Implementing just-in-time (JIT) privileged access with approval workflows (Correct answer)
- Using long-lived service accounts with broad permissions
- Storing admin credentials in a shared password spreadsheet
Correct answer: Implementing just-in-time (JIT) privileged access with approval workflows
JIT access grants elevated privileges only when needed and for a limited time, reducing the window of exposure for high-privilege accounts.
Question 3: An architect must ensure high availability for a critical authentication service. Which approach BEST balances resilience and security?
- Active-passive cluster with manual failover
- Geographically distributed active-active cluster with health checks and session replication (Correct answer)
- Single server with nightly backups
- DNS round-robin with no session persistence
Correct answer: Geographically distributed active-active cluster with health checks and session replication
An active-active cluster across geographic regions provides automatic failover and load distribution while replicating session state for continuity.
Question 4: Which security architecture approach MOST effectively addresses insider threats?
- Blocking all USB ports on endpoints
- User and Entity Behavior Analytics (UEBA) combined with least-privilege access (Correct answer)
- Requiring employees to sign acceptable use policies
- Deploying antivirus on all workstations
Correct answer: User and Entity Behavior Analytics (UEBA) combined with least-privilege access
UEBA establishes behavioral baselines and alerts on anomalous activity, while least-privilege limits what insiders can access or exfiltrate.
Question 5: A CASP+ professional is designing an API gateway for microservices. Which control is MOST important for API security?
- Using HTTP instead of HTTPS to reduce latency
- OAuth 2.0 with JWT tokens and rate limiting per client (Correct answer)
- Allowing anonymous access to improve developer experience
- Embedding API keys directly in mobile application code
Correct answer: OAuth 2.0 with JWT tokens and rate limiting per client
OAuth 2.0 with short-lived JWT tokens provides delegated authorization, and rate limiting prevents abuse, together forming a strong API security baseline.
Question 6: Which network architecture decision BEST prevents lateral movement after an initial compromise?
- Using a single flat VLAN for all systems
- Implementing east-west traffic inspection between network segments (Correct answer)
- Allowing all internal traffic by default
- Using only host-based firewalls
Correct answer: Implementing east-west traffic inspection between network segments
Inspecting east-west (internal) traffic between segments allows detection and blocking of lateral movement that perimeter controls cannot see.
CASP+ Enterprise Security Architecture 2
A large enterprise wants to implement defense-in-depth.
Which combination of controls BEST represents this strategy?