CASP+ Enterprise Security Architecture 2

Question 1

A large enterprise wants to implement defense-in-depth. Which combination of controls BEST represents this strategy?

Accepted Answer

Network segmentation, endpoint detection, and application-layer controls working together

Answer

A single next-generation firewall at the perimeter

Answer

Redundant firewalls from the same vendor

Answer

A unified threat management appliance at the network edge

Question 2

Which design principle BEST limits privilege escalation within an enterprise architecture?

Accepted Answer

Implementing just-in-time (JIT) privileged access with approval workflows

Answer

Giving all administrators a single shared admin account

Answer

Using long-lived service accounts with broad permissions

Answer

Storing admin credentials in a shared password spreadsheet

Question 3

An architect must ensure high availability for a critical authentication service. Which approach BEST balances resilience and security?

Accepted Answer

Geographically distributed active-active cluster with health checks and session replication

Answer

Active-passive cluster with manual failover

Answer

Single server with nightly backups

Answer

DNS round-robin with no session persistence

Question 4

Which security architecture approach MOST effectively addresses insider threats?

Accepted Answer

User and Entity Behavior Analytics (UEBA) combined with least-privilege access

Answer

Blocking all USB ports on endpoints

Answer

Requiring employees to sign acceptable use policies

Answer

Deploying antivirus on all workstations

Question 5

A CASP+ professional is designing an API gateway for microservices. Which control is MOST important for API security?

Accepted Answer

OAuth 2.0 with JWT tokens and rate limiting per client

Answer

Using HTTP instead of HTTPS to reduce latency

Answer

Allowing anonymous access to improve developer experience

Answer

Embedding API keys directly in mobile application code

Question 6

Which network architecture decision BEST prevents lateral movement after an initial compromise?

Accepted Answer

Implementing east-west traffic inspection between network segments

Answer

Using a single flat VLAN for all systems

Answer

Allowing all internal traffic by default

Answer

Using only host-based firewalls