CASP+ Enterprise Security Architecture 3

Question 1

An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

Accepted Answer

NIST SP 800-53

Answer

TOGAF with security extensions

Answer

ISO 27001 alone

Answer

PCI DSS (only applicable if payment data is involved)

Question 2

Which control BEST enforces separation of duties in a financial application's architecture?

Accepted Answer

Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

Answer

Requiring two-factor authentication for all users

Answer

Using audit logging for all transactions

Answer

Encrypting the database at rest

Question 3

A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Accepted Answer

In the DMZ, behind the external firewall but before the internal firewall

Answer

Inside the internal network with no additional segmentation

Answer

Directly on the internet with no firewall

Answer

Inside the internal network but accessible via a reverse proxy in the DMZ

Question 4

Which architecture control MOST effectively protects sensitive data from compromised application code?

Accepted Answer

Hardware security modules (HSMs) for key management with application-layer encryption

Answer

Encrypting data only during transmission

Answer

Storing encryption keys in the same database as the data

Answer

Using application-level password hashing only

Question 5

A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Accepted Answer

Conducting a proof of concept (PoC) against defined acceptance criteria

Answer

Choosing the solution from the most well-known vendor

Answer

Relying on analyst reports alone

Answer

Selecting the cheapest option that meets minimum compliance requirements

Question 6

Which approach BEST ensures that security architecture decisions remain aligned with business objectives over time?

Accepted Answer

Establishing a security governance committee with regular architecture review boards

Answer

Conducting a one-time security assessment at system launch

Answer

Delegating all security decisions to the IT operations team

Answer

Updating security policies only when a breach occurs