CASP+ Enterprise Security Architecture 3

Question 1

An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

Accepted Answer

NIST SP 800-53

Answer

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Question 2

Which control BEST enforces separation of duties in a financial application's architecture?

Accepted Answer

Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

Answer

RBAC that separates initiator and approver roles enforces separation of duties, preventing a single user from completing a fraudulent transaction alone.

Question 3

A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Accepted Answer

In the DMZ, behind the external firewall but before the internal firewall

Answer

Placing the web server in the DMZ isolates it from the internal network so that a compromise does not immediately expose internal systems.

Question 4

Which architecture control MOST effectively protects sensitive data from compromised application code?

Accepted Answer

Hardware security modules (HSMs) for key management with application-layer encryption

Answer

HSMs store cryptographic keys in tamper-resistant hardware, so even fully compromised application code cannot extract the raw keys.

Question 5

A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Accepted Answer

Conducting a proof of concept (PoC) against defined acceptance criteria

Answer

A PoC tested against pre-defined, measurable acceptance criteria provides objective evidence of how each solution performs in the specific environment.

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ - CompTIA Advanced Security Practitioner Practice Test

CASP+ Enterprise Security Architecture 3