Security Architecture Flashcards

Which security architecture model uses the concept of 'never trust, always verify' as its foundational principle?

Answer: Zero Trust Architecture

Zero Trust Architecture (ZTA) operates on the principle that no user, device, or network segment is inherently trusted, requiring continuous verification of every access request.

A CISO is designing a cloud security architecture. Which framework provides a comprehensive set of security controls specifically tailored for cloud environments?

Answer: CSA Cloud Controls Matrix (CCM)

The CSA Cloud Controls Matrix (CCM) is specifically designed to provide security control requirements and guidance for cloud computing environments.

In a segmented network architecture, what is the PRIMARY purpose of a demilitarized zone (DMZ)?

Answer: To provide a buffer zone between untrusted external networks and trusted internal networks

A DMZ acts as a buffer zone that separates an organization's internal network from untrusted external networks, hosting publicly accessible services while protecting internal resources.

Which architectural pattern best supports resilience by ensuring no single component failure can bring down an entire system?

Answer: Single point of failure elimination through redundancy

Eliminating single points of failure through redundancy ensures that the failure of any individual component does not cause a complete system outage, supporting high availability and resilience.

A CISO must choose between a hardware security module (HSM) and a software-based key management solution. What is the MAIN advantage of an HSM?

Answer: Physical tamper resistance and secure key generation within a dedicated hardware boundary

HSMs provide physical tamper resistance and perform cryptographic operations within a secure hardware boundary, preventing private keys from ever being exposed in plaintext outside the device.

Which security architecture concept involves distributing security controls across multiple layers so that if one layer fails, subsequent layers continue to provide protection?

Answer: Defense-in-depth

Defense-in-depth is a layered security strategy where multiple overlapping security controls are deployed so that failure of a single control does not compromise the overall security posture.

When implementing a Zero Trust Network Access (ZTNA) solution, what replaces the traditional VPN as the primary remote access mechanism?

Answer: Identity-aware proxies that grant per-application access based on continuous verification

ZTNA uses identity-aware proxies that verify identity, device posture, and context before granting access to specific applications, rather than providing broad network-level access like VPNs.