CCISO Security Architecture 2

Question 1

Which security architecture model uses the concept of 'never trust, always verify' as its foundational principle?

Accepted Answer

Zero Trust Architecture

Answer

Defense-in-Depth

Answer

Jericho Forum Model

Answer

Perimeter Security Model

Question 2

A CISO is designing a cloud security architecture. Which framework provides a comprehensive set of security controls specifically tailored for cloud environments?

Accepted Answer

CSA Cloud Controls Matrix (CCM)

Answer

NIST SP 800-53

Answer

ISO 27001 Annex A

Answer

CIS Controls v8

Question 3

In a segmented network architecture, what is the PRIMARY purpose of a demilitarized zone (DMZ)?

Accepted Answer

To provide a buffer zone between untrusted external networks and trusted internal networks

Answer

To host internal databases away from the internet

Answer

To isolate workstations from servers

Answer

To store encryption keys securely

Question 4

Which architectural pattern best supports resilience by ensuring no single component failure can bring down an entire system?

Accepted Answer

Single point of failure elimination through redundancy

Answer

Monolithic architecture

Answer

Flat network design

Answer

Air-gapped network design

Question 5

A CISO must choose between a hardware security module (HSM) and a software-based key management solution. What is the MAIN advantage of an HSM?

Accepted Answer

Physical tamper resistance and secure key generation within a dedicated hardware boundary

Answer

Lower cost than software solutions

Answer

Easier integration with cloud services

Answer

Faster key rotation capabilities

Question 6

Which security architecture concept involves distributing security controls across multiple layers so that if one layer fails, subsequent layers continue to provide protection?

Accepted Answer

Defense-in-depth

Answer

Least privilege

Answer

Separation of duties

Answer

Need-to-know

Question 7

When implementing a Zero Trust Network Access (ZTNA) solution, what replaces the traditional VPN as the primary remote access mechanism?

Accepted Answer

Identity-aware proxies that grant per-application access based on continuous verification

Answer

SSL/TLS tunnels to the corporate firewall

Answer

Site-to-site IPsec tunnels

Answer

Network Access Control (NAC) quarantine VLANs