CCISO Security Architecture 2

Question 1

Which security architecture model uses the concept of 'never trust, always verify' as its foundational principle?

Accepted Answer

Zero Trust Architecture

Answer

Zero Trust Architecture (ZTA) operates on the principle that no user, device, or network segment is inherently trusted, requiring continuous verification of every access request.

Question 2

A CISO is designing a cloud security architecture. Which framework provides a comprehensive set of security controls specifically tailored for cloud environments?

Accepted Answer

CSA Cloud Controls Matrix (CCM)

Answer

The CSA Cloud Controls Matrix (CCM) is specifically designed to provide security control requirements and guidance for cloud computing environments.

Question 3

In a segmented network architecture, what is the PRIMARY purpose of a demilitarized zone (DMZ)?

Accepted Answer

To provide a buffer zone between untrusted external networks and trusted internal networks

Answer

A DMZ acts as a buffer zone that separates an organization's internal network from untrusted external networks, hosting publicly accessible services while protecting internal resources.

Question 4

Which architectural pattern best supports resilience by ensuring no single component failure can bring down an entire system?

Accepted Answer

Single point of failure elimination through redundancy

Answer

Eliminating single points of failure through redundancy ensures that the failure of any individual component does not cause a complete system outage, supporting high availability and resilience.

Question 5

A CISO must choose between a hardware security module (HSM) and a software-based key management solution. What is the MAIN advantage of an HSM?

Accepted Answer

Physical tamper resistance and secure key generation within a dedicated hardware boundary

Answer

HSMs provide physical tamper resistance and perform cryptographic operations within a secure hardware boundary, preventing private keys from ever being exposed in plaintext outside the device.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Security Architecture 2