CCISO Security Architecture 3

Question 1

A CISO is evaluating a proposed microservices architecture for a financial application. Which security concern is MOST unique to microservices compared to monolithic architectures?

Accepted Answer

Securing a dramatically increased number of inter-service API communication channels

Answer

SQL injection vulnerabilities

Answer

Patching operating system vulnerabilities

Answer

Managing user authentication sessions

Question 2

Which architectural framework defines security requirements across five concurrent viewpoints: security architecture, security processes, security technology, security assurance, and security governance?

Accepted Answer

SABSA (Sherwood Applied Business Security Architecture)

Answer

TOGAF Security Extension

Answer

DoDAF

Answer

FEAF

Question 3

In network security architecture, what does 'east-west traffic' refer to, and why is it a growing concern?

Accepted Answer

Lateral traffic between servers within the same data center or cloud environment

Answer

Traffic between US and European data centers

Answer

Encrypted traffic bypassing DLP controls

Answer

Traffic from mobile endpoints to corporate servers

Question 4

A CISO needs to secure a SCADA/ICS environment. Which architectural principle is MOST critical when integrating ICS with corporate IT networks?

Accepted Answer

Network segmentation with strict access controls and unidirectional security gateways where possible

Answer

Implementing single sign-on across both environments

Answer

Using the same patch management cycle for both environments

Answer

Deploying cloud-based monitoring for ICS devices

Question 5

What is the security implication of using a shared responsibility model in cloud computing?

Accepted Answer

Security responsibilities are divided between the cloud provider and customer based on the service model (IaaS, PaaS, SaaS)

Answer

The cloud provider assumes all security responsibilities

Answer

Customers have no security responsibilities in the cloud

Answer

Security is handled entirely by third-party auditors

Question 6

Which cryptographic architecture concept ensures that compromising a long-term key does not expose previously recorded encrypted sessions?

Accepted Answer

Perfect Forward Secrecy (PFS)

Answer

Key escrow

Answer

Key stretching

Answer

Certificate pinning

Question 7

A CISO is reviewing a proposed architecture for a high-security environment handling classified data. Which architectural control ensures data cannot flow from a high-security domain to a lower-security domain?

Accepted Answer

Data diode (unidirectional security gateway)

Answer

Stateful firewall between zones

Answer

Bidirectional VPN tunnel

Answer

IDS/IPS at the boundary