CCISO Security Architecture 4 — Questions and Answers
Question 1: In a hybrid cloud architecture, what is the MOST important architectural consideration for maintaining consistent security policies?
- Using identical hardware from the same vendor
- Implementing a unified identity and access management (IAM) framework across on-premises and cloud environments (Correct answer)
- Hosting all sensitive data on-premises only
- Using separate security teams for cloud and on-premises
Correct answer: Implementing a unified identity and access management (IAM) framework across on-premises and cloud environments
A unified IAM framework ensures consistent identity verification, access controls, and policy enforcement across hybrid environments, preventing security gaps at integration points.
Question 2: What is the architectural difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) in terms of network placement?
- IDS is always cloud-based while IPS is on-premises
- IDS is typically placed out-of-band (passive monitoring) while IPS is placed inline (active blocking) (Correct answer)
- IDS operates at Layer 7 while IPS operates at Layer 3
- IDS requires more bandwidth than IPS
Correct answer: IDS is typically placed out-of-band (passive monitoring) while IPS is placed inline (active blocking)
IDS is deployed out-of-band to passively monitor and alert on suspicious traffic, while IPS is deployed inline and can actively block malicious traffic in real time.
Question 3: A CISO must design an architecture to protect sensitive PII while allowing data analytics teams to work with the data. Which architectural approach BEST addresses this requirement?
- Granting analytics teams read-only database access
- Implementing data masking or tokenization to provide de-identified data for analytics while protecting the original PII (Correct answer)
- Storing PII in a separate database with no analytics access
- Encrypting the entire database and providing decryption keys to analytics teams
Correct answer: Implementing data masking or tokenization to provide de-identified data for analytics while protecting the original PII
Data masking and tokenization allow organizations to replace sensitive PII with realistic but non-sensitive substitutes, enabling analytics work without exposing actual personal data.
Question 4: Which security architecture principle states that a subject should only have the minimum access rights necessary to perform its authorized functions?
- Separation of duties
- Least privilege (Correct answer)
- Need-to-know
- Job rotation
Correct answer: Least privilege
The principle of least privilege limits user and system permissions to the minimum required to accomplish legitimate tasks, reducing the potential damage from errors, attacks, or compromised accounts.
Question 5: When designing a security architecture for a containerized environment, which control is MOST effective at preventing container escape attacks?
- Encrypting container images at rest
- Enforcing kernel namespace isolation and running containers with non-root user contexts and read-only file systems (Correct answer)
- Using private container registries
- Scanning container images for known CVEs before deployment
Correct answer: Enforcing kernel namespace isolation and running containers with non-root user contexts and read-only file systems
Container escape prevention relies on kernel namespace isolation, dropping unnecessary capabilities, running as non-root, and using read-only file systems to limit what an attacker can do even if they compromise a container.
Question 6: A financial institution's CISO is designing an architecture to detect insider threats. Which combination of controls provides the MOST comprehensive detection capability?
- Firewalls and antivirus software
- User and Entity Behavior Analytics (UEBA) combined with Data Loss Prevention (DLP) and privileged access monitoring (Correct answer)
- Network IDS and email filtering
- Multi-factor authentication and password complexity requirements
Correct answer: User and Entity Behavior Analytics (UEBA) combined with Data Loss Prevention (DLP) and privileged access monitoring
UEBA detects anomalous behavior patterns, DLP monitors and controls data movement, and privileged access monitoring tracks high-risk accounts, together providing comprehensive insider threat detection.
Question 7: In a Software-Defined Networking (SDN) architecture, what is the primary security concern introduced by centralizing network control in the SDN controller?
- Increased network latency due to central processing
- The SDN controller becomes a high-value single point of attack that, if compromised, allows complete network manipulation (Correct answer)
- Difficulty implementing VLANs in software-defined environments
- Incompatibility with legacy firewall solutions
Correct answer: The SDN controller becomes a high-value single point of attack that, if compromised, allows complete network manipulation
The centralized SDN controller is a critical single point of failure and a high-value target; compromising it gives an attacker full control over network routing, segmentation, and traffic flows.
CCISO Security Architecture 4
In a hybrid cloud architecture, what is the MOST important architectural consideration for maintaining consistent security policies?