CCISO Security Architecture 4

Question 1

In a hybrid cloud architecture, what is the MOST important architectural consideration for maintaining consistent security policies?

Accepted Answer

Implementing a unified identity and access management (IAM) framework across on-premises and cloud environments

Answer

A unified IAM framework ensures consistent identity verification, access controls, and policy enforcement across hybrid environments, preventing security gaps at integration points.

Question 2

What is the architectural difference between an Intrusion Detection System (IDS) and an Intrusion Prevention System (IPS) in terms of network placement?

Accepted Answer

IDS is typically placed out-of-band (passive monitoring) while IPS is placed inline (active blocking)

Answer

IDS is deployed out-of-band to passively monitor and alert on suspicious traffic, while IPS is deployed inline and can actively block malicious traffic in real time.

Question 3

A CISO must design an architecture to protect sensitive PII while allowing data analytics teams to work with the data. Which architectural approach BEST addresses this requirement?

Accepted Answer

Implementing data masking or tokenization to provide de-identified data for analytics while protecting the original PII

Answer

Data masking and tokenization allow organizations to replace sensitive PII with realistic but non-sensitive substitutes, enabling analytics work without exposing actual personal data.

Question 4

Which security architecture principle states that a subject should only have the minimum access rights necessary to perform its authorized functions?

Accepted Answer

Least privilege

Answer

The principle of least privilege limits user and system permissions to the minimum required to accomplish legitimate tasks, reducing the potential damage from errors, attacks, or compromised accounts.

Question 5

When designing a security architecture for a containerized environment, which control is MOST effective at preventing container escape attacks?

Accepted Answer

Enforcing kernel namespace isolation and running containers with non-root user contexts and read-only file systems

Answer

Container escape prevention relies on kernel namespace isolation, dropping unnecessary capabilities, running as non-root, and using read-only file systems to limit what an attacker can do even if they compromise a container.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Security Architecture 4