CCISO Security Architecture 5 — Questions and Answers
Question 1: Which security architecture approach involves treating security infrastructure as code, enabling automated, repeatable, and version-controlled security deployments?
- Security Operations Center (SOC) automation
- Infrastructure as Code (IaC) security with policy-as-code enforcement (Correct answer)
- Managed security service provider (MSSP) outsourcing
- Manual security baseline hardening
Correct answer: Infrastructure as Code (IaC) security with policy-as-code enforcement
Infrastructure as Code combined with policy-as-code allows security controls to be defined, versioned, tested, and automatically enforced across environments, eliminating configuration drift and manual errors.
Question 2: A CISO is assessing the security architecture of a third-party SaaS provider. Which architectural control gives the CISO the greatest assurance about the provider's security without direct access to their systems?
- Reviewing the provider's marketing security documentation
- Obtaining and reviewing a current SOC 2 Type II report or ISO 27001 certification with access to the full audit report (Correct answer)
- Performing an unannounced penetration test of the provider's systems
- Requiring the provider to complete a self-assessment questionnaire
Correct answer: Obtaining and reviewing a current SOC 2 Type II report or ISO 27001 certification with access to the full audit report
A SOC 2 Type II report provides independent third-party attestation of the provider's security controls over a defined operating period, offering much stronger assurance than self-reported documentation.
Question 3: In enterprise security architecture, what is the purpose of a Security Reference Architecture (SRA)?
- To document all currently installed security tools
- To provide a reusable, standardized template of security controls and design patterns that align with business objectives and risk tolerance (Correct answer)
- To replace the need for individual system security plans
- To serve as a legal compliance checklist for auditors
Correct answer: To provide a reusable, standardized template of security controls and design patterns that align with business objectives and risk tolerance
A Security Reference Architecture provides standardized, reusable security design patterns and control blueprints that guide consistent security implementation across the enterprise aligned to business goals.
Question 4: What security architectural pattern does a Content Delivery Network (CDN) with DDoS mitigation capability primarily implement?
- Data loss prevention at the edge
- Distributed traffic absorption and scrubbing that protects origin servers by dispersing attack traffic across global points of presence (Correct answer)
- Zero-knowledge encryption of cached content
- Multi-factor authentication for content access
Correct answer: Distributed traffic absorption and scrubbing that protects origin servers by dispersing attack traffic across global points of presence
CDNs with DDoS mitigation absorb and filter attack traffic at globally distributed edge nodes, preventing volumetric attacks from overwhelming origin infrastructure.
Question 5: A CISO is designing security architecture for a DevSecOps pipeline. At which stage should static application security testing (SAST) be integrated for MAXIMUM effectiveness?
- After deployment to production
- During the coding/build phase, so vulnerabilities are detected and remediated before they progress through the pipeline (Correct answer)
- Only during the final pre-release security review
- Exclusively during penetration testing engagements
Correct answer: During the coding/build phase, so vulnerabilities are detected and remediated before they progress through the pipeline
Integrating SAST during the coding and build phases follows the 'shift left' principle, detecting vulnerabilities at the cheapest point in the SDLC before they propagate to later, more expensive stages.
Question 6: Which architectural design decision BEST protects against cryptographic algorithm obsolescence (cryptographic agility)?
- Hardcoding the strongest currently available algorithm into all applications
- Designing systems to abstract cryptographic functions so algorithms can be swapped without major code changes (Correct answer)
- Using proprietary encryption algorithms developed in-house
- Avoiding encryption for internal communications to reduce complexity
Correct answer: Designing systems to abstract cryptographic functions so algorithms can be swapped without major code changes
Cryptographic agility means designing systems so cryptographic primitives are abstracted and configurable, allowing organizations to update algorithms as standards evolve or vulnerabilities are discovered without application redesign.
Question 7: When evaluating a security architecture against the NIST Cybersecurity Framework (CSF), which core function focuses on implementing appropriate safeguards to ensure delivery of critical infrastructure services?
- Identify
- Protect (Correct answer)
- Detect
- Respond
Correct answer: Protect
The 'Protect' function of the NIST CSF focuses on developing and implementing appropriate safeguards to limit or contain the impact of a potential cybersecurity event.
CCISO Security Architecture 5
Which security architecture approach involves treating security infrastructure as code, enabling automated, repeatable, and version-controlled security deployments?