CCISO Security Architecture 5

Question 1

Which security architecture approach involves treating security infrastructure as code, enabling automated, repeatable, and version-controlled security deployments?

Accepted Answer

Infrastructure as Code (IaC) security with policy-as-code enforcement

Answer

Infrastructure as Code combined with policy-as-code allows security controls to be defined, versioned, tested, and automatically enforced across environments, eliminating configuration drift and manual errors.

Question 2

A CISO is assessing the security architecture of a third-party SaaS provider. Which architectural control gives the CISO the greatest assurance about the provider's security without direct access to their systems?

Accepted Answer

Obtaining and reviewing a current SOC 2 Type II report or ISO 27001 certification with access to the full audit report

Answer

A SOC 2 Type II report provides independent third-party attestation of the provider's security controls over a defined operating period, offering much stronger assurance than self-reported documentation.

Question 3

In enterprise security architecture, what is the purpose of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a reusable, standardized template of security controls and design patterns that align with business objectives and risk tolerance

Answer

A Security Reference Architecture provides standardized, reusable security design patterns and control blueprints that guide consistent security implementation across the enterprise aligned to business goals.

Question 4

What security architectural pattern does a Content Delivery Network (CDN) with DDoS mitigation capability primarily implement?

Accepted Answer

Distributed traffic absorption and scrubbing that protects origin servers by dispersing attack traffic across global points of presence

Answer

CDNs with DDoS mitigation absorb and filter attack traffic at globally distributed edge nodes, preventing volumetric attacks from overwhelming origin infrastructure.

Question 5

A CISO is designing security architecture for a DevSecOps pipeline. At which stage should static application security testing (SAST) be integrated for MAXIMUM effectiveness?

Accepted Answer

During the coding/build phase, so vulnerabilities are detected and remediated before they progress through the pipeline

Answer

Integrating SAST during the coding and build phases follows the 'shift left' principle, detecting vulnerabilities at the cheapest point in the SDLC before they propagate to later, more expensive stages.

(CCISO) EC-Council Certified CISO Practice Test

(CCISO) EC-Council Certified CISO Practice Test

CCISO Security Architecture 5