CISSP Security Architecture 5

Question 1

Which Evaluation Assurance Level (EAL) in Common Criteria represents 'structurally tested' and is the most common for commercial products seeking formal evaluation?

Accepted Answer

EAL4

Answer

EAL4 (methodically designed, tested, and reviewed) is the highest level typically economically feasible for commercial products.

Question 2

A covert channel in a secure system is best described as:

Accepted Answer

A communication path that was not intended for information transfer but can leak data

Answer

Covert channels exploit unintended communication paths — such as timing or storage — to exfiltrate information in violation of security policy.

Question 3

In a service-oriented architecture (SOA), which component is primarily responsible for routing messages between services and enforcing security policies?

Accepted Answer

API gateway

Answer

An API gateway enforces authentication, authorization, rate limiting, and other security policies for services in an SOA or microservices environment.

Question 4

Which threat modeling methodology uses attack trees to enumerate potential attack paths against a system?

Accepted Answer

Attack tree analysis

Answer

Attack tree analysis visually represents attack paths as a tree structure, with the root being the attacker's goal and leaves being specific attack methods.

Question 5

What is the primary purpose of a security architecture review board?

Accepted Answer

To ensure new systems and changes align with the enterprise security architecture

Answer

A security architecture review board evaluates proposed systems and changes against established architectural standards before implementation.

CISSP - Certified Information Systems Security Professional Practice Test

CISSP - Certified Information Systems Security Professional Practice Test

CISSP Security Architecture 5