CMA Risk Management & Security Architecture 2 — Questions and Answers
Question 1: Which security architecture concept ensures that users and systems are granted only the minimum permissions necessary to perform their required functions?
- Defense in Depth
- Least Privilege (Correct answer)
- Zero Trust
- Separation of Duties
Correct answer: Least Privilege
The Principle of Least Privilege limits access rights for users, accounts, and computing processes to only what is strictly required for their role.
Question 2: A Zero Trust Architecture (ZTA) model assumes which foundational principle about network location and user identity?
- Internal network users are inherently trusted
- No user or device is trusted by default, regardless of location (Correct answer)
- VPN usage guarantees secure access
- Perimeter firewalls provide sufficient protection
Correct answer: No user or device is trusted by default, regardless of location
Zero Trust operates on the principle of 'never trust, always verify,' requiring continuous authentication and authorization for every user and device.
Question 3: In a risk register, what does 'residual risk' refer to?
- Risk identified but not yet assessed
- Risk remaining after controls have been applied (Correct answer)
- Risk transferred to a third party
- Risk that has been fully mitigated
Correct answer: Risk remaining after controls have been applied
Residual risk is the level of risk that remains after security controls and mitigations have been implemented, which organizations must accept or further reduce.
Question 4: Which NIST publication provides a comprehensive catalog of security and privacy controls for federal information systems, commonly used in US government architecture?
- NIST SP 800-37
- NIST SP 800-53 (Correct answer)
- NIST SP 800-171
- NIST SP 800-61
Correct answer: NIST SP 800-53
NIST SP 800-53 provides a catalog of security and privacy controls organized into families for protecting federal information systems and organizations.
Question 5: Which architectural approach segments a network into smaller isolated zones to contain breaches and limit lateral movement by attackers?
- Network Address Translation
- Micro-segmentation (Correct answer)
- Load Balancing
- Content Delivery Network
Correct answer: Micro-segmentation
Micro-segmentation divides the network into fine-grained security zones, preventing attackers from moving laterally between workloads after an initial breach.
Question 6: A CMA architect is performing a Business Impact Analysis (BIA); which metric defines the maximum tolerable period that a business process can be offline before causing unacceptable harm?
- Recovery Point Objective (RPO)
- Recovery Time Objective (RTO)
- Maximum Tolerable Downtime (MTD) (Correct answer)
- Mean Time to Repair (MTTR)
Correct answer: Maximum Tolerable Downtime (MTD)
Maximum Tolerable Downtime (MTD) specifies the longest time a business process can be unavailable before the organization suffers irreversible damage.
CMA Risk Management & Security Architecture 2
Which security architecture concept ensures that users and systems are granted only the minimum permissions necessary to perform their required functions?