Enterprise Security Architecture Flashcards

An organization requires a security architecture review of a new data warehouse. Which framework MOST comprehensively addresses data security requirements?

Answer: NIST SP 800-53

NIST SP 800-53 provides a comprehensive catalog of security and privacy controls applicable to federal and enterprise information systems, including data warehouses.

Which control BEST enforces separation of duties in a financial application's architecture?

Answer: Implementing role-based access control (RBAC) so no single role can both initiate and approve transactions

RBAC that separates initiator and approver roles enforces separation of duties, preventing a single user from completing a fraudulent transaction alone.

A security architect is designing a DMZ. Which placement is MOST appropriate for a public-facing web application server?

Answer: In the DMZ, behind the external firewall but before the internal firewall

Placing the web server in the DMZ isolates it from the internal network so that a compromise does not immediately expose internal systems.

Which architecture control MOST effectively protects sensitive data from compromised application code?

Answer: Hardware security modules (HSMs) for key management with application-layer encryption

HSMs store cryptographic keys in tamper-resistant hardware, so even fully compromised application code cannot extract the raw keys.

A CASP+ architect evaluates two competing security solutions. Which evaluation method provides the MOST objective comparison?

Answer: Conducting a proof of concept (PoC) against defined acceptance criteria

A PoC tested against pre-defined, measurable acceptance criteria provides objective evidence of how each solution performs in the specific environment.

Which approach BEST ensures that security architecture decisions remain aligned with business objectives over time?

Answer: Establishing a security governance committee with regular architecture review boards

A governance committee with scheduled architecture reviews ensures security controls evolve with the business, technology, and threat landscape.