CREST Security Architecture & Design 2

Question 1

What is a zero-trust security model?

Accepted Answer

Never trust, always verify — every request must be authenticated and authorized regardless of network location

Answer

Zero trust assumes no implicit trust based on network location and requires continuous verification of identity and authorization for every request.

Question 2

Which STRIDE threat category relates to an attacker pretending to be a legitimate user or system?

Accepted Answer

Spoofing

Answer

Spoofing in STRIDE refers to falsely claiming an identity, such as impersonating a legitimate user, service, or IP address.

Question 3

What is the primary goal of a security architecture review?

Accepted Answer

Identifying security weaknesses in a system's design before implementation or deployment

Answer

A security architecture review examines design decisions to identify risks and weaknesses early, when they are cheapest to remediate.

Question 4

Which concept ensures that no single individual can complete a critical task without involvement from another person?

Accepted Answer

Separation of duties

Answer

Separation of duties requires that sensitive tasks be divided among multiple people to prevent fraud and reduce insider threat risk.

Question 5

What does the term 'attack surface' refer to in security architecture?

Accepted Answer

The sum of all exploitable entry points and vulnerabilities in a system

Answer

The attack surface encompasses all pathways and interfaces through which an attacker could attempt to access or compromise a system.

(CREST) Council for Registered Ethical Security Testers Practice Test