CREST Security Architecture & Design 3

Question 1

What is the purpose of threat modeling in secure design?

Accepted Answer

To systematically identify, enumerate, and prioritize threats to a system

Answer

To patch vulnerabilities discovered during penetration testing

Answer

To monitor live traffic for anomalies

Answer

To document network topology

Question 2

What does the MITRE ATT&CK framework provide to security architects?

Accepted Answer

A knowledge base of real-world adversary tactics, techniques, and procedures (TTPs)

Answer

A checklist for firewall configuration

Answer

A set of cryptographic standards

Answer

A framework for incident response workflows

Question 3

Which security design pattern ensures that sensitive data is encrypted at each layer of a multi-tier application?

Accepted Answer

End-to-end encryption with per-layer key management

Answer

Transport layer security only

Answer

Database-level encryption only

Answer

Application-level tokenization only

Question 4

What is a security baseline in the context of architecture design?

Accepted Answer

A defined minimum set of security configurations that all systems must meet

Answer

The starting point before any security controls are applied

Answer

The lowest-security tier in a network zone model

Answer

The first scan result in a vulnerability assessment

Question 5

In a micro-segmented cloud architecture, what is the role of a security group?

Accepted Answer

To act as a virtual firewall controlling inbound and outbound traffic for cloud resources

Answer

To group users with similar job functions together

Answer

To define encryption policies for cloud storage

Answer

To manage identity federation across cloud providers

Question 6

Which concept in secure architecture design recommends exposing only necessary functionality through well-defined interfaces while hiding implementation details?

Accepted Answer

Encapsulation and minimizing attack surface

Answer

Open design

Answer

Security through obscurity

Answer

Full disclosure