CREST Security Architecture & Design 3

Question 1

What is the purpose of threat modeling in secure design?

Accepted Answer

To systematically identify, enumerate, and prioritize threats to a system

Answer

Threat modeling identifies potential threats and attack vectors during the design phase so that appropriate countermeasures can be designed in from the start.

Question 2

What does the MITRE ATT&CK framework provide to security architects?

Accepted Answer

A knowledge base of real-world adversary tactics, techniques, and procedures (TTPs)

Answer

MITRE ATT&CK documents real-world adversary behaviors organized by tactic categories, helping architects design defenses against known attack patterns.

Question 3

Which security design pattern ensures that sensitive data is encrypted at each layer of a multi-tier application?

Accepted Answer

End-to-end encryption with per-layer key management

Answer

End-to-end encryption with per-layer key management ensures data remains protected even if one tier is compromised, as each layer uses separate cryptographic controls.

Question 4

What is a security baseline in the context of architecture design?

Accepted Answer

A defined minimum set of security configurations that all systems must meet

Answer

A security baseline specifies the minimum security configuration standards required for systems, ensuring consistent protection across an environment.

Question 5

In a micro-segmented cloud architecture, what is the role of a security group?

Accepted Answer

To act as a virtual firewall controlling inbound and outbound traffic for cloud resources

Answer

Cloud security groups are stateful virtual firewalls that control which traffic is allowed to reach or leave specific cloud resource instances.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Security Architecture & Design 3