CREST Security Architecture & Design 1 — Questions and Answers
Question 1: What is the principle of least privilege in security architecture?
- Granting users only the minimum access rights needed for their role (Correct answer)
- Giving administrators full access to all systems
- Allowing all users read access by default
- Restricting network access to a single VLAN
Correct answer: Granting users only the minimum access rights needed for their role
Least privilege limits each user, process, or system to only the permissions required for legitimate tasks, reducing the attack surface.
Question 2: Which security architecture model enforces strict access controls based on data classification and clearance levels?
- Bell-LaPadula model (Correct answer)
- Biba model
- Clark-Wilson model
- Brewer-Nash model
Correct answer: Bell-LaPadula model
The Bell-LaPadula model is a confidentiality-focused model that enforces 'no read up, no write down' rules based on security labels.
Question 3: What is defense in depth?
- Layering multiple security controls so that failure of one does not compromise the whole system (Correct answer)
- Using a single highly secure firewall
- Encrypting all data at rest and in transit
- Conducting regular penetration tests
Correct answer: Layering multiple security controls so that failure of one does not compromise the whole system
Defense in depth applies multiple overlapping security controls at different layers so an attacker must bypass several independent defenses.
Question 4: What does a DMZ (Demilitarized Zone) in network architecture provide?
- A segmented network zone for publicly accessible services, isolated from the internal network (Correct answer)
- A zone where no security controls are enforced
- A backup network for disaster recovery
- A VLAN reserved for management traffic
Correct answer: A segmented network zone for publicly accessible services, isolated from the internal network
A DMZ places externally facing services between two firewalls, limiting the damage if a public-facing server is compromised.
Question 5: Which architecture pattern separates an application into presentation, business logic, and data layers?
- Three-tier architecture (Correct answer)
- Monolithic architecture
- Peer-to-peer architecture
- Serverless architecture
Correct answer: Three-tier architecture
Three-tier architecture divides applications into presentation, application logic, and data tiers, enabling independent security controls at each layer.
Question 6: What is the purpose of network segmentation in security architecture?
- To limit the lateral movement of attackers by isolating network zones (Correct answer)
- To increase network throughput and reduce latency
- To simplify network management
- To enable full mesh connectivity between all hosts
Correct answer: To limit the lateral movement of attackers by isolating network zones
Network segmentation divides a network into isolated zones, limiting the blast radius of a breach by preventing unrestricted lateral movement.
CREST Security Architecture & Design 1
What is the principle of least privilege in security architecture?