CREST Security Architecture & Design

Question 1

What is the principle of least privilege in security architecture?

Accepted Answer

Granting users only the minimum access rights needed for their role

Answer

Least privilege limits each user, process, or system to only the permissions required for legitimate tasks, reducing the attack surface.

Question 2

Which security architecture model enforces strict access controls based on data classification and clearance levels?

Accepted Answer

Bell-LaPadula model

Answer

The Bell-LaPadula model is a confidentiality-focused model that enforces 'no read up, no write down' rules based on security labels.

Question 3

What is defense in depth?

Accepted Answer

Layering multiple security controls so that failure of one does not compromise the whole system

Answer

Defense in depth applies multiple overlapping security controls at different layers so an attacker must bypass several independent defenses.

Question 4

What does a DMZ (Demilitarized Zone) in network architecture provide?

Accepted Answer

A segmented network zone for publicly accessible services, isolated from the internal network

Answer

A DMZ places externally facing services between two firewalls, limiting the damage if a public-facing server is compromised.

Question 5

Which architecture pattern separates an application into presentation, business logic, and data layers?

Accepted Answer

Three-tier architecture

Answer

Three-tier architecture divides applications into presentation, application logic, and data tiers, enabling independent security controls at each layer.

(CREST) Council for Registered Ethical Security Testers Practice Test

(CREST) Council for Registered Ethical Security Testers Practice Test

CREST Security Architecture & Design