ISSAP - Information Systems Security Architecture Professional Application and System Security Questions and Answers — Questions and Answers
Question 1: A security architect wants to implement a testing methodology that can identify insecure coding practices, such as potential SQL injection or buffer overflow vulnerabilities, by analyzing the application's source code without executing it. Which testing methodology should be chosen?
- Dynamic Application Security Testing (DAST)
- Interactive Application Security Testing (IAST)
- Static Application Security Testing (SAST) (Correct answer)
- Fuzz Testing
Correct answer: Static Application Security Testing (SAST)
Static Application Security Testing (SAST), also known as 'white-box' testing, analyzes an application's source code, byte code, or binary code for security vulnerabilities without executing the program. It is effective at finding issues like SQL injection, buffer overflows, and other insecure coding patterns early in the SDLC. DAST, or 'black-box' testing, analyzes a running application from the outside, while IAST combines elements of both. Fuzz testing involves providing invalid or random data to an application to see how it responds.
Question 2: To be most effective and least costly, a security architect should recommend that threat modeling be performed during which phase of the Secure Software Development Lifecycle (SSDLC)?
- Testing
- Deployment
- Maintenance
- Design (Correct answer)
Correct answer: Design
Threat modeling is most effective and cost-efficient when performed during the Design phase of the SSDLC. Identifying potential threats and architectural flaws at this early stage allows for security controls to be built into the system's blueprint, preventing expensive and time-consuming remediation that would be required if these issues were found later during testing or after deployment.
Question 3: A security architect is designing a multi-level secure (MLS) database for a government agency. The primary requirement is to prevent an inference attack where a user with a low clearance could deduce the existence of high-level data by observing an error or a null result. Which database security mechanism is specifically designed to mitigate this type of attack?
- Data Masking
- Polyinstantiation (Correct answer)
- Homomorphic Encryption
- Database Activity Monitoring (DAM)
Correct answer: Polyinstantiation
Polyinstantiation is a database security technique used in multi-level secure systems to prevent inference attacks. It allows multiple records with the same primary key to exist in the database, but with different security classifications. A user with a low clearance level would see a different, less-sensitive version of the record instead of an error, preventing them from inferring that a higher-classification record exists.
Question 4: A company is deploying microservices using Docker containers. The security architect is concerned about vulnerabilities within the third-party and open-source libraries included in the container images. Which of the following is the MOST effective control to implement early in the CI/CD pipeline to mitigate this specific risk?
- Runtime container security monitoring
- Implementing strict Kubernetes Network Policies
- Software Composition Analysis (SCA) (Correct answer)
- Enforcing mandatory access control (MAC) on host nodes
Correct answer: Software Composition Analysis (SCA)
Software Composition Analysis (SCA) tools are specifically designed to scan an application's dependencies, including container images, to identify all third-party and open-source components and their known vulnerabilities (CVEs). Integrating an SCA scanner into the CI/CD pipeline allows for early detection of vulnerable libraries before the container image is even stored in a registry or deployed.
Question 5: When architecting a baseline security configuration for new servers, the primary goal is to reduce the attack surface. Which of the following actions is the MOST fundamental and effective first step in achieving this goal?
- Implementing a host-based intrusion prevention system (HIPS)
- Enforcing a complex password policy
- Enabling full-disk encryption
- Removing all non-essential services, software, and ports (Correct answer)
Correct answer: Removing all non-essential services, software, and ports
The most fundamental principle of system hardening and reducing the attack surface is to remove or disable all functionality that is not strictly necessary for the system's business purpose. This includes uninstalling unused software packages, disabling unneeded services, and closing unnecessary network ports, which directly eliminates potential vectors an attacker could exploit. The other options are important security controls but are applied to protect the remaining services, not to reduce the number of services themselves.
Question 6: A security architect is defining the security verification requirements for a new web application that will handle sensitive medical data (PHI). The application requires the highest level of security assurance. According to the OWASP Application Security Verification Standard (ASVS), which level should be specified?
- Level 2
- Level 4
- Level 3 (Correct answer)
- Level 1
Correct answer: Level 3
The OWASP ASVS defines three security verification levels. Level 3 is the highest and most stringent level, intended for the most critical applications, such as those that handle high-value transactions, sensitive medical data, or any application requiring the highest level of trust. Level 1 is for low-assurance needs, and Level 2 is the standard for applications handling sensitive data. There is no Level 4 in the ASVS standard.
ISSAP - Information Systems Security Architecture Professional Application and System Security Questions and Answers
A security architect wants to implement a testing methodology that can identify insecure coding practices, such as potential SQL injection or buffer overflow vulnerabilities, by analyzing the application's source code without executing it.
Which testing methodology should be chosen?