ISSAP - Information Systems Security Architecture Professional Architecting Cryptographic Solutions Questions and Answers

Question 1

A security architect is designing a system to protect sensitive data that will be stored for over 20 years.
The architect is concerned about the future threat of quantum computing rendering current asymmetric encryption algorithms obsolete.
Which of the following is the MOST important architectural principle to incorporate into the design to mitigate this long-term risk?

Accepted Answer

Cryptographic agility

Answer

Data fragmentation

Answer

Homomorphic encryption

Answer

Perfect forward secrecy

Question 2

A financial services company is architecting a new cloud-native application. The security architect must ensure that sensitive customer data is protected both when stored in cloud object storage and when transmitted between microservices. Which combination of cryptographic solutions BEST addresses this requirement?

Accepted Answer

TLS for data in transit and AES-256 for data at rest.

Answer

IPsec for all data communication and TDE for the database.

Answer

SSL for data at rest and SSH for data in transit.

Answer

Asymmetric key encryption for all data states.

Question 3

Which of the following is the PRIMARY reason for implementing a key rotation policy as part of a cryptographic key management lifecycle?

Accepted Answer

To limit the amount of data exposed if a key is compromised.

Answer

To improve cryptographic performance.

Answer

To comply with data retention policies.

Answer

To simplify the key backup and recovery process.

Question 4

A security architect is evaluating a proposal for a new enterprise-wide key management system. A key requirement is to prevent a single administrator from having complete control over the cryptographic keys, thereby preventing a single point of compromise. Which architectural concept should the architect ensure is implemented?

Accepted Answer

Split knowledge and separation of duties

Answer

Key escrow

Answer

Hardware Security Module (HSM) clustering

Answer

Centralized key generation

Question 5

When architecting a cryptographic solution for a multi-cloud environment, what is the most significant challenge a security architect must address regarding key management?

Accepted Answer

Maintaining consistent key management policies and control across different providers.

Answer

Selecting algorithms that are supported by all cloud providers.

Answer

Ensuring low latency for cryptographic operations.

Answer

Meeting FIPS 140-2 validation requirements for all keys.

Question 6

An organization is preparing for a transition to post-quantum cryptography (PQC) in anticipation of future threats. The security architect has been tasked with creating a readiness plan. Which of the following is the MOST critical first step in this plan?

Accepted Answer

Create an inventory of all systems and applications that use cryptography.

Answer

Immediately replace all RSA and ECC algorithms with PQC alternatives.

Answer

Procure quantum computing hardware for internal testing.

Answer

Decommission all systems that do not support cryptographic agility.