ISSAP - Information Systems Security Architecture Professional Cloud and Hybrid Architectures Questions and Answers — Questions and Answers
Question 1: An organization has discovered that numerous employees are using unauthorized SaaS applications for business purposes, creating a significant 'shadow IT' problem. A security architect needs to recommend a solution that provides visibility into all cloud services in use, enforces data loss prevention (DLP) policies, and offers threat protection for sanctioned and unsanctioned applications. Which of the following is the MOST appropriate architectural component to address these requirements?
- Secure Web Gateway (SWG)
- Web Application Firewall (WAF)
- Cloud Access Security Broker (CASB) (Correct answer)
- Zero Trust Network Access (ZTNA) Controller
Correct answer: Cloud Access Security Broker (CASB)
A Cloud Access Security Broker (CASB) is specifically designed to address the security gaps created by cloud service usage, including shadow IT. A CASB sits between an organization's on-premises infrastructure and a cloud provider's infrastructure to enforce security policies as users access cloud-based resources. Key functions include discovering all cloud apps in use (sanctioned and unsanctioned), applying DLP policies to data in transit and at rest, and protecting against cloud-based threats.
Question 2: A security architect is designing a new network architecture for a highly distributed organization with a large remote workforce and extensive use of cloud applications. The goal is to move away from a traditional hub-and-spoke model that backhauls traffic to a central data center. Which of the following frameworks converges network and security functions into a single, cloud-delivered service, providing optimized and secure access for users regardless of their location?
- Microsegmentation
- Secure Access Service Edge (SASE) (Correct answer)
- Defense-in-Depth
- Intrusion Prevention System (IPS)
Correct answer: Secure Access Service Edge (SASE)
Secure Access Service Edge (SASE) is an architectural framework that converges networking capabilities (like SD-WAN) with cloud-native security functions (like CASB, FWaaS, and ZTNA) into a single, cloud-delivered service. This model is designed to provide secure and optimized access to applications and data for a distributed workforce, eliminating the need to backhaul traffic to a central data center for security inspection.
Question 3: An organization is deploying a new application using a microservices architecture running in containers managed by Kubernetes. The security architect is concerned about unauthorized communication between different microservices (pods) once an attacker compromises a single container. Which of the following Kubernetes-native controls is the MOST effective for enforcing a Zero Trust policy and restricting this lateral movement?
- Implementing Pod Security Policies (PSPs)
- Using a secrets management vault
- Enforcing strict Role-Based Access Control (RBAC) on the API server
- Applying default-deny Network Policies (Correct answer)
Correct answer: Applying default-deny Network Policies
Kubernetes Network Policies are the primary native mechanism for controlling traffic flow at the IP address or port level (OSI layer 3 or 4) between pods. By implementing a default-deny policy and then explicitly allowing only required communication paths between microservices, an architect can enforce a Zero Trust, least-privilege network model. This directly limits an attacker's ability to move laterally within the cluster.
Question 4: Which of the following represents the MOST significant security challenge unique to a serverless (FaaS) architecture compared to a traditional Infrastructure as a Service (IaaS) model where the organization manages the full OS?
- The need for vulnerability scanning of operating systems and kernel patching.
- An expanded and more complex attack surface due to event-triggers and function-to-function interactions. (Correct answer)
- The requirement to configure network-level firewalls and security groups.
- The responsibility for physical security of the data center hardware.
Correct answer: An expanded and more complex attack surface due to event-triggers and function-to-function interactions.
In a serverless architecture, the attack surface shifts from the underlying OS (which is managed by the cloud provider) to the functions themselves and their triggers. Each function can be triggered by numerous event sources (HTTP APIs, storage events, message queues), creating many more entry points for an attacker. Securing the interactions and permissions between dozens or hundreds of ephemeral functions introduces a complexity not present in managing a few monolithic VMs.
Question 5: A financial services firm is architecting a hybrid cloud solution that requires a stable, high-bandwidth, and low-latency connection for replicating large volumes of sensitive transaction data between its on-premises data center and its cloud environment. Public internet performance variability is not acceptable. Which connectivity method BEST meets these requirements?
- A site-to-site IPsec VPN over the public internet
- A dedicated private network connection (e.g., AWS Direct Connect, Azure ExpressRoute) (Correct answer)
- An SSL VPN established from each on-premises server to the cloud
- A multi-region VPC peering connection
Correct answer: A dedicated private network connection (e.g., AWS Direct Connect, Azure ExpressRoute)
A dedicated private network connection, such as AWS Direct Connect or Azure ExpressRoute, provides a private, physical link between the on-premises environment and the cloud provider's network. This approach bypasses the public internet entirely, resulting in consistent low latency, high bandwidth, and enhanced security, making it ideal for performance-sensitive and critical workloads like large-scale data replication.
Question 6: A company operates a large, multi-cloud environment and is struggling to maintain a consistent security baseline. The security team needs a tool that can continuously scan cloud infrastructure configurations across AWS, Azure, and GCP to detect misconfigurations, compliance violations, and security risks in real-time. Which category of security tool is specifically designed for this purpose?
- Cloud Workload Protection Platform (CWPP)
- Security Information and Event Management (SIEM)
- Cloud Security Posture Management (CSPM) (Correct answer)
- Next-Generation Firewall (NGFW)
Correct answer: Cloud Security Posture Management (CSPM)
Cloud Security Posture Management (CSPM) tools are designed to provide visibility and continuous monitoring of cloud infrastructure. They automatically detect and alert on misconfigurations, policy violations, and compliance risks by comparing the current state of cloud resources against security best practices and compliance frameworks. In contrast, a CWPP focuses on protecting the individual workloads (like VMs and containers) running in the cloud.
ISSAP - Information Systems Security Architecture Professional Cloud and Hybrid Architectures Questions and Answers
An organization has discovered that numerous employees are using unauthorized SaaS applications for business purposes, creating a significant 'shadow IT' problem.
A security architect needs to recommend a solution that provides visibility into all cloud services in use, enforces data loss prevention (DLP) policies, and offers threat protection for sanctioned and unsanctioned applications.
Which of the following is the MOST appropriate architectural component to address these requirements?