ISSAP - Information Systems Security Architecture Professional Infrastructure Security Design Questions and Answers

Question 1

An organization is migrating its data center to a hybrid cloud model.
A security architect is tasked with defining security responsibilities for the new Infrastructure as a Service (IaaS) environment.
According to the shared responsibility model, which of the following is the customer's primary responsibility?

Accepted Answer

Configuring operating system patches and managing user access controls.

Answer

Securing the physical data center and network infrastructure.

Answer

Managing virtualization software (the hypervisor).

Answer

Ensuring the security of the cloud provider's hardware.

Question 2

A security architect is designing a network for a manufacturing plant that uses Industrial Control Systems (ICS) and SCADA for process automation. A primary security goal is to prevent threats from the corporate IT network from impacting the operational technology (OT) network. Which design principle is MOST critical to implement?

Accepted Answer

Strict network segmentation with a demilitarized zone (DMZ) between the IT and OT networks.

Answer

Implementing end-to-end encryption for all SCADA traffic.

Answer

Deploying a host-based intrusion detection system on all PLCs.

Answer

Enforcing multi-factor authentication for all corporate users.

Question 3

Which of the following is a core principle of a Zero Trust Architecture (ZTA) that fundamentally changes the traditional network security paradigm?

Accepted Answer

Assuming breach and verifying each access request as if it originates from an open network.

Answer

Trusting all traffic originating from within the corporate firewall.

Answer

Establishing a single, hardened network perimeter to keep attackers out.

Answer

Relying solely on network location for access control decisions.

Question 4

An architect is applying the defense-in-depth strategy to secure a critical application server. The design includes a perimeter firewall, network segmentation, host-based intrusion prevention system (HIPS), application-level access controls, and data encryption. What is the primary purpose of this layered approach?

Accepted Answer

To ensure that if one security control fails, others may still be effective in stopping an attack.

Answer

To eliminate the need for security monitoring and logging.

Answer

To focus all security resources on preventing initial network penetration.

Answer

To meet the minimum compliance requirements with a single security solution.

Question 5

When designing a secure network infrastructure, which protocol suite is specifically designed to provide confidentiality, integrity, and authentication for data at the IP packet level, securing communications between two endpoints across a network?

Accepted Answer

Internet Protocol Security (IPsec)

Answer

Transport Layer Security (TLS)

Answer

Secure Shell (SSH)

Answer

Secure File Transfer Protocol (SFTP)

Question 6

A financial institution is undergoing a security architecture review. The architect notes that the current network is a large, flat design where application servers, user workstations, and development systems all reside on the same broadcast domain. Which security design practice would provide the MOST significant improvement in limiting the lateral movement of an attacker?

Accepted Answer

Performing network segmentation using VLANs and firewalls.

Answer

Implementing a new password complexity policy.

Answer

Deploying a Web Application Firewall (WAF) for the public-facing website.

Answer

Upgrading all network switches to the latest firmware.