ISSAP - Information Systems Security Architecture Professional Security Operations Architecture Questions and Answers

Question 1

A global corporation with major offices in North America, Europe, and Asia needs to establish a 24/7 security monitoring capability.
The goal is to handle common alerts locally within each region for efficiency, while escalating complex, novel, or widespread threats to a central team of highly skilled experts for in-depth analysis and coordination.
Which Security Operations Center (SOC) model BEST fits this architectural requirement?

Accepted Answer

A tiered or hierarchical SOC with regional Tier 1/2 teams and a central Tier 3 command SOC.

Answer

A distributed SOC with fully independent regional teams.

Answer

A virtual SOC (VSOC) leveraging geographically dispersed analysts without a central command.

Answer

A co-managed SOC where a third-party manages all Tier 1 analysis globally.

Question 2

An architect is designing a Security Information and Event Management (SIEM) architecture for a large enterprise. A primary requirement is to process high-volume log data from thousands of diverse sources, including firewalls, servers, and custom applications, each with a unique format. Which SIEM component is fundamentally responsible for parsing these varied log formats into a standardized, common schema before they are sent to the correlation engine?

Accepted Answer

The data collection and normalization layer.

Answer

The reporting and dashboarding module.

Answer

The log storage and data lake.

Answer

The correlation and analytics engine.

Question 3

A Security Operations Center (SOC) is consistently overwhelmed by the high volume of phishing alerts. Analysts perform the same manual steps for each alert: analyze the email headers, detonate suspicious URLs in a sandbox, check indicators against threat intelligence feeds, and, if malicious, block the indicators and isolate the host. A security architect wants to implement a solution to automate this entire workflow. Which technology is specifically designed for this purpose?

Accepted Answer

Security Orchestration, Automation, and Response (SOAR)

Answer

User and Entity Behavior Analytics (UEBA)

Answer

Threat Intelligence Platform (TIP)

Answer

Endpoint Detection and Response (EDR)

Question 4

A security architect is establishing a proactive threat hunting program. The primary goal is to search for previously unknown or undetected threats that have bypassed existing security controls. Which of the following is the MOST critical architectural prerequisite for enabling effective, hypothesis-driven threat hunting?

Accepted Answer

A centralized, long-term repository of searchable endpoint, network, and log data.

Answer

An automated patching and vulnerability management system.

Answer

A complete set of incident response playbooks for all known threat types.

Answer

A real-time dashboard showing alerts from perimeter security devices.

Question 5

To enhance its security operations, an organization wants to operationalize threat intelligence. The architect's design calls for a central system that can ingest threat data from multiple feeds (e.g., open-source, commercial, ISACs), deduplicate and normalize the data, enrich it with context, and then share actionable indicators with other security tools like the SIEM, firewalls, and EDR. Which type of platform BEST describes this central system?

Accepted Answer

A Threat Intelligence Platform (TIP).

Answer

A vulnerability management platform.

Answer

A Security Orchestration, Automation, and Response (SOAR) platform.

Answer

A next-generation Security Information and Event Management (SIEM).

Question 6

A security architect is designing an infrastructure with the principle of "forensic readiness" in mind. The primary objective is to ensure that in the event of a security incident, reliable digital evidence can be collected efficiently and its integrity maintained for an investigation. Which architectural design choice is MOST foundational to achieving this objective?

Accepted Answer

Enabling comprehensive, immutable, and centrally-managed logging for all critical systems and network devices.

Answer

Deploying a deception technology grid to lure attackers.

Answer

Implementing the fastest available storage for all systems.

Answer

Mandating annual incident response tabletop exercises.