Mixed Deck — All ISSAP Topics Flashcards

A security architect must ensure that sensitive network traffic between data centers is protected in transit. Which solution provides both confidentiality and integrity for this traffic?

Answer: IPsec tunnel mode between data center gateways

IPsec tunnel mode encrypts the entire original IP packet and provides both confidentiality and integrity verification, protecting data in transit between data centers.

A financial services company is architecting a new cloud-native application. The security architect must ensure that sensitive customer data is protected both when stored in cloud object storage and when transmitted between microservices. Which combination of cryptographic solutions BEST addresses this requirement?

Answer: TLS for data in transit and AES-256 for data at rest.

The question requires protection for two distinct data states: data at rest (stored in object storage) and data in transit (transmitted between services). Transport Layer Security (TLS) is the standard protocol for encrypting data in transit over a network. Advanced Encryption Standard (AES) with a 256-bit key is a widely adopted, strong symmetric algorithm for encrypting data at rest. This combination directly and effectively addresses both requirements of the scenario.

What is the purpose of a digital signature?

Answer: To verify the authenticity and integrity of a message

A digital signature uses cryptographic techniques to provide assurance about the origin and integrity of a digital message or document. It verifies that the message has not been altered since it was signed and confirms the identity of the signer, ensuring non-repudiation.

A company operates a large, multi-cloud environment and is struggling to maintain a consistent security baseline. The security team needs a tool that can continuously scan cloud infrastructure configurations across AWS, Azure, and GCP to detect misconfigurations, compliance violations, and security risks in real-time. Which category of security tool is specifically designed for this purpose?

Answer: Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM) tools are designed to provide visibility and continuous monitoring of cloud infrastructure. They automatically detect and alert on misconfigurations, policy violations, and compliance risks by comparing the current state of cloud resources against security best practices and compliance frameworks. In contrast, a CWPP focuses on protecting the individual workloads (like VMs and containers) running in the cloud.

In a traditional three-tier network architecture, what is the primary security purpose of a DMZ (Demilitarized Zone)?

Answer: To isolate publicly accessible services from the internal network

The DMZ hosts publicly accessible services (e.g., web servers) while isolating them from the internal network, so external threats cannot directly reach internal resources.

Which network security architecture model uses software-defined perimeters to make infrastructure invisible to unauthorized users before authentication occurs?

Answer: Software-Defined Perimeter (SDP) / Zero Trust Network Access (ZTNA)

SDP/ZTNA makes network resources invisible (dark) to unauthenticated users and only establishes encrypted connections to specific resources after identity and device posture are verified.

When architecting a cryptographic solution for a multi-cloud environment, what is the most significant challenge a security architect must address regarding key management?

Answer: Maintaining consistent key management policies and control across different providers.

Each cloud service provider (CSP) has its own native key management service (KMS) with different APIs, policies, and capabilities. In a multi-cloud architecture, maintaining a consistent and centralized approach to key management policies, access control, and auditing becomes a major challenge. An architect must decide between using native tools, which leads to fragmented control, or implementing a third-party or hybrid KMS to achieve uniform governance across all cloud environments.

A security architect is tasked with developing a security architecture that is tightly aligned with business objectives and integrates risk management throughout the entire lifecycle of enterprise systems. Which of the following frameworks is MOST suitable for this purpose due to its business-driven approach?

Answer: SABSA

SABSA (Sherwood Applied Business Security Architecture) is specifically designed as a business-driven security architecture framework. It starts by analyzing business requirements and uses a risk-based approach to develop a security architecture that supports business goals. TOGAF is a general enterprise architecture framework, Zachman is an ontology for organizing artifacts, and STRIDE is a threat modeling methodology, not a comprehensive architecture framework.

When designing a federated identity solution using Security Assertion Markup Language (SAML), what is the primary role of the Identity Provider (IdP)?

Answer: To authenticate the user and issue a security assertion containing identity information.

In a SAML federation, the Identity Provider (IdP) is the entity responsible for authenticating the user and, upon successful authentication, creating a security assertion (a SAML token) that contains information about the user's identity and attributes. This assertion is then sent to the Service Provider (SP), which consumes it to make an authorization decision. The SP hosts the resource. While an IdP uses a directory, its primary role in the federation is authentication and assertion issuance.

A security architect is designing the identity lifecycle management process for a large enterprise. The architect must ensure that access rights are correctly assigned when an employee is hired, adjusted when they change roles, and revoked promptly when they leave. Which of the following frameworks is specifically designed to address these stages of the identity lifecycle?

Answer: Joiner-Mover-Leaver (JML)

The Joiner-Mover-Leaver (JML) framework is a core process within identity and access management that specifically outlines the procedures for onboarding (Joiner), role changes (Mover), and offboarding (Leaver). It ensures that user access privileges are managed dynamically and appropriately throughout their tenure with an organization, enforcing principles like least privilege. The other options are enterprise architecture frameworks, not specific IAM process models.

A security architect is evaluating a proposal for a new enterprise-wide key management system. A key requirement is to prevent a single administrator from having complete control over the cryptographic keys, thereby preventing a single point of compromise. Which architectural concept should the architect ensure is implemented?

Answer: Split knowledge and separation of duties

Split knowledge and separation of duties are core principles in key management that ensure no single person has unilateral access to or control over the entire key management process. Split knowledge involves dividing a key or access to keys among multiple individuals, while separation of duties ensures that different stages of the key lifecycle (e.g., generation, use, revocation) are controlled by different people or roles. This prevents a single compromised administrator from compromising the entire cryptographic system.

Which of the following is used to determine the likelihood and impact of a risk?

Answer: Quantitative analysis

Both quantitative and qualitative analysis are used to determine the likelihood and impact of a risk. Qualitative analysis uses descriptive terms (e.g., high, medium, low) for impact and likelihood, while quantitative analysis assigns numerical values and probabilities, often leading to a monetary value of risk.

An architect is designing a Security Information and Event Management (SIEM) architecture for a large enterprise. A primary requirement is to process high-volume log data from thousands of diverse sources, including firewalls, servers, and custom applications, each with a unique format. Which SIEM component is fundamentally responsible for parsing these varied log formats into a standardized, common schema before they are sent to the correlation engine?

Answer: The data collection and normalization layer.

The data collection and normalization layer is the core component responsible for this function. [5] Collectors or agents gather raw logs from various sources. [1, 3] The normalization process then parses the different log formats, extracts key fields, and transforms them into a common, standardized format (schema). This step is critical because the correlation engine requires a consistent data structure to apply rules and detect patterns across disparate data sources effectively. [3]

A large, multinational corporation is designing an access control architecture for a new, highly dynamic environment. The system must support fine-grained access decisions based on a user's role, their geographic location, the time of day, and the data sensitivity of the resource being accessed. Traditional access control models are proving too static. Which of the following access control models would be MOST suitable for this architecture?

Answer: Attribute-Based Access Control (ABAC)

Attribute-Based Access Control (ABAC) is the most suitable model because it makes access decisions based on a combination of attributes of the user, resource, action, and environment. This allows for the creation of dynamic, context-aware policies that can handle the complexity described in the scenario (role, location, time, data sensitivity). RBAC is limited to user roles, while DAC is user-managed and MAC is based on security labels, neither of which provide the required flexibility.

What is the primary purpose of identity federation?

Answer: To enable seamless access across multiple systems or organizations

Identity federation allows users to use a single set of login credentials to access resources across different, independent security domains or applications without needing to re-authenticate. This enhances user experience and simplifies identity management, especially in cloud environments or inter-organizational collaborations.

Which of the following is the primary goal of security design principles?

Answer: To reduce vulnerabilities and mitigate risks

The primary goal of security design principles is to build systems that are inherently resilient against attacks. By incorporating these principles, architects aim to minimize potential weaknesses (vulnerabilities) and reduce the likelihood and impact of security incidents (risks).

To be most effective and least costly, a security architect should recommend that threat modeling be performed during which phase of the Secure Software Development Lifecycle (SSDLC)?

Answer: Design

Threat modeling is most effective and cost-efficient when performed during the Design phase of the SSDLC. Identifying potential threats and architectural flaws at this early stage allows for security controls to be built into the system's blueprint, preventing expensive and time-consuming remediation that would be required if these issues were found later during testing or after deployment.

A security architect is designing an infrastructure with the principle of "forensic readiness" in mind. The primary objective is to ensure that in the event of a security incident, reliable digital evidence can be collected efficiently and its integrity maintained for an investigation. Which architectural design choice is MOST foundational to achieving this objective?

Answer: Enabling comprehensive, immutable, and centrally-managed logging for all critical systems and network devices.

Forensic readiness is a proactive approach to prepare for investigations before an incident occurs. [24] The most critical foundation is having a reliable record of events. Enabling comprehensive logging across all relevant assets provides the raw data needed for analysis. [31] Ensuring these logs are immutable (write-once, read-many) and centrally managed prevents tampering and guarantees that a verifiable trail of evidence is available for investigators, forming the basis of any digital forensic investigation. [24, 31]

When architecting a baseline security configuration for new servers, the primary goal is to reduce the attack surface. Which of the following actions is the MOST fundamental and effective first step in achieving this goal?

Answer: Removing all non-essential services, software, and ports

The most fundamental principle of system hardening and reducing the attack surface is to remove or disable all functionality that is not strictly necessary for the system's business purpose. This includes uninstalling unused software packages, disabling unneeded services, and closing unnecessary network ports, which directly eliminates potential vectors an attacker could exploit. The other options are important security controls but are applied to protect the remaining services, not to reduce the number of services themselves.

As a security architect for a financial services company, you are evaluating solutions to streamline user access across dozens of cloud-based (SaaS) and on-premises applications. The primary goals are to improve user experience with single sign-on (SSO), centralize identity management, and reduce the administrative burden of managing credentials in multiple systems. Which of the following architectural approaches BEST meets these requirements?

Answer: Adopting an Identity as a Service (IDaaS) solution.

Identity as a Service (IDaaS) is a cloud-based subscription model that provides comprehensive identity and access management capabilities, including Single Sign-On (SSO), multi-factor authentication, and centralized user management. This directly addresses the company's need to streamline access across hybrid environments, improve user experience, and reduce administrative overhead. A SIEM is for monitoring, a HIDS is for host-level threat detection, and a manual process would increase, not decrease, administrative burden.