Security Architecture Design Flashcards

An organization is shifting its security posture from a traditional perimeter-based model to one that mandates verification for every access request, regardless of whether it originates from inside or outside the corporate network. Which security architecture model BEST represents this modern approach?

Answer: Zero Trust Architecture

Zero Trust Architecture is a security model based on the principle of "never trust, always verify." It requires strict identity verification for every user and device trying to access resources on a private network, eliminating the concept of a trusted internal network.

During the security architecture design phase for a new cloud-native application, an architect leads a structured exercise to identify and evaluate potential security flaws from an attacker's perspective. What is this proactive process called?

Answer: Threat Modeling

Threat modeling is a structured, proactive process used early in the development lifecycle to identify, analyze, and mitigate potential security threats and architectural weaknesses before the system is built. Penetration testing and vulnerability scanning are typically performed on a system that has already been built.

Which of the following scenarios is the BEST example of implementing the 'Defense-in-Depth' principle?

Answer: Using a combination of network firewalls, endpoint anti-malware, data encryption, and multi-factor authentication to protect a critical database.

Defense-in-Depth is a strategy that employs multiple layers of security controls to protect an asset. The idea is that if one control fails, another is in place to stop an attack. Using firewalls, anti-malware, encryption, and MFA together is a perfect example of this layered approach, whereas the other options represent single security controls.

An architect for a financial institution is designing security controls for a new wealth management platform. To comply with regulations, customer financial data must have stronger encryption and more restrictive access policies than marketing materials. What is the MOST critical prerequisite activity to enable this differentiated approach to security?

Answer: Data Classification

Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements. This process is a fundamental prerequisite for applying appropriate security controls, as you cannot protect what you have not identified and valued. Once data is classified, appropriate controls like encryption and access policies can be applied.

An enterprise security architect is tasked with developing a comprehensive security architecture. A key requirement is that the entire architecture must be derived from and directly traceable to the organization's business objectives and risk tolerance. Which security architecture framework is specifically designed with this business-driven methodology at its core?

Answer: SABSA (Sherwood Applied Business Security Architecture)

SABSA is a methodology renowned for being business-driven. It starts with analyzing business requirements, goals, and risk appetite to create a security architecture where every control is traceable back to a business need. While TOGAF and Zachman are enterprise architecture frameworks, they are not as specifically focused on a business-risk-driven approach for security as SABSA is. ITIL is a framework for IT service management.

An architect specifies that a new application's service account, which is used to process automated reports, must only have read-only access to a specific database table and no other permissions within the system. Which fundamental security design principle does this specification enforce?

Answer: Principle of Least Privilege

The Principle of Least Privilege (PoLP) dictates that a user, program, or process should have only the minimum necessary access rights (or permissions) to perform its specific function. By restricting the service account to only read-only access for a single table, the architect is strictly applying this principle.