NSE Security Architecture & Design 4 — Questions and Answers
Question 1: What is the primary function of a Security Operations Center (SOC) in a mature security architecture?
- Designing firewall rules
- Continuous monitoring, detection, and response to security events (Correct answer)
- Managing software development pipelines
- Conducting annual penetration tests
Correct answer: Continuous monitoring, detection, and response to security events
A SOC provides 24/7 monitoring and response capabilities using SIEM and other tools to detect and remediate threats in real time.
Question 2: An architect needs to verify the integrity of firmware on network devices. Which security control directly addresses this requirement?
- Encrypting device configurations
- Secure boot with cryptographic signature verification (Correct answer)
- Multi-factor authentication for admin access
- Network-based anomaly detection
Correct answer: Secure boot with cryptographic signature verification
Secure boot ensures firmware is cryptographically signed and validated before execution, preventing tampered firmware from loading.
Question 3: In the context of cloud security architecture, what does the 'shared responsibility model' define?
- How cloud costs are split between teams
- Which security controls are the cloud provider's responsibility versus the customer's (Correct answer)
- The process for sharing encryption keys
- How to distribute workloads across availability zones
Correct answer: Which security controls are the cloud provider's responsibility versus the customer's
The shared responsibility model delineates which security duties (e.g., physical infrastructure vs. data, OS, applications) belong to the CSP versus the customer.
Question 4: Which protocol is used by FortiGate to synchronize session tables between HA cluster members?
- OSPF
- FGSP (FortiGate Session Life Support Protocol) (Correct answer)
- VRRP
- BGP
Correct answer: FGSP (FortiGate Session Life Support Protocol)
FGSP allows FortiGate peers to synchronize session tables so failover is stateful and connections are not dropped.
Question 5: A security architect must protect against insider threats accessing sensitive databases. Which control is most effective at the database layer?
- Network firewall between users and DB servers
- Database Activity Monitoring (DAM) with privileged user controls (Correct answer)
- Endpoint antivirus on workstations
- Email filtering
Correct answer: Database Activity Monitoring (DAM) with privileged user controls
DAM monitors and alerts on suspicious database queries, including those from privileged insiders, providing audit trails and anomaly detection.
Question 6: What is the key advantage of using SAML 2.0 for federated identity in an enterprise security architecture?
- It eliminates the need for passwords entirely
- It allows single sign-on across different organizations and service providers (Correct answer)
- It encrypts all user traffic end-to-end
- It provides multi-factor authentication natively
Correct answer: It allows single sign-on across different organizations and service providers
SAML 2.0 enables federated SSO, allowing users to authenticate once with their identity provider and access resources at multiple service providers.
Question 7: When evaluating a security architecture for compliance with NIST SP 800-53, which control family specifically addresses access management?
- SI – System and Information Integrity
- AC – Access Control (Correct answer)
- IR – Incident Response
- CP – Contingency Planning
Correct answer: AC – Access Control
The AC (Access Control) family in NIST SP 800-53 covers account management, separation of duties, and least privilege enforcement.
NSE Security Architecture & Design 4
What is the primary function of a Security Operations Center (SOC) in a mature security architecture?