ISSAP - Information Systems Security Architecture Professional Infrastructure Security Design Questions and Answers

Question 1

An organization is migrating its data center to a hybrid cloud model. A security architect is tasked with defining security responsibilities for the new Infrastructure as a Service (IaaS) environment. According to the shared responsibility model, which of the following is the customer's primary responsibility?

Accepted Answer

Configuring operating system patches and managing user access controls.

Answer

In an IaaS model, the cloud provider is responsible for the security 'of' the cloud (physical infrastructure, network, hypervisor). The customer is responsible for security 'in' the cloud, which includes securing the guest operating systems, data, applications, identity, and access management. Therefore, configuring OS patches and managing user access falls squarely on the customer.

Question 2

A security architect is designing a network for a manufacturing plant that uses Industrial Control Systems (ICS) and SCADA for process automation. A primary security goal is to prevent threats from the corporate IT network from impacting the operational technology (OT) network. Which design principle is MOST critical to implement?

Accepted Answer

Strict network segmentation with a demilitarized zone (DMZ) between the IT and OT networks.

Answer

Strict network segmentation is a foundational security control for protecting ICS/SCADA environments. Creating a DMZ between the IT and OT networks allows for controlled and monitored communication while preventing direct traffic, which significantly reduces the risk of malware or attacks spreading from the less-secure corporate network to the critical OT environment. While other controls are valuable, segmentation provides the most critical architectural defense against this specific threat vector.

Question 3

Which of the following is a core principle of a Zero Trust Architecture (ZTA) that fundamentally changes the traditional network security paradigm?

Accepted Answer

Assuming breach and verifying each access request as if it originates from an open network.

Answer

Zero Trust Architecture is built on the principle of "never trust, always verify." It assumes that the network is always hostile and that an attacker may already be present. Therefore, every access request, regardless of its origin (inside or outside the traditional perimeter), must be explicitly authenticated and authorized before access is granted.

Question 4

An architect is applying the defense-in-depth strategy to secure a critical application server. The design includes a perimeter firewall, network segmentation, host-based intrusion prevention system (HIPS), application-level access controls, and data encryption. What is the primary purpose of this layered approach?

Accepted Answer

To ensure that if one security control fails, others may still be effective in stopping an attack.

Answer

The core concept of defense-in-depth is that no single security control is infallible. By implementing multiple, overlapping layers of security, the architecture creates redundancy. If an attacker bypasses one layer (e.g., the perimeter firewall), other layers (like network segmentation or HIPS) are in place to detect or prevent further progress, thus enhancing the overall resilience of the system.

Question 5

When designing a secure network infrastructure, which protocol suite is specifically designed to provide confidentiality, integrity, and authentication for data at the IP packet level, securing communications between two endpoints across a network?

Accepted Answer

Internet Protocol Security (IPsec)

Answer

IPsec operates at the network layer (Layer 3) and is designed to secure IP communications by authenticating and encrypting each IP packet in a data stream. It can be used to create secure VPNs and protect traffic between servers. TLS operates at the transport layer, securing application-to-application communication, while SSH and SFTP are application-layer protocols for secure remote access and file transfer, respectively.

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP - Information Systems Security Architecture Professional Practice Test

ISSAP - Information Systems Security Architecture Professional Infrastructure Security Design Questions and Answers