Architecture & Design Flashcards

A security team implements a system that automatically revokes and rotates credentials when anomalous API usage is detected. This is an example of which security architecture principle?

Answer: Automated response and orchestration

Automated response and orchestration (SOAR) reduces dwell time by triggering remediation actions such as credential rotation without human intervention.

Which data security technique replaces sensitive data elements with non-sensitive placeholders that retain the format but have no exploitable value outside the specific system?

Answer: Tokenization

Tokenization substitutes sensitive data (e.g., a credit card number) with a token that is meaningless outside the tokenization system, reducing PCI DSS scope.

An enterprise CISO wants to ensure that cloud-hosted workloads adhere to security baselines continuously, not just at deployment time. Which tool category addresses this requirement?

Answer: Cloud Security Posture Management (CSPM)

CSPM tools continuously monitor cloud environments for configuration drift and compliance violations against defined security baselines.

A company needs employees to prove their identity using something they know, something they have, and something they are before accessing sensitive systems. This is an example of:

Answer: Multi-factor authentication (MFA)

MFA combines multiple authentication factors—knowledge, possession, and inherence—to significantly reduce the risk of unauthorized access.

A network architect is designing a campus with multiple buildings. To prevent a broadcast storm in one building from affecting others, which design technique should be used?

Answer: VLAN segmentation per building

VLANs logically isolate broadcast domains so that a storm or failure in one VLAN does not propagate to VLANs in other buildings.

During a threat model, the team identifies that an attacker could intercept communications between internal microservices. Which control directly mitigates this east-west traffic threat?

Answer: Mutual TLS (mTLS) between all microservices

Mutual TLS (mTLS) ensures that both the client and server microservices authenticate each other and encrypt the channel, protecting east-west traffic from interception or spoofing.

A cloud provider offers a shared responsibility model. For a SaaS application, which security domain is the customer primarily responsible for?

Answer: User access management and data governance

In the SaaS model, the provider manages infrastructure through the application layer; the customer is responsible for managing user identities, access controls, and the data they store.