Security Architecture Overview GMON Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security architect is using SABSA to develop a security architecture for a new product. The architect needs to define the monitoring requirements that align with the business's risk appetite. Which SABSA layer should the architect focus on to define what to monitor and why?

   • AThe Component Security Architecture layer, which defines specific products and configurations.
   • BThe Logical Security Architecture layer, which defines the services and components.
   • CThe Physical Security Architecture layer, which defines the technology and hardware.
   • DThe Contextual Security Architecture layer, which defines business requirements and risk.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which security architecture framework is primarily used as a general enterprise architecture framework that can be extended to include security considerations, but is not security-specific?

   • ATOGAF
   • BSABSA
   • CCIS Controls
   • DISO 27001
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A small company has a single firewall at the internet edge and no internal segmentation. After a malware infection spread to all workstations, the security team wants to prevent a single compromised host from affecting the entire network. Which change best applies the principle of least privilege?

   • ACreate a VLAN for each department and allow all traffic between VLANs to simplify management.
   • BReplace the edge firewall with a more expensive next-generation firewall that includes intrusion prevention.
   • CInstall host-based firewalls on every workstation and block all inbound connections except those explicitly required.
   • DDeploy an SIEM to collect logs from all workstations and alert on suspicious activity.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   A security architect wants to ensure that no single individual can both approve and execute a high-risk change to the firewall rulebase. Which security architecture principle is being applied?

   • ASeparation of duties
   • BDefense in depth
   • CFail-safe defaults
   • DLeast privilege
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A security team is designing a continuous monitoring program for a hybrid environment that includes on-premises servers and a public cloud. The team wants to ensure that all security events are collected in a central SIEM, but they are concerned about bandwidth costs and data residency requirements. Which approach best addresses these concerns?

   • AStore logs locally at each site and only send them to the central SIEM once a month for compliance reporting.
   • BDeploy log collectors at each site that filter and aggregate logs before forwarding only relevant events to the central SIEM, and use a SIEM region that meets data residency requirements.
   • CForward all logs from all sources directly to the central SIEM without filtering, to ensure no events are missed.
   • DUse a separate SIEM for the cloud and on-premises environments to avoid data transfer costs.
   Reveal Solution Discussion Select an answer first