3.1 - Research, Implement and Manage Engineering Processes Using Secure Design Principles CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A multinational company has employees working from various locations and using cloud-based applications. The security team wants to provide secure access to these applications based on user identity and context, while also simplifying network management. Which solution BEST meets these requirements?

   • ADeploy a traditional VPN concentrator and require all remote users to connect to the corporate network before accessing cloud applications.
   • BUse a cloud access security broker (CASB) to monitor and control cloud application usage.
   • CImplement a Secure Access Service Edge (SASE) solution that combines network security functions with WAN capabilities and enforces policies based on identity and context.
   • DInstall a next-generation firewall (NGFW) at each branch office and route all traffic through it.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company is implementing a zero trust architecture. They have a mix of on-premises and cloud-based applications. The security team is evaluating different access control solutions. Which solution BEST aligns with the zero trust model?

   • ADeploy a VPN for remote users and rely on the corporate network perimeter for security.
   • BImplement a SASE solution that provides identity-based access to all applications, regardless of location, and continuously validates user and device posture.
   • CUse a firewall to segment the network and allow access based on IP addresses.
   • DGrant all users the same level of access to all applications to simplify management.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is developing a new fitness tracking app. The app will collect users' health data, including heart rate and exercise routines. The company wants to comply with privacy regulations and build user trust. Which approach BEST demonstrates privacy by design?

   • ACollect as much health data as possible to enable future features, and inform users in the privacy policy.
   • BAllow users to opt out of data collection after the app is installed, but collect data by default.
   • CStore all health data in an encrypted database and share it with third-party researchers for analysis.
   • DCollect only the data necessary for the app's core functionality, and provide users with clear controls to view, export, and delete their data.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of threat modeling in the system design process?

   • ATo identify and prioritize potential threats by analyzing assets, attack surfaces, and adversary capabilities
   • BTo verify that all users have the minimum permissions necessary to perform their job functions
   • CTo implement security controls after a system has been deployed and is in production
   • DTo assign specific security roles and responsibilities to individuals within the organization
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is an example of a fail-secure design?

   • AA firewall sends an alert to the administrator and then reboots
   • BA firewall allows all traffic by default when its rule set fails to load
   • CA firewall denies all traffic by default when its rule set fails to load
   • DA firewall logs the failure and continues to operate with the last known good rule set
   Reveal Solution Discussion Select an answer first