3.1 - Research, Implement and Manage Engineering Processes Using Secure Design Principles CISSP Practice Questions (Page 5)

Questions 21–24

1. 21application · medium

   A healthcare startup is developing a mobile app that collects patient health data. The product team wants to ensure that the app complies with privacy regulations. Which approach BEST demonstrates privacy by design?

   • ACollect only the minimum health data necessary for the app's core functionality, and allow users to control how their data is shared.
   • BCollect as much data as possible to enable future features, and inform users in the privacy policy.
   • CStore all health data in an encrypted database and share it with third-party researchers for analysis.
   • DAllow users to opt out of data collection after the app is installed, but collect data by default.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is an example of defense in depth?

   • AUsing a firewall, an intrusion detection system, and encryption together to protect a network
   • BUsing a single strong password policy for all systems
   • CInstalling antivirus software on all endpoints
   • DEncrypting all data at rest and in transit
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the 'trust but verify' approach?

   • AEstablish trust and then continuously validate that trust
   • BVerify all users and devices only when a security incident occurs
   • CTrust all users without any verification
   • DVerify users only when they access the system for the first time
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company is deploying a new web application that will be accessible from the internet. The application will store sensitive customer data. The security architect is designing the network architecture. The company has a limited budget and must choose between two options: (1) a single firewall with an intrusion prevention system (IPS) and a web application firewall (WAF), or (2) a DMZ with a firewall, a separate application server, and a database server on a separate network segment. Which option provides BETTER defense in depth?

   • AOption 1, because it is simpler to manage and reduces the attack surface.
   • BOption 1, because the IPS and WAF provide multiple layers of protection at the network edge.
   • COption 2, because it separates the application and database servers, providing multiple layers of protection even if the web server is compromised.
   • DBoth options provide equal defense in depth because they both use multiple security controls.
   Reveal Solution Discussion Select an answer first