Define Secure Operational Architecture (e.g., Deployment Topology, Operational Interfaces, Continuous Integration and Continuous Delivery (CI/CD)) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company is designing a disaster recovery plan for its multi-tier application. The security architect must ensure that the environment can be recovered quickly after a security incident while maintaining forensic integrity. Which design should be implemented?

   • AStore backups in a public cloud bucket without encryption to ensure they are easily accessible during recovery.
   • BUse a replication mechanism that continuously copies data to a secondary site, but do not test the recovery process.
   • CKeep a single backup of the entire application on the same physical server as the production environment for easy access.
   • DMaintain encrypted backups of all tiers, store them in a separate region, and document a recovery runbook that includes validating the integrity of the restored environment.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a security baseline in secure configuration management?

   • ATo document the history of all configuration changes
   • BTo provide a default password for all systems
   • CTo list all software licenses used in the organization
   • DTo define a minimum set of security settings that must be applied to systems
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Why is change control important in secure configuration management?

   • AIt speeds up the deployment of new features without any review
   • BIt eliminates the need for configuration backups
   • CIt allows administrators to make changes without documentation
   • DIt ensures that all configuration changes are reviewed and approved before implementation
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In a microservices deployment topology, which security challenge is most prominent compared to a monolithic application?

   • AIncreased attack surface due to many inter-service communication channels
   • BNo need for centralized logging because each service is isolated
   • CSimplified network security because all services run in one process
   • DA single point of failure for the entire application
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services company exposes a set of REST APIs to third-party partners. The security architect must protect these operational interfaces while allowing partners to integrate with the system. Which control should be implemented?

   • ADisable the APIs and provide partners with direct database access to retrieve data.
   • BAllow all partners to use a shared API key, and rely on the network firewall to restrict access to trusted IP addresses.
   • CExpose the APIs only over HTTP for simplicity, and require partners to include their credentials in the URL.
   • DUse OAuth 2.0 with scoped access tokens, and enforce rate limiting and API key validation at the gateway.
   Reveal Solution Discussion Select an answer first