Define Secure Operational Architecture (e.g., Deployment Topology, Operational Interfaces, Continuous Integration and Continuous Delivery (CI/CD)) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary purpose of security monitoring in an operational architecture?

   • ATo ensure that all software licenses are up to date
   • BTo automatically patch all vulnerabilities without human intervention
   • CTo detect suspicious activity and potential threats in real time
   • DTo replace the need for incident response procedures
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security operations center (SOC) is responsible for monitoring a complex environment that includes on-premises servers and cloud-based microservices. The SOC needs to detect and respond to threats across both environments. The security architect must design a monitoring solution that provides a unified view. Which approach should be recommended?

   • ADeploy a centralized SIEM that collects logs from both on-premises and cloud environments, and use correlation rules to detect cross-environment threats.
   • BUse separate monitoring tools for on-premises and cloud, and have the SOC manually correlate alerts from each tool.
   • CMonitor only the cloud environment because it is more likely to be attacked, and ignore on-premises logs.
   • DUse a cloud-native monitoring service that only collects logs from cloud resources, and rely on the on-premises team to monitor their own systems.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team wants to integrate security scanning into their CI/CD pipeline. They currently build and deploy to a staging environment automatically on every commit. The security architect must ensure that vulnerabilities are detected early without slowing down the development process. Which approach best meets this requirement?

   • ARun a full static application security test (SAST) and dependency scan on every commit, and fail the build if any high-severity vulnerability is found.
   • BRun SAST only on release branches, and manually review the results before each production deployment.
   • CRun SAST on every commit but only report results to the security team without failing the build.
   • DRun a dynamic application security test (DAST) against the staging environment after every deployment, and fail the deployment if any medium-severity issue is found.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A healthcare organization is designing a new patient portal that will be deployed in a multi-tier architecture. The security architect must ensure that the system can be recovered within 4 hours after a ransomware attack, while also preserving forensic evidence for legal action. The organization has a limited budget and cannot afford a fully redundant hot site. Which recovery strategy best meets these constraints?

   • AStore backups on tape and keep them in the same data center as the production environment for quick access.
   • BUse a warm standby site with replicated data, but do not test the recovery process to save costs.
   • CImplement a hot site with real-time replication, but do not encrypt the replicated data to reduce latency.
   • DMaintain encrypted backups in a separate cloud region, and document a runbook that includes restoring to a clean environment and validating data integrity.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does operational architecture support incident response recovery procedures?

   • ABy eliminating the need for incident response planning
   • BBy ensuring that all systems are permanently shut down after an incident
   • CBy providing documented backup and restore processes that are tested regularly
   • DBy preventing any changes to the system after deployment
   Reveal Solution Discussion Select an answer first