A security architect is designing a solution for a web application that will handle user passwords. The architect must ensure that passwords are stored securely and that the solution is resistant to brute-force attacks. Which approach is most appropriate for storing passwords?

Store passwords in plain text but restrict access to the database

Encrypt passwords using AES-256 and store the encryption key in the application code

Use a simple hash function like MD5 with a single global salt

Use a strong password hashing algorithm such as bcrypt with a unique salt for each password

A security architect is designing a cryptographic solution for a system that will be deployed in a country with strict data sovereignty laws. The architect must ensure that all cryptographic operations and key management occur within the country's borders. Which design consideration is most important to address?

Select a cloud provider that offers a region within the country and ensure that keys are stored and used only in that region

Use a VPN to connect to a cloud provider in another country and perform all cryptographic operations there

Use a global key management service that replicates keys across multiple regions for high availability

Encrypt data with a key generated in the country, but store the key in a neighboring country for backup

A large enterprise is migrating its on-premises data center to a hybrid cloud environment. The security architect must design a key management solution that allows the organization to retain control over keys while using cloud services for data storage. Which key management architecture best meets this requirement?

Use the cloud provider's default encryption with automatically generated keys

Use a cloud key management service (KMS) with customer-managed keys (CMK)

Store all keys on-premises in an HSM and export them to the cloud for each encryption operation

Encrypt data on-premises before sending it to the cloud and store the keys in the cloud

Which design consideration is most important when selecting a cryptographic algorithm for a system that must protect data for the next 30 years?

The algorithm's ease of implementation in software

The algorithm's key length and expected cryptographic strength over time

The algorithm's compatibility with existing systems

The algorithm's licensing and patent status

In the key management lifecycle, what is the primary purpose of key rotation?

To reduce the risk of key compromise by limiting the amount of data encrypted with a single key

To ensure that keys are stored in a hardware security module (HSM)

To simplify the process of distributing keys to multiple users

To allow multiple keys to be used simultaneously for the same data

Information Systems Security Architecture Professional

Domain 3Objective 3

3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 1)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

32%of the exam

Questions 1–5

1application · medium
A security architect is designing a solution for a web application that will handle user passwords. The architect must ensure that passwords are stored securely and that the solution is resistant to brute-force attacks. Which approach is most appropriate for storing passwords?
Select an answer first
2application · medium
A security architect is designing a cryptographic solution for a system that will be deployed in a country with strict data sovereignty laws. The architect must ensure that all cryptographic operations and key management occur within the country's borders. Which design consideration is most important to address?
Select an answer first
3application · medium
A large enterprise is migrating its on-premises data center to a hybrid cloud environment. The security architect must design a key management solution that allows the organization to retain control over keys while using cloud services for data storage. Which key management architecture best meets this requirement?
Select an answer first
4foundation · easy
Which design consideration is most important when selecting a cryptographic algorithm for a system that must protect data for the next 30 years?
Select an answer first
5foundation · easy
In the key management lifecycle, what is the primary purpose of key rotation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 1)

Questions 1–5

A security architect is designing a solution for a web application that will handle user passwords. The architect must ensure that passwords are stored securely and that the solution is resistant to brute-force attacks. Which approach is most appropriate for storing passwords?

Which design consideration is most important when selecting a cryptographic algorithm for a system that must protect data for the next 30 years?

In the key management lifecycle, what is the primary purpose of key rotation?

Keep studying — Infrastructure and System Security Architecture