An e-commerce company is designing a new microservices architecture. The architect must ensure that all inter-service communication is encrypted, but performance is a critical concern. Which approach best balances security and performance for data in transit between services?

Encrypt all data at the application layer using a custom encryption library

Use a virtual private network (VPN) between all services

Use mutual TLS (mTLS) with short-lived certificates for service-to-service authentication and encryption

Rely on the underlying network encryption provided by the cloud provider

A security architect is designing a system that will process highly sensitive personal data. The architect must ensure that data is encrypted in memory to protect against memory-scraping attacks. Which approach is most appropriate for protecting data in use?

Use Intel Software Guard Extensions (SGX) to create an enclave for processing data

Encrypt data with a key stored in the application's memory

Use full disk encryption (FDE) on the server's hard drive

Rely on the operating system's built-in memory protection mechanisms

A security architect is designing a key management system for a global organization that must comply with multiple regulatory frameworks. The architect must balance the need for key availability with the requirement to securely destroy keys after a data breach. Which key management strategy best addresses this trade-off?

Implement a key escrow system with a trusted third party and a defined key destruction process

Use a single key for all data to simplify destruction, but accept the risk of a single point of failure

Store keys only in hardware security modules (HSMs) and never back them up

Use a cloud KMS with automatic key rotation and no manual deletion capability

Information Systems Security Architecture Professional

Domain 3Objective 3

3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 2)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

32%of the exam

Questions 6–10

6application · medium
An e-commerce company is designing a new microservices architecture. The architect must ensure that all inter-service communication is encrypted, but performance is a critical concern. Which approach best balances security and performance for data in transit between services?
Select an answer first
7application · medium
A security architect is designing a system that will process highly sensitive personal data. The architect must ensure that data is encrypted in memory to protect against memory-scraping attacks. Which approach is most appropriate for protecting data in use?
Select an answer first
8foundation · easy
Which cryptographic mechanism is specifically designed to protect data while it is being processed in memory?
Select an answer first
9foundation · easy
Which of the following is the most common and practical method for protecting data at rest on a laptop's hard drive?
Select an answer first
10expert · hard
A security architect is designing a key management system for a global organization that must comply with multiple regulatory frameworks. The architect must balance the need for key availability with the requirement to securely destroy keys after a data breach. Which key management strategy best addresses this trade-off?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.

3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 2)

Questions 6–10

An e-commerce company is designing a new microservices architecture. The architect must ensure that all inter-service communication is encrypted, but performance is a critical concern. Which approach best balances security and performance for data in transit between services?

A security architect is designing a system that will process highly sensitive personal data. The architect must ensure that data is encrypted in memory to protect against memory-scraping attacks. Which approach is most appropriate for protecting data in use?

Which cryptographic mechanism is specifically designed to protect data while it is being processed in memory?

Which of the following is the most common and practical method for protecting data at rest on a laptop's hard drive?

Keep studying — Infrastructure and System Security Architecture