A security architect is designing a solution for a database that will store credit card numbers. The architect must ensure that the data is protected at rest and that the encryption keys are managed separately from the data. Which approach best meets these requirements?

Use transparent data encryption (TDE) with keys stored in a hardware security module (HSM)

Use application-level encryption with keys stored in the same database

Use a cloud KMS to encrypt the database, but store the keys in the database's configuration file

Use full disk encryption (FDE) on the database server

A security architect is designing a key management system for a multi-tenant cloud application. The architect must ensure that each tenant's data is encrypted with a unique key and that keys are isolated from other tenants. Which key management approach is most appropriate?

Store all tenant keys in a single database table with tenant ID as a column

Use a single key for all tenants to simplify management

Use a single master key for all tenants and derive unique data keys for each tenant

Use a key management service (KMS) with a separate customer master key (CMK) for each tenant

A healthcare organization is implementing a new encryption solution for patient records. The security architect must ensure that encryption keys are rotated annually and that old keys are securely destroyed after a mandatory retention period. Which key management practice is most critical to implement?

Use a long key length to avoid the need for frequent rotation

Automate key rotation and maintain an audit log of all key lifecycle events

Store all keys in a single, well-protected location to simplify management

Share keys among multiple systems to reduce the number of keys to manage

A security architect is designing a key management system for a large organization. The architect must ensure that keys are available when needed but also protected from unauthorized access. Which key management practice is most effective for achieving high availability and security?

Encrypt the key with a password and store it in a shared network drive

Use a single, highly available key management appliance in a central data center

Store a single master key in a secure location and back it up to a cloud storage service

Distribute key shares across multiple geographically separated locations using a secret sharing scheme

When designing a cryptographic solution for a system, which factor is most directly related to the long-term viability of the chosen algorithm?

The cost of the hardware implementing the algorithm

The popularity of the algorithm among developers

The algorithm's resistance to known cryptanalytic attacks

The speed of the algorithm on modern processors

Information Systems Security Architecture Professional

Domain 3Objective 3

3.3 Architect Infrastructure and System Cryptographic Solutions ISSAP Practice Questions (Page 3)

Part of the Infrastructure and System Security Architecture domain, which accounts for 32% of the ISSAP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–38 in this domain), expect 7–13 from this objective — we provide 19 practice questions to prepare you well beyond it. (estimate)

19questions here

4free pages

3concepts

32%of the exam

Questions 11–15

11application · medium
A security architect is designing a solution for a database that will store credit card numbers. The architect must ensure that the data is protected at rest and that the encryption keys are managed separately from the data. Which approach best meets these requirements?
Select an answer first
12application · medium
A security architect is designing a key management system for a multi-tenant cloud application. The architect must ensure that each tenant's data is encrypted with a unique key and that keys are isolated from other tenants. Which key management approach is most appropriate?
Select an answer first
13application · medium
A healthcare organization is implementing a new encryption solution for patient records. The security architect must ensure that encryption keys are rotated annually and that old keys are securely destroyed after a mandatory retention period. Which key management practice is most critical to implement?
Select an answer first
14application · medium
A security architect is designing a key management system for a large organization. The architect must ensure that keys are available when needed but also protected from unauthorized access. Which key management practice is most effective for achieving high availability and security?
Select an answer first
15foundation · easy
When designing a cryptographic solution for a system, which factor is most directly related to the long-term viability of the chosen algorithm?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSAP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSAP” is a trademark of its owner, used for identification only.