3.2 Architect Infrastructure and System Security ISSAP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an example of an out-of-band communication method for IT management?

   • ASSH over the management VLAN
   • BRemote management via a dedicated serial console
   • CRemote desktop over the corporate VPN
   • DEmail-based support tickets
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which physical security control is specifically designed to detect and record the movement of individuals within a facility, providing both a deterrent and an evidentiary record?

   • AMantrap
   • BElectronic door lock
   • CBiometric reader
   • DVideo surveillance camera
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A data center is being designed to house a high-security application. The security architect must ensure that only authorized personnel can physically access the server racks. The facility already has a perimeter fence and security guards. Which additional physical control should be implemented to provide the most granular access control at the rack level?

   • ADeploy CCTV cameras throughout the data center to monitor all activity.
   • BUse a biometric access control system at the data center entrance.
   • CInstall electronic locks on each server rack with individual PIN codes and audit logs of access attempts.
   • DImplement a visitor management system that requires all visitors to be escorted.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A financial services firm is migrating a customer relationship management (CRM) application to a public cloud SaaS provider. The firm's compliance team requires that customer data be encrypted at rest and that the firm retain the ability to revoke access to the data if the SaaS contract is terminated. The SaaS provider offers built-in encryption with provider-managed keys. Which additional control should the security architect recommend to meet the compliance requirement?

   • ARely on the provider's default encryption and request a contractual clause for data deletion upon termination.
   • BImplement a data loss prevention (DLP) policy in the SaaS application to block unauthorized exports.
   • CExport all customer data to the firm's on-premises storage nightly and delete the SaaS copy.
   • DEnable the SaaS provider's customer-managed key (CMK) feature and store the key in the firm's own cloud-based key management service (KMS).
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a major security incident, the primary corporate network is under a distributed denial-of-service (DDoS) attack, and the incident response team suspects that the network is also compromised. The team needs a reliable way to communicate and coordinate the response without relying on the compromised infrastructure. Which strategy should the security architect have implemented in advance?

   • AUse the corporate email system with encrypted messages for all incident response communication.
   • BRely on the public switched telephone network (PSTN) for voice calls, but use the corporate VoIP system for conferencing.
   • CEstablish an out-of-band communication channel using a separate, isolated network with dedicated phones and a different internet service provider.
   • DSchedule regular in-person meetings at a designated off-site location for incident response coordination.
   Reveal Solution Discussion Select an answer first