1.1 Identify Legal, Regulatory, Organizational, and Industry Requirements ISSAP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which mechanism allows a system to continue operating without interruption when a component fails?

   • ALoad balancing
   • BPatch management
   • CFault tolerance
   • DMonitoring
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An e-commerce platform experiences a surge in traffic during a flash sale, causing the application to become unresponsive. The architecture uses a single load balancer and a pool of web servers. The security architect is asked to improve resilience. Which change provides the MOST immediate improvement in fault tolerance?

   • AAdd a second load balancer in an active-passive configuration and configure health checks on the web servers.
   • BEnable session persistence (sticky sessions) on the load balancer.
   • CMove the application to a single, more powerful server to simplify the architecture.
   • DIncrease the size of the web servers to handle more traffic.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A financial services firm outsources its customer support operations to a third-party call center. The call center will have access to customer account information. The firm's security architect must ensure the outsourcing agreement includes appropriate security obligations. Which clause is MOST critical to include?

   • AA requirement for the call center to implement multi-factor authentication (MFA) for all agents accessing customer data.
   • BA service level agreement (SLA) that specifies the call center's uptime and average call handling time.
   • CA clause that allows the firm to audit the call center's security controls at any time.
   • DA data protection and confidentiality clause that defines the permitted use of data, requires safeguards, and mandates breach notification to the firm.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the purpose of vendor assurance processes in supply chain security?

   • ATo provide ongoing verification that vendors maintain the required security controls
   • BTo guarantee the vendor's products are free of vulnerabilities
   • CTo transfer all security risk to the vendor
   • DTo eliminate the need for incident response planning
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A retail company processes credit card payments in-store and via an e-commerce platform. It also shares transaction data with a third-party analytics vendor. The company is subject to PCI DSS. The security architect must design the data flow to minimize compliance scope. Which approach is most effective?

   • AStore all cardholder data in a single database and restrict access to the database administrator only.
   • BOutsource all payment processing to a PCI DSS validated third party and assume the company is no longer subject to PCI DSS.
   • CEncrypt all cardholder data in transit and at rest, and provide the analytics vendor with the decryption keys for processing.
   • DSegment the cardholder data environment (CDE) from the rest of the network and share only tokenized or masked data with the analytics vendor.
   Reveal Solution Discussion Select an answer first