2.1 Identify Security Architecture Approach ISSAP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security architect is prioritizing vulnerabilities in a hybrid environment. The team has identified a critical vulnerability (CVSS 9.0) in a customer-facing web application. The same vulnerability also exists in an internal HR application, but the HR application is not internet-facing and has compensating controls in place. Threat intelligence indicates active exploitation of this vulnerability in the wild. What is the most appropriate prioritization strategy?

   • APrioritize the HR application because internal systems are often more trusted and contain sensitive data
   • BDefer both applications until the next scheduled patch cycle to avoid disruption
   • CPrioritize the web application for immediate remediation and schedule the HR application for the next maintenance window
   • DTreat both applications with equal priority because the CVSS score is the same
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which security architecture type focuses on protecting the flow of data across network segments and enforcing access control at the network layer?

   • AEnterprise security architecture
   • BApplication security architecture
   • CNetwork security architecture
   • DService-oriented architecture (SOA)
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An architect is creating a security blueprint for a new system. The blueprint must communicate the security architecture to both technical teams and business stakeholders. The architect wants to show the high-level security domains (e.g., identity, data, network) and how they relate to business processes. Which type of blueprint is most suitable for this audience?

   • AA conceptual architecture diagram showing security domains and their alignment with business functions
   • BA data flow diagram showing every data element and its transformation
   • CA list of security controls from ISO/IEC 27001
   • DA detailed network diagram with all IP addresses and port numbers
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A multinational retail company is adopting TOGAF to standardize its architecture practice. The security architect must ensure that security requirements are embedded in every phase of the architecture development cycle, from the initial business vision through the final implementation and migration plan. Which TOGAF component should the architect leverage to achieve this integration?

   • AThe Architecture Repository, to store all security artifacts for reuse across projects
   • BThe Architecture Development Method (ADM), applying security-specific activities and deliverables in each of its phases
   • CThe Security Architecture artifact within the Architecture Requirements Specification, produced only during Phase D
   • DThe Enterprise Continuum, which classifies security solutions from generic to specific for reuse
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A security architect is defining the scope of a security architecture for a multinational enterprise that operates both on-premises data centers and multiple public cloud regions. Which statement best describes the scope of the security architecture in this context?

   • AThe scope is limited to the on-premises data centers because cloud providers are responsible for all security controls.
   • BThe scope is determined solely by the security architect's preference and does not need to consider business operations.
   • CThe scope is limited to the public cloud regions because on-premises systems are governed by physical security only.
   • DThe scope includes both on-premises and cloud environments, and the architecture must address the shared responsibility model for each cloud service.
   Reveal Solution Discussion Select an answer first