2.1 Identify Security Architecture Approach ISSAP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When determining the scope of a security architecture, which factor most directly influences the architectural decisions?

   • AThe number of security vendors used in the environment
   • BThe organization's business goals and risk tolerance
   • CThe latest security technology trends
   • DThe personal preference of the security architect
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An architect is designing the security architecture for a new SOA-based system using the Service-Oriented Modeling Framework (SOMF). The system will expose several services, including a payment service and a user profile service. The architect needs to model the security requirements for these services, including the policies for authentication and authorization. According to SOMF, where should these security requirements be modeled?

   • AIn a network architecture diagram, showing the firewalls and IDS placement
   • BIn a separate security service model, independent of the business service models
   • CIn a threat model, using STRIDE to identify all possible attacks
   • DWithin the service model for each business service, specifying the security policies that apply to it
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which CVSS metric describes the conditions required to exploit a vulnerability?

   • AConfidentiality Impact
   • BAttack Complexity
   • CUser Interaction
   • DAttack Vector
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of integrating threat intelligence into security architecture modeling?

   • ATo automate the patching of all vulnerabilities.
   • BTo guarantee that no security breaches will occur.
   • CTo replace the need for vulnerability scanning.
   • DTo provide real-time information about current threats that can inform threat modeling and risk assessment.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security architect is prioritizing vulnerabilities for a critical application. The team has identified a remote code execution vulnerability in a web server component. The vulnerability is rated with a CVSS v3.1 base score of 9.8. The application is internet-facing, but the vulnerable component is only accessible from a limited internal network segment. What is the most appropriate initial action for the architect?

   • AIgnore the CVSS score and rely on threat intelligence feeds for prioritization
   • BDefer remediation because the component is not directly internet-facing
   • CAdjust the CVSS score using the environmental metrics to reflect the limited accessibility
   • DTreat the CVSS score as the sole factor and remediate immediately
   Reveal Solution Discussion Select an answer first