2.1 Identify Security Architecture Approach ISSAP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A healthcare organization is migrating its patient records system to a service-oriented architecture (SOA). The architect must design security for the new services, including authentication, authorization, and message-level integrity. The organization wants a structured approach that specifically addresses the unique security challenges of SOA, such as service-to-service trust and data integrity across intermediaries. Which approach should the architect take?

   • AImplement a single enterprise service bus (ESB) with centralized security enforcement
   • BUse STRIDE to identify threats and then map them to network-level controls such as firewalls and IDS
   • CAdopt a traditional network security architecture with perimeter firewalls and VLAN segmentation
   • DApply the Service-Oriented Modeling Framework (SOMF) to model security services and their interactions
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security architect is defining the scope of a security architecture project for a new SaaS product. The product will be deployed in a public cloud and will use a third-party payment gateway. The architect must decide what to include in the scope. What is the most appropriate scope?

   • AThe entire product, including the cloud infrastructure, the application, and the integration with the third-party payment gateway
   • BOnly the components that are subject to regulatory compliance, such as payment card data
   • COnly the components that the organization directly controls, such as the application code and its configuration
   • DOnly the network security components, such as firewalls and virtual networks
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which element is typically included in a security architecture blueprint?

   • ANetwork topology diagrams
   • BEmployee names and roles
   • CVendor pricing information
   • DSecurity controls and their placement
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   In the SABSA framework, which layer is responsible for defining the business context and risk appetite that drive security architecture decisions?

   • AContextual Security Architecture
   • BPhysical Security Architecture
   • CLogical Security Architecture
   • DComponent Security Architecture
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A security architect is using SABSA to develop a security architecture for a new product. The architect has completed the Contextual and Conceptual layers. The next step is to define the Logical layer, which specifies the security services and their relationships. What is the primary input for this layer?

   • AThe specific security products and technologies selected for implementation
   • BThe detailed network diagrams and server configurations
   • CThe operational procedures and monitoring tools used in day-to-day security management
   • DThe business risk assessment and the security strategy defined in the Conceptual layer
   Reveal Solution Discussion Select an answer first