2.1 Identify Security Architecture Approach ISSAP Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   An architect is documenting the security architecture for a new e-commerce platform. The blueprint must clearly show how the web application firewall (WAF), the API gateway, and the identity provider (IdP) interact to protect the application. Which type of architecture blueprint is most appropriate for this purpose?

   • AA physical deployment diagram showing server racks and cabling
   • BA data flow diagram (DFD) showing the flow of requests and security decisions between components
   • CA network diagram showing IP addresses and firewall rules
   • DAn organizational chart showing the security team's responsibilities
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the primary purpose of the TOGAF Architecture Development Method (ADM)?

   • ATo provide a step-by-step approach for developing and managing enterprise architectures.
   • BTo replace the need for risk assessment in architecture.
   • CTo provide a compliance checklist for regulatory requirements.
   • DTo define a specific set of security controls for all organizations.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A government agency is building a new secure data exchange platform. The architect wants to use a proven, standardized set of security patterns and components rather than designing from scratch. The agency requires a template that has been validated for similar high-assurance environments. What should the architect use?

   • AThe TOGAF Architecture Repository, which contains all necessary security patterns
   • BA custom architecture blueprint developed internally for this project
   • CA reference architecture for secure data exchange from a recognized body like NIST or a national cybersecurity center
   • DA generic network security architecture diagram from a vendor's website
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A large enterprise is updating its threat model for its cloud-based customer relationship management (CRM) system. The security architect wants to incorporate recent threat intelligence indicating that a specific advanced persistent threat (APT) group is targeting similar CRM platforms in the same industry. How should the architect integrate this intelligence into the threat modeling process?

   • APrioritize the STRIDE threats that the intelligence indicates are most likely to be exploited by this APT group
   • BStore the intelligence in the architecture repository but do not use it in the current model
   • CUse the intelligence to create a new STRIDE category specific to the APT group
   • DReplace the STRIDE analysis with the threat intelligence report
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A logistics company is replacing its monolithic legacy system with a service-oriented architecture (SOA). The security architect must design the security architecture for the new system. The architect is concerned about threats that target the message exchanges between services, such as message alteration and unauthorized replay. Which type of security architecture is most directly relevant to addressing these concerns?

   • ANetwork security architecture, focusing on firewalls and intrusion prevention systems
   • BDatabase security architecture, focusing on encryption at rest
   • CPerimeter security architecture, focusing on demilitarized zones (DMZs)
   • DService-oriented architecture (SOA) security architecture, focusing on message-level security such as WS-Security
   Reveal Solution Discussion Select an answer first