Security Architecture and Engineering — CISSP Practice Questions

What is the MOST important factor to consider when researching security models and architecture for an IoT system?

• A.Scalability and performance of the security model
• B.Interoperability with existing systems and devices
• C.Security of data in transit and at rest
• D.Device and network segmentation to limit attack surfaces

Why: Consider device and network segmentation to limit attack surfaces IoT systems often have a large number of devices and connections, making device and network segmentation crucial to limit attack surfaces and prevent lateral movement

An organization is implementing a new security architecture. What should be done FIRST to ensure a secure design?

• A.Conduct a risk assessment and vulnerability analysis
• B.Develop a comprehensive security policy and procedures
• C.Design and implement a firewall and intrusion detection system
• D.Establish a security awareness training program for employees

Why: Risk assessment is the foundation of security design Conducting a risk assessment and vulnerability analysis is the first step in ensuring a secure design, as it helps identify potential threats and vulnerabilities that need to be addressed.

What should be done FIRST when designing a secure site and facility to protect against physical threats?

• A.Conduct a risk assessment to identify potential vulnerabilities
• B.Implement access controls such as locks and alarms
• C.Install surveillance cameras and motion detectors
• D.Develop a security policy and procedures manual

Why: Identify the first step in designing a secure site and facility Conducting a risk assessment is the first step in designing a secure site and facility as it helps to identify potential vulnerabilities and threats, allowing for the development of effective countermeasures

An organization is migrating its data center to a cloud-based infrastructure. What is the MOST comprehensive approach to ensure the security of sensitive data during the migration process?

• A.A. Utilize a cloud access security broker (CASB) as part of a layered security strategy to monitor and control cloud-based data access before, during, and after migration
• B.B. Implement a cloud security gateway to encrypt and protect data in transit, and ensure it is part of an overall security plan
• C.C. Develop a comprehensive data migration plan that includes data encryption, access controls, monitoring, risk assessment, and testing to ensure security throughout the migration process
• D.D. Conduct a thorough risk assessment of the cloud service provider's security controls as an initial step in planning the migration

Why: Ensure security of sensitive data during cloud migration Developing a comprehensive data migration plan ensures that all aspects of data security are considered, including encryption, access controls, and monitoring, reducing the risk of data breaches during the migration process.

A security team is responsible for designing a secure facility for a new data center, the site is located near a high risk flood zone. What should be done FIRST to ensure the security of the facility?

• A.Conduct a risk assessment of the facility's location, including environmental risks such as flooding
• B.Design the facility's physical security controls, including access controls and surveillance systems
• C.Develop a comprehensive security plan, including incident response and disaster recovery procedures
• D.Implement a building management system to monitor and control the facility's environmental systems

Why: Conduct risk assessment to ensure facility security Conducting a risk assessment of the facility's location is crucial to identify potential risks, such as flooding, and take necessary measures to mitigate them, ensuring the security and integrity of the facility.

An organization is planning to deploy a new cloud-based service that will handle sensitive customer data. What is the MOST important security capability for the organization to prioritize when selecting a cloud service provider?

• A.Data encryption at rest and in transit
• B.Regular security audits and compliance reporting
• C.Incident response and disaster recovery planning
• D.Access controls and identity management

Why: Data encryption is a critical security control for protecting sensitive data in the cloud Data encryption is essential for protecting sensitive customer data, both at rest and in transit, to prevent unauthorized access

A security manager discovers that the company's current data center has reached maximum capacity and is no longer able to support business operations. What should be done FIRST to address this issue?

• A.Conduct a thorough risk assessment to identify potential security threats
• B.Develop a business case to justify the cost of upgrading or relocating the data center
• C.Engage with stakeholders to determine the short-term and long-term needs of the business
• D.Initiate a request for proposal (RFP) process to select a new data center provider

Why: Engaging stakeholders is crucial in determining business needs for security architecture Engaging stakeholders is essential to understand the business requirements and determine the best course of action to address the data center capacity issue.

A security architect is designing a new data center. What is the MOST important consideration for the site and facility design?

• A.Cost and budget constraints
• B.Environmental and geographical factors
• C.Physical security and access controls
• D.Scalability and future growth potential

Why: Physical security is crucial for data center design Physical security and access controls are the most critical considerations for a data center design to protect against unauthorized access and ensure the confidentiality, integrity, and availability of data.

An organization is implementing a secure facility design. What is the BEST approach to physical security?

• A.Implement a single layer of physical security controls
• B.Implement multiple layers of physical security controls
• C.Focus on internal security controls and ignore external threats
• D.Focus on external security controls and ignore internal threats

Why: Defense in depth is key to physical security Implementing multiple layers of physical security controls, such as fences, gates, doors, and intrusion detection systems, provides a defense-in-depth approach that helps prevent unauthorized access and protect the facility.

What is the BEST way to assess and mitigate vulnerabilities in a security architecture?

• A.Conduct regular penetration testing and vulnerability scans
• B.Implement a defense-in-depth strategy with multiple layers of security controls
• C.Use a threat modeling framework to identify and prioritize potential threats
• D.Develop a comprehensive incident response plan

Why: Understand how to assess and mitigate vulnerabilities in a security architecture Conducting regular penetration testing and vulnerability scans is the best way to assess and mitigate vulnerabilities as it provides a proactive and continuous approach to identifying and addressing potential weaknesses

An organization is migrating its on-premises data center to a cloud-based infrastructure. What should be done FIRST to ensure a secure transition?

• A.Conduct a vulnerability assessment of the cloud provider's infrastructure
• B.Develop a comprehensive cloud security architecture
• C.Establish a cloud security governance framework
• D.Perform a risk analysis of the cloud migration process

Why: Identify the initial step in securing a cloud migration Performing a risk analysis of the cloud migration process is the first step in identifying potential security risks and developing strategies to mitigate them.

An organization is designing a new facility that will house sensitive data and equipment. What is the MOST important security consideration for the facility's design?

• A.Access control and authentication mechanisms
• B.Environmental controls, such as temperature and humidity
• C.Facility layout and compartmentalization
• D.Physical security measures, such as walls, doors, and locks

Why: Identify the primary security consideration for facility design Physical security measures, such as walls, doors, and locks, are the most important consideration for facility design, as they provide the first line of defense against unauthorized access.