CCISO Security Architecture 3 — Questions and Answers
Question 1: A CISO is evaluating a proposed microservices architecture for a financial application. Which security concern is MOST unique to microservices compared to monolithic architectures?
- SQL injection vulnerabilities
- Securing a dramatically increased number of inter-service API communication channels (Correct answer)
- Patching operating system vulnerabilities
- Managing user authentication sessions
Correct answer: Securing a dramatically increased number of inter-service API communication channels
Microservices architectures dramatically increase the attack surface through numerous inter-service API calls that each require authentication, encryption, and authorization controls.
Question 2: Which architectural framework defines security requirements across five concurrent viewpoints: security architecture, security processes, security technology, security assurance, and security governance?
- SABSA (Sherwood Applied Business Security Architecture) (Correct answer)
- TOGAF Security Extension
- DoDAF
- FEAF
Correct answer: SABSA (Sherwood Applied Business Security Architecture)
SABSA is a framework for developing risk-driven enterprise security architectures that links business requirements to security architecture through multiple layered viewpoints.
Question 3: In network security architecture, what does 'east-west traffic' refer to, and why is it a growing concern?
- Traffic between US and European data centers
- Lateral traffic between servers within the same data center or cloud environment (Correct answer)
- Encrypted traffic bypassing DLP controls
- Traffic from mobile endpoints to corporate servers
Correct answer: Lateral traffic between servers within the same data center or cloud environment
East-west traffic refers to lateral communication between workloads within the same environment; it is a concern because attackers who breach the perimeter can move laterally without being detected by perimeter controls.
Question 4: A CISO needs to secure a SCADA/ICS environment. Which architectural principle is MOST critical when integrating ICS with corporate IT networks?
- Implementing single sign-on across both environments
- Network segmentation with strict access controls and unidirectional security gateways where possible (Correct answer)
- Using the same patch management cycle for both environments
- Deploying cloud-based monitoring for ICS devices
Correct answer: Network segmentation with strict access controls and unidirectional security gateways where possible
ICS/SCADA environments require strict network segmentation from corporate IT networks, often using unidirectional data diodes, because these systems prioritize availability over confidentiality and cannot tolerate standard IT security disruptions.
Question 5: What is the security implication of using a shared responsibility model in cloud computing?
- The cloud provider assumes all security responsibilities
- Security responsibilities are divided between the cloud provider and customer based on the service model (IaaS, PaaS, SaaS) (Correct answer)
- Customers have no security responsibilities in the cloud
- Security is handled entirely by third-party auditors
Correct answer: Security responsibilities are divided between the cloud provider and customer based on the service model (IaaS, PaaS, SaaS)
The shared responsibility model means security duties are split between the cloud provider (infrastructure, physical) and the customer (data, access controls, configurations) based on the service model used.
Question 6: Which cryptographic architecture concept ensures that compromising a long-term key does not expose previously recorded encrypted sessions?
- Key escrow
- Perfect Forward Secrecy (PFS) (Correct answer)
- Key stretching
- Certificate pinning
Correct answer: Perfect Forward Secrecy (PFS)
Perfect Forward Secrecy generates ephemeral session keys that are discarded after each session, ensuring that compromise of the long-term private key cannot be used to decrypt previously captured traffic.
Question 7: A CISO is reviewing a proposed architecture for a high-security environment handling classified data. Which architectural control ensures data cannot flow from a high-security domain to a lower-security domain?
- Stateful firewall between zones
- Data diode (unidirectional security gateway) (Correct answer)
- Bidirectional VPN tunnel
- IDS/IPS at the boundary
Correct answer: Data diode (unidirectional security gateway)
A data diode is a hardware-enforced unidirectional device that physically permits data to flow in only one direction, preventing any data leakage from high to low security domains.
CCISO Security Architecture 3
A CISO is evaluating a proposed microservices architecture for a financial application.
Which security concern is MOST unique to microservices compared to monolithic architectures?