ITA - Information Technology Architecture Security Architecture Design Questions and Answers — Questions and Answers
Question 1: An organization is shifting its security posture from a traditional perimeter-based model to one that mandates verification for every access request, regardless of whether it originates from inside or outside the corporate network. Which security architecture model BEST represents this modern approach?
- Defense-in-Depth
- Castle-and-Moat
- Zero Trust Architecture (Correct answer)
- Security Zone Architecture
Correct answer: Zero Trust Architecture
Zero Trust Architecture is a security model based on the principle of "never trust, always verify." It requires strict identity verification for every user and device trying to access resources on a private network, eliminating the concept of a trusted internal network.
Question 2: During the security architecture design phase for a new cloud-native application, an architect leads a structured exercise to identify and evaluate potential security flaws from an attacker's perspective. What is this proactive process called?
- Penetration Testing
- Threat Modeling (Correct answer)
- Vulnerability Scanning
- Security Audit
Correct answer: Threat Modeling
Threat modeling is a structured, proactive process used early in the development lifecycle to identify, analyze, and mitigate potential security threats and architectural weaknesses before the system is built. Penetration testing and vulnerability scanning are typically performed on a system that has already been built.
Question 3: Which of the following scenarios is the BEST example of implementing the 'Defense-in-Depth' principle?
- Enforcing a strong password policy for all user accounts.
- Using a combination of network firewalls, endpoint anti-malware, data encryption, and multi-factor authentication to protect a critical database. (Correct answer)
- Conducting annual security awareness training for all employees.
- Deploying a single, next-generation firewall at the network edge.
Correct answer: Using a combination of network firewalls, endpoint anti-malware, data encryption, and multi-factor authentication to protect a critical database.
Defense-in-Depth is a strategy that employs multiple layers of security controls to protect an asset. The idea is that if one control fails, another is in place to stop an attack. Using firewalls, anti-malware, encryption, and MFA together is a perfect example of this layered approach, whereas the other options represent single security controls.
Question 4: An architect for a financial institution is designing security controls for a new wealth management platform. To comply with regulations, customer financial data must have stronger encryption and more restrictive access policies than marketing materials. What is the MOST critical prerequisite activity to enable this differentiated approach to security?
- Network Segmentation
- Data Classification (Correct answer)
- Threat Intelligence Integration
- Incident Response Planning
Correct answer: Data Classification
Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements. This process is a fundamental prerequisite for applying appropriate security controls, as you cannot protect what you have not identified and valued. Once data is classified, appropriate controls like encryption and access policies can be applied.
Question 5: An enterprise security architect is tasked with developing a comprehensive security architecture. A key requirement is that the entire architecture must be derived from and directly traceable to the organization's business objectives and risk tolerance. Which security architecture framework is specifically designed with this business-driven methodology at its core?
- SABSA (Sherwood Applied Business Security Architecture) (Correct answer)
- ITIL (Information Technology Infrastructure Library)
- TOGAF (The Open Group Architecture Framework)
- Zachman Framework
Correct answer: SABSA (Sherwood Applied Business Security Architecture)
SABSA is a methodology renowned for being business-driven. It starts with analyzing business requirements, goals, and risk appetite to create a security architecture where every control is traceable back to a business need. While TOGAF and Zachman are enterprise architecture frameworks, they are not as specifically focused on a business-risk-driven approach for security as SABSA is. ITIL is a framework for IT service management.
Question 6: An architect specifies that a new application's service account, which is used to process automated reports, must only have read-only access to a specific database table and no other permissions within the system. Which fundamental security design principle does this specification enforce?
- Defense-in-Depth
- Separation of Duties
- Open Design
- Principle of Least Privilege (Correct answer)
Correct answer: Principle of Least Privilege
The Principle of Least Privilege (PoLP) dictates that a user, program, or process should have only the minimum necessary access rights (or permissions) to perform its specific function. By restricting the service account to only read-only access for a single table, the architect is strictly applying this principle.
ITA - Information Technology Architecture Security Architecture Design Questions and Answers
An organization is shifting its security posture from a traditional perimeter-based model to one that mandates verification for every access request, regardless of whether it originates from inside or outside the corporate network.
Which security architecture model BEST represents this modern approach?