I85PREP
⌘ K
CASSPT study materials
CASSPT study resources

CASSPT practice questions

One question at a time. Build your CASSPT understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Threat and Vulnerability Assessment

During a threat modeling exercise for a new payment API, the team maps each asset to the ways an adversary could reach it. Which activity best describes this step of the threat modeling process?

  1. Enumerating trust boundaries and entry points to identify attack paths Correct answer.
  2. Estimating the annualized loss expectancy for each asset
  3. Drafting the incident response communication plan
  4. Configuring the WAF rule set for the API gateway

Explanation

Threat modeling centers on decomposing the system, identifying trust boundaries and entry points, and enumerating how an adversary could traverse them. Loss expectancy belongs to quantitative risk analysis, while WAF configuration and communications planning are later operational controls.

Question 2Threat and Vulnerability Assessment

A vulnerability scan reports a finding on a production host but the system owner insists the service is not exposed. Which action most directly resolves the disagreement before the finding is closed?

  1. Suppress the finding in the scanner console to reduce noise
  2. Re-scan the entire subnet with aggressive timing templates
  3. Perform manual validation of the finding against the live service Correct answer.
  4. Escalate the finding to the vendor that published the CVE

Explanation

Findings should be validated manually to confirm whether the reported condition is a true positive and whether compensating controls exist. Suppressing or rescanning does not establish the actual exposure state, and the CVE vendor does not adjudicate the local configuration.

Question 3Threat and Vulnerability Assessment

Which scoring metric in CVSS v3.1 reflects whether an attacker must already be authenticated to exploit a vulnerability?

  1. Confidentiality
  2. Scope
  3. Attack Complexity
  4. Privileges Required Correct answer.

Explanation

Privileges Required captures the level of access an attacker must hold before exploitation succeeds, ranging from none to high. Scope describes whether impact crosses a security authority, Confidentiality measures data disclosure, and Attack Complexity measures conditions beyond the attacker's control.

Question 4Threat and Vulnerability Assessment

An analyst is prioritizing remediation across several systems and wants to combine exploit likelihood with business impact. Which approach best supports that goal?

  1. Ranking solely by the number of open ports
  2. Ranking solely by CVSS base score
  3. Ranking solely by the date the CVE was published
  4. Ranking by a risk score that weights asset criticality and threat context Correct answer.

Explanation

Risk-based prioritization combines technical severity with asset criticality, exposure, and threat intelligence to reflect actual business impact. Base scores, port counts, and publication dates each capture only one dimension and can misorder remediation.

Question 5Threat and Vulnerability Assessment

Which framework is most commonly used to describe adversary tactics and techniques so defenders can map detections to observed behavior?

  1. ISO/IEC 27001
  2. MITRE ATT&CK Correct answer.
  3. NIST SP 800-53
  4. PCI DSS

Explanation

MITRE ATT&CK catalogs adversary tactics and techniques observed in real intrusions, enabling defenders to align detections and threat hunting. The other frameworks are control or compliance standards rather than behavior catalogs.

Question 6Threat and Vulnerability Assessment

A web application reflects user input into an HTML response without encoding. Which vulnerability class is most directly indicated?

  1. Insecure deserialization
  2. XML external entity injection
  3. Cross-site scripting Correct answer.
  4. Server-side request forgery

Explanation

Reflecting unencoded user input into HTML allows injected script to execute in a victim's browser, which is cross-site scripting. SSRF abuses server-side requests, deserialization abuses object reconstruction, and XXE abuses XML parser entity resolution.

Question 7Threat and Vulnerability Assessment

Which characteristic makes an asset a higher-priority target during a threat assessment?

  1. It has a large number of installed fonts
  2. It uses a nonstandard hostname convention
  3. It runs on hardware nearing end of warranty
  4. It hosts regulated customer data and is reachable from the internet Correct answer.

Explanation

Asset criticality rises when the asset holds sensitive regulated data and is broadly reachable, because both impact and exposure increase. Warranty status, fonts, and naming conventions do not directly raise the value or exposure of the data.

Question 8Threat and Vulnerability Assessment

Which source is most appropriate for obtaining timely indicators of compromise such as malicious IP addresses and file hashes?

  1. The organization's acceptable use policy
  2. A threat intelligence feed Correct answer.
  3. The annual financial audit report
  4. The network switch configuration baseline

Explanation

Threat intelligence feeds deliver indicators such as malicious IPs and hashes that can be operationalized in detection tooling. Policies, audit reports, and configuration baselines describe governance or architecture rather than current adversary indicators.

Question 9Threat and Vulnerability Assessment

A vulnerability scanner reports a critical finding, but the affected service is confirmed to be running a patched version. How should the finding be handled?

  1. Report it to the CVE vendor as a new vulnerability
  2. Leave it open and accept the risk permanently
  3. Close it as a false positive after documenting the version evidence Correct answer.
  4. Change the scanner to skip that host permanently

Explanation

When validation shows the vulnerability is not present, the finding is a false positive and should be closed with documented evidence. Permanently skipping the host or accepting risk misrepresents the state, and the vendor is not responsible for local scan results.

Question 10Threat and Vulnerability Assessment

An attacker sends a crafted request that causes the backend to fetch an internal metadata endpoint and return its contents. Which vulnerability is being exploited?

  1. Server-side request forgery Correct answer.
  2. Cross-site request forgery
  3. Directory traversal
  4. SQL injection

Explanation

Server-side request forgery tricks the server into making requests to attacker-chosen destinations, such as cloud metadata services. CSRF abuses a victim's browser session, SQL injection manipulates queries, and directory traversal reads files through path manipulation.

Question 11Threat and Vulnerability Assessment

Which factor most strongly increases the operational priority of a vulnerability that has a public proof-of-concept exploit?

  1. The vulnerability was discovered by an external researcher
  2. The affected asset is internet-facing and holds sensitive data Correct answer.
  3. The vulnerable package is licensed under a permissive open-source license
  4. The affected vendor has a large customer base

Explanation

A public exploit raises likelihood, and internet exposure plus sensitive data raises impact, so the combination drives urgency. Licensing, discoverer identity, and vendor size do not directly change the local risk of exploitation.

Question 12Threat and Vulnerability Assessment

During an assessment, an analyst observes that an application accepts serialized objects from users and reconstructs them server-side. Which risk should be assessed first?

  1. Cross-site scripting in the login form
  2. Weak TLS cipher suite negotiation
  3. Insecure deserialization leading to remote code execution Correct answer.
  4. Missing security headers on static assets

Explanation

Deserializing untrusted input can allow attacker-controlled object graphs to trigger code execution or privilege escalation, making it the highest-severity concern described. XSS, cipher suites, and headers are separate issues not indicated by the observation.

Question 13Threat and Vulnerability Assessment

Which practice best reduces the chance that a vulnerability assessment misses newly added cloud resources?

  1. Integrating the scanner with cloud asset inventory and tagging Correct answer.
  2. Disabling authenticated scanning to reduce false positives
  3. Relying on annual manual inventory reviews
  4. Scanning only the IP ranges documented in the CMDB

Explanation

Cloud environments change rapidly, so tying scans to live asset inventory and tags keeps coverage current. Manual reviews and static IP lists lag behind provisioning, and disabling authenticated scanning reduces depth rather than improving coverage.

Question 14Threat and Vulnerability Assessment

An analyst needs to determine whether a specific CVE affects a deployed application that bundles a third-party library. What is the most reliable first step?

  1. Assume the application is affected because the library name matches
  2. Check the exact library version and build against the affected version range Correct answer.
  3. Wait for the next scheduled quarterly scan
  4. Ask the application users whether they have seen errors

Explanation

Confirming the exact version and build against the CVE's affected range establishes whether the vulnerable code is present. Name matching is unreliable, scheduled scans may be delayed, and user reports do not establish software composition.

Question 15Threat and Vulnerability Assessment

Which technique best helps a defender anticipate adversary behavior against a newly deployed service before an incident occurs?

  1. Enabling verbose error messages for troubleshooting
  2. Increasing the log retention period to one year
  3. Rotating administrator passwords on a quarterly schedule
  4. Conducting adversarial threat modeling and attack path analysis Correct answer.

Explanation

Adversarial threat modeling and attack path analysis explicitly reason about how an attacker would approach the new service. Log retention, password rotation, and verbose errors are operational hygiene or controls, not predictive analysis of adversary behavior.

Question 16Threat and Vulnerability Assessment

A CVSS v3.1 vector string shows Attack Vector Network, Attack Complexity Low, Privileges Required None, and User Interaction None. What does this combination most directly indicate?

  1. The vulnerability affects only confidentiality with no integrity impact
  2. The vulnerability is exploitable only during a narrow timing window
  3. The vulnerability is remotely exploitable without credentials or user action Correct answer.
  4. The vulnerability requires local access and significant user action

Explanation

Network attack vector with low complexity, no privileges, and no user interaction describes a remotely reachable flaw that an unauthenticated attacker can trigger directly. Local access, confidentiality-only impact, and timing windows correspond to other metric values.

Question 17Threat and Vulnerability Assessment

Which indicator is most consistent with an adversary performing reconnaissance against an internet-facing web server?

  1. A routine operating system patch installation
  2. A spike in requests for common administrative paths from a single source Correct answer.
  3. A scheduled backup job completing successfully
  4. A sudden increase in legitimate checkout transactions

Explanation

Automated probing of common administrative paths from one source is a classic reconnaissance signature. Transaction spikes, backups, and patching are normal operational events that do not indicate enumeration behavior.

Question 18Threat and Vulnerability Assessment

When sharing threat intelligence indicators with a partner organization, which practice best preserves the value of the data while limiting harm?

  1. Share indicators with confidence levels, timestamps, and handling restrictions Correct answer.
  2. Share only indicators older than one year to avoid attribution
  3. Share raw indicators without context to maximize volume
  4. Share indicators through public social media channels

Explanation

Indicators retain value when accompanied by confidence, observation time, and handling caveats, which let recipients judge relevance and act appropriately. Raw volume, stale data, and public channels reduce utility or increase risk.

Question 19Threat and Vulnerability Assessment

An organization wants to reduce the time between vulnerability disclosure and remediation. Which metric best tracks progress toward that goal?

  1. Percentage of hosts with antivirus installed
  2. Mean time to remediate by severity Correct answer.
  3. Number of firewall rules in the perimeter policy
  4. Number of vulnerabilities discovered per scan

Explanation

Mean time to remediate by severity directly measures how quickly findings are closed after disclosure. Discovery counts, antivirus coverage, and firewall rule counts describe volume or control presence, not remediation speed.

Question 20Threat and Vulnerability Assessment

A threat assessment identifies that an internal application trusts any request arriving from the corporate network. Which weakness does this represent?

  1. Implicit trust across a network boundary Correct answer.
  2. Inadequate backup encryption
  3. Insufficient log retention
  4. Weak password hashing algorithm

Explanation

Treating network location as proof of identity creates implicit trust that an attacker can abuse after gaining a foothold. Log retention, password hashing, and backup encryption are separate control areas not described by the observation.

Question 21Threat and Vulnerability Assessment

An analyst must decide whether a newly published vulnerability is exploitable in the organization's environment. Which combination of evidence is most decisive?

  1. Presence of the vulnerable component, exposure of the asset, and available exploit tooling Correct answer.
  2. Total count of open findings in the vulnerability tracker
  3. CVE publication date and vendor marketing materials
  4. Number of employees who have heard of the vulnerability

Explanation

Exploitability depends on whether the vulnerable code is present, whether the asset is reachable, and whether practical exploit tooling exists. Publication dates, awareness, and tracker counts do not establish local exploitability.

Question 22Threat and Vulnerability Assessment

A vulnerability scanner authenticates to hosts with domain credentials. Which risk should be addressed in the assessment design?

  1. Credentials eliminate the need for patch management
  2. Authenticated scans always produce more false positives than unauthenticated scans
  3. The scanner account may hold excessive privileges that expand blast radius if compromised Correct answer.
  4. Authenticated scanning prevents the use of CVSS scoring

Explanation

Authenticated scanning requires a privileged account, so least privilege and monitoring limit the impact if that account is misused. Authenticated scans generally improve accuracy, do not replace patching, and do not preclude CVSS scoring.

Question 23Threat and Vulnerability Assessment

An adversary uses living-off-the-land binaries to avoid detection after initial access. Which assessment conclusion best follows?

  1. Signature-based detection alone is sufficient for this threat
  2. The threat is low risk because no malware was installed
  3. Behavioral detection and baseline anomaly analysis are needed alongside signatures Correct answer.
  4. The organization should disable administrative tooling entirely

Explanation

Living-off-the-land techniques abuse legitimate binaries, so file signatures alone often miss them; behavioral baselines add necessary coverage. Disabling administrative tools is impractical, and absence of malware does not reduce impact.

Question 24Threat and Vulnerability Assessment

Two findings share the same CVSS base score, but one affects a system processing regulated data and the other a development sandbox. How should remediation be sequenced?

  1. Defer both until the next annual assessment cycle
  2. Remediate the sandbox first because developers need a secure environment
  3. Remediate both simultaneously regardless of context
  4. Remediate the regulated-data system first because business impact is higher Correct answer.

Explanation

Equal base scores do not imply equal risk; asset criticality and data sensitivity raise the impact of the regulated system. Sequencing should follow business impact, and deferring both leaves unnecessary exposure.

Question 25Threat and Vulnerability Assessment

A team is scoping a penetration test against a cloud-hosted application. Which scoping element most directly prevents unintended disruption to production?

  1. Allowing unrestricted denial-of-service testing during business hours
  2. Providing the testers with a list of all employee names
  3. Requiring testers to use the same VPN as administrators
  4. Defining in-scope targets, testing windows, and prohibited techniques in a signed agreement Correct answer.

Explanation

Clear scope, timing, and technique restrictions in a signed agreement bound the test and protect production systems. Employee lists and shared VPN access do not limit disruption, and unrestricted denial-of-service testing increases it.

Question 26Threat and Vulnerability Assessment

An analyst is building a threat model for a new customer-facing API and must rank adversary groups by relevance. Which attribute of a threat actor most directly determines whether that actor is a credible threat to this specific API?

  1. The number of followers the actor maintains on public social media channels
  2. The geographic region where the actor's malware was first observed
  3. The actor's demonstrated intent and capability aligned to the API's exposed attack surface Correct answer.
  4. The actor's preferred programming language for tool development

Explanation

Threat relevance is established by matching an actor's intent and capability against the specific attack surface and value of the target asset. Attributes such as tooling language or historical origin do not by themselves show that the actor can or will reach this API. Without that alignment, the actor cannot be prioritized as a credible threat.

Question 27Threat and Vulnerability Assessment

An analyst is cataloging assets for a threat and vulnerability assessment and needs to record the attack surface of each. Which entry best describes an attack surface rather than an asset attribute?

  1. The hardware vendor and model of the server hosting the application
  2. The set of reachable entry points and exposed services through which an adversary could interact with the system Correct answer.
  3. The date the operating system was last patched
  4. The business owner assigned to approve changes to the system

Explanation

Attack surface is the collection of exposed interfaces, protocols, and entry points an adversary can reach, such as listening services, APIs, and user input paths. Vendor, ownership, and patch date describe the asset or its management rather than its exposure. Assessment scoping depends on enumerating entry points, not inventory metadata.

Question 28Threat and Vulnerability Assessment

A vulnerability assessment team is choosing a scoring approach for findings. Which statement correctly describes how CVSS base metrics relate to environmental metrics?

  1. Base metrics already incorporate the organization's compensating controls, so environmental metrics are informational only
  2. Base and environmental metrics are averaged to produce the final severity score
  3. Environmental metrics replace base metrics entirely whenever the asset is internet-facing
  4. Base metrics capture intrinsic characteristics of a vulnerability, while environmental metrics adjust severity for the specific deployed context Correct answer.

Explanation

CVSS separates intrinsic vulnerability properties (base) from context-specific modifiers such as mitigations, confidentiality requirements, and modified attack vectors (environmental). Environmental metrics are applied on top of the base to reflect the assessed environment. They do not replace or average with the base score.

Question 29Threat and Vulnerability Assessment

During a threat assessment an analyst must distinguish a vulnerability from an exposure. Which observation is best classified as a vulnerability rather than an exposure?

  1. A staging hostname resolves in public DNS
  2. A service parses untrusted input with a routine that permits out-of-bounds memory reads Correct answer.
  3. A server banner discloses the operating system version
  4. A file share permits anonymous read access to archived marketing collateral

Explanation

A vulnerability is a weakness in code or configuration that can be exploited to cause harm, such as a memory-safety flaw reachable with attacker-controlled input. Anonymous access, banner disclosure, and DNS visibility are exposures: they reveal or widen access but are not by themselves exploitable weaknesses. Analysts separate the two because remediation and risk treatment differ.

Question 30Threat and Vulnerability Assessment

An analyst is reviewing a web application and finds that session identifiers are generated with a predictable incrementing counter and are never rotated after login. Which assessment conclusion best captures the risk?

  1. The finding is out of scope because it concerns application logic rather than infrastructure
  2. The finding is informational because session management is a design choice
  3. An attacker who obtains or guesses a session identifier can hijack an authenticated session, so the finding should be rated high Correct answer.
  4. The finding is low risk because session identifiers are transmitted only over TLS

Explanation

Predictable identifiers combined with no rotation after authentication allow session fixation and hijacking, which grants an attacker the victim's privileges. TLS protects identifiers in transit but does not prevent guessing or fixation. Session management weaknesses are core application security findings and belong in the assessment.

Question 31Threat and Vulnerability Assessment

An analyst is evaluating whether a public exploit changes the risk rating of a vulnerability in a segmented internal network. Which reasoning is most defensible?

  1. Exploit availability should be ignored until the vendor publishes an advisory
  2. Exploit availability alone fixes the rating at critical regardless of network placement
  3. Exploit availability raises likelihood, but the rating must also account for the reachability of the affected host from untrusted networks Correct answer.
  4. Exploit availability is irrelevant because the host is not internet-facing

Explanation

Weaponized exploit code increases the likelihood of exploitation, but risk also depends on whether an attacker can reach the vulnerable component. Segmentation reduces exposure and should be reflected in the environmental assessment. Neither ignoring exploit maturity nor treating it as decisive on its own is sound.

Question 32Threat and Vulnerability Assessment

A threat intelligence feed provides indicators of compromise with no context or expiry. Which action best supports their use in a vulnerability and threat assessment program?

  1. Discard the feed entirely because it lacks metadata
  2. Ingest every indicator directly into blocking controls to maximize coverage
  3. Enrich indicators with context and aging rules before operational use, and treat them as hypotheses to validate Correct answer.
  4. Publish the raw indicators to all staff so they can recognize attacks

Explanation

Indicators without context or lifetime decay quickly and can cause false positives or block legitimate traffic. Enrichment and aging let analysts judge relevance and confidence before operationalizing them. Treating them as hypotheses keeps the program evidence-driven rather than reactive.

Question 33Threat and Vulnerability Assessment

An analyst is assessing a containerized workload and must determine whether a reported kernel vulnerability is exploitable. Which factor is most decisive?

  1. Whether the container shares the host kernel and whether the vulnerable syscall is reachable from the container's workload Correct answer.
  2. Whether the container image uses a minimal base operating system
  3. Whether the workload is deployed with more than one replica
  4. Whether the container registry enforces image signing

Explanation

Containers share the host kernel, so kernel vulnerabilities can be exploitable from inside a container if the vulnerable code path is reachable. Minimal base images and signing reduce other risks but do not remove kernel exposure. Replica count affects availability, not exploitability.

Question 34Threat and Vulnerability Assessment

An analyst is reviewing authentication for a legacy administrative interface and finds it accepts basic credentials over plain HTTP on the internal network. Which recommendation best reflects sound risk treatment?

  1. Restrict access by source IP address and consider the finding closed
  2. Require the interface to be reached only through an encrypted, authenticated jump path and plan migration to a modern protocol Correct answer.
  3. Accept the risk because the interface is reachable only from the internal network
  4. Add a longer password policy to compensate for the lack of encryption

Explanation

Credentials sent over plain HTTP can be captured by anyone with network visibility, so encryption and strong authentication must be enforced, with migration as the durable fix. Internal-only placement and source IP filtering reduce but do not eliminate interception risk. Password length does not protect credentials in transit.

Question 35Threat and Vulnerability Assessment

A threat assessment team is mapping adversary tactics to the assets they could affect. Which pairing best illustrates the technique of establishing an initial foothold via a legitimate remote service?

  1. Exploiting a buffer overflow in a public web server
  2. Using valid credentials over an exposed remote desktop or SSH service to log in without malware Correct answer.
  3. Registering a lookalike domain for a future campaign
  4. Sending phishing email with a malicious attachment to an employee

Explanation

Logging in with valid accounts over exposed remote services is a technique that abuses legitimate access rather than exploiting a flaw. Phishing delivery, memory corruption exploitation, and domain registration are different tactics in the adversary lifecycle. Mapping assets to such techniques reveals where authentication hardening and service exposure controls matter most.

Question 36Threat and Vulnerability Assessment

An analyst is assessing a third-party component embedded in a product and must determine whether a published vulnerability applies. The vendor's advisory lists affected version ranges. Which step is most reliable?

  1. Wait for a scanner signature before drawing any conclusion
  2. Assume the vulnerability applies because the component family is named in the advisory
  3. Compare the component's exact build and patch level against the advisory's affected ranges and backported fixes Correct answer.
  4. Rely on the product's marketing version number alone

Explanation

Applicability depends on the precise build and patch level, because vendors often backport fixes without changing the visible version. Advisory ranges and backport notes are the authoritative reference. Family-level assumptions, marketing versions, and scanner lag all produce false conclusions.

Question 37Threat and Vulnerability Assessment

An analyst is quantifying risk for a finding and wants to express the potential business impact rather than only technical severity. Which input contributes most directly to that estimate?

  1. The number of lines of code in the vulnerable module
  2. The CVSS temporal score alone
  3. The criticality of the business process supported by the affected system and the data it handles Correct answer.
  4. The scanner's confidence rating for the finding

Explanation

Business impact reflects what the affected system supports: process criticality, regulated data, and downstream dependencies. Code size and scanner confidence are technical signals that do not translate into business consequence. Temporal score adjusts exploitability over time but remains a technical measure.

Question 38Threat and Vulnerability Assessment

A team is preparing a threat assessment for a merger and must evaluate an acquired company's environment. Which approach best handles unknown and undocumented assets?

  1. Limit assessment to assets mentioned in the merger agreement
  2. Rely solely on the acquired company's self-reported asset list
  3. Defer all assessment until integration is complete
  4. Perform active discovery and passive traffic analysis to build an asset inventory, then reconcile it with the acquired company's records Correct answer.

Explanation

Undocumented and shadow assets are common in acquired environments, so independent discovery combined with traffic observation is needed to establish a trustworthy inventory. Self-reported lists, contractual scope, and post-integration deferral all leave unknown exposure unexamined. Reconciliation then resolves discrepancies between discovered and reported assets.

Question 39Threat and Vulnerability Assessment

An analyst observes that a critical service has no network segmentation and is reachable from user workstations. Which conclusion best follows for the threat assessment?

  1. Lateral movement from a compromised workstation to the critical service is feasible, raising the assessed likelihood of impact Correct answer.
  2. The finding is out of scope because segmentation is a network design issue
  3. The finding is low priority because workstations are patched
  4. The finding is mitigated because the service requires authentication

Explanation

Lack of segmentation means a workstation compromise can pivot directly to a critical service, which raises the likelihood that an initial intrusion escalates to serious impact. Authentication helps but does not prevent credential abuse or exploitation. Network design weaknesses are legitimate assessment findings.

Question 40Threat and Vulnerability Assessment

An analyst is designing a vulnerability assessment cadence for a rapidly changing cloud environment. Which approach best balances coverage with operational cost?

  1. Scan only annually to minimize disruption to production
  2. Combine continuous asset discovery with risk-based scanning frequency driven by asset criticality and change rate Correct answer.
  3. Scan every asset weekly with full authenticated scans regardless of criticality
  4. Scan only when an incident occurs to focus effort on real problems

Explanation

Continuous discovery catches new and changed resources, while risk-based frequency concentrates scanning effort where criticality and churn are highest. Uniform high-frequency scanning wastes resources and may disrupt stable low-risk systems. Annual or incident-only scanning leaves windows of undetected exposure.

Question 41Security Architecture and Design

In a formal security architecture, which concept describes the complete set of mechanisms (preventive, detective, and corrective) that protect an asset across its lifecycle?

  1. Risk appetite statement
  2. Trust boundary
  3. Security control baseline
  4. Defense in depth Correct answer.

Explanation

Defense in depth layers independent controls so that failure of one mechanism does not expose the asset, spanning preventive, detective, and corrective functions. A baseline is a minimum set of controls, not a layered architecture, and a trust boundary marks where trust level changes.

Question 42Security Architecture and Design

An architect places the web tier in a subnet that can receive traffic from the internet but cannot initiate connections to the database tier directly. Which design principle does this most directly implement?

  1. Least common mechanism
  2. Fail-safe defaults
  3. Separation of duties
  4. Least privilege Correct answer.

Explanation

Least privilege grants each component only the access it needs to perform its function, so the web tier is limited to the flows its role requires. Separation of duties divides tasks among people, and least common mechanism minimizes shared resources among users.

Question 43Security Architecture and Design

Which security model is specifically designed to prevent information flow that violates confidentiality by assigning subjects and objects labels and enforcing dominance rules?

  1. Bell-LaPadula model Correct answer.
  2. Biba integrity model
  3. Clark-Wilson model
  4. Brewer-Nash model

Explanation

Bell-LaPadula enforces confidentiality with the no-read-up and no-write-down properties based on security labels. Biba addresses integrity, Clark-Wilson enforces integrity through well-formed transactions, and Brewer-Nash prevents conflicts of interest.

Question 44Security Architecture and Design

In the Bell-LaPadula model, a subject cleared at Secret attempts to write to an object classified at Confidential. What does the model enforce?

  1. The write is permitted because Secret dominates Confidential
  2. The write is denied by the no-write-down property Correct answer.
  3. The write is permitted only with a temporary downgrade
  4. The write is denied by the no-read-up property

Explanation

The *-property (no-write-down) prevents a subject from writing to an object at a lower classification, which would leak higher-classified information. Writing Secret data into a Confidential object would violate that rule, so the operation is blocked.

Question 45Security Architecture and Design

A healthcare system must ensure that only clinicians with an active treatment relationship to a patient can view that patient's record. Which access control model best fits this requirement?

  1. Attribute-based access control Correct answer.
  2. Discretionary access control
  3. Mandatory access control
  4. Role-based access control

Explanation

Attribute-based access control evaluates attributes of the subject, resource, action, and context, allowing policies such as an active treatment relationship between clinician and patient. RBAC keys on job role only, MAC on classification labels, and DAC on owner discretion, none of which capture the relationship.

Question 46Security Architecture and Design

Which statement accurately describes the role of a reference monitor in a trusted computing base?

  1. It mediates every access by subjects to objects and must be tamper-proof and verifiable Correct answer.
  2. It stores audit logs for later forensic review
  3. It authenticates users before they reach the network perimeter
  4. It encrypts data at rest across all storage volumes

Explanation

The reference monitor is the abstract enforcement component that validates every access request against policy, and it must be always invoked, tamper-proof, and small enough to be verified. Audit logging, encryption, and authentication are separate functions that may support but do not define it.

Question 47Security Architecture and Design

A security architect is selecting encryption for data at rest on a shared storage array. Which requirement most directly justifies choosing a mode that provides per-record integrity protection as well as confidentiality?

  1. The array must support key rotation
  2. The array must compress data before encryption
  3. The organization requires FIPS 140-3 validated modules
  4. Records may be individually modified or reordered by an attacker with storage access Correct answer.

Explanation

Authenticated encryption modes detect tampering and reordering of records, so the threat of an attacker with storage-level access justifies integrity protection alongside confidentiality. Key rotation, compression, and module validation are separate requirements that do not address record tampering.

Question 48Security Architecture and Design

In a security architecture, what is the primary purpose of segmenting a network into zones separated by mediating devices?

  1. To eliminate the need for endpoint controls
  2. To simplify IP address management
  3. To reduce the broadcast domain size for performance
  4. To limit the blast radius of a compromise and enforce policy between trust levels Correct answer.

Explanation

Zoning establishes trust boundaries where traffic between zones is mediated and policy-enforced, which contains the impact of a compromise. Performance, endpoint coverage, and addressing are operational side effects, not the security rationale.

Question 49Security Architecture and Design

An architect documents that a system, upon failure, must deny access and preserve its last known secure state. Which design principle is being specified?

  1. Open design
  2. Fail-safe defaults Correct answer.
  3. Economy of mechanism
  4. Psychological acceptability

Explanation

Fail-safe defaults require that a system fail into a secure, denying state rather than an open one. Open design concerns public scrutiny of the design, economy of mechanism favors simplicity, and psychological acceptability concerns usability.

Question 50Security Architecture and Design

Which of the following best characterizes the Trusted Computing Base (TCB) of a system?

  1. The totality of protection mechanisms, including hardware, firmware, and software, that enforce the security policy Correct answer.
  2. The set of users authorized to administer the system
  3. The network perimeter devices protecting the system
  4. All applications installed on the system

Explanation

The TCB comprises every protection mechanism within a system that is relied upon to enforce the security policy, spanning hardware, firmware, and software. Installed applications, administrators, and perimeter devices are not the definition of the TCB.