I85PREP
⌘ K
ISSAP study materials
ISSAP study resources

ISSAP practice questions

One question at a time. Build your ISSAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecting for governance, risk and compliance (GRC)

An enterprise security architect is drafting an information security policy hierarchy. Which document type should define mandatory, technology-specific configuration requirements that support a high-level control statement?

  1. Procedure
  2. Standard Correct answer.
  3. Charter
  4. Guideline

Explanation

Standards translate policy intent into mandatory, measurable requirements, including technology-specific configuration baselines. Procedures describe step-by-step execution, guidelines are discretionary advice, and a charter authorizes a program rather than setting configuration requirements.

Question 2Architecting for governance, risk and compliance (GRC)

A risk assessment team wants to express exposure in monetary terms so that remediation can be compared against business impact. Which measurement approach should the architect recommend?

  1. Qualitative risk rating
  2. Quantitative risk analysis Correct answer.
  3. Control maturity scoring
  4. Threat modeling

Explanation

Quantitative risk analysis assigns monetary values to asset loss, likelihood, and impact, enabling cost-benefit comparison of remediation options. Qualitative ratings use ordinal scales, maturity scoring measures control capability, and threat modeling identifies attack paths rather than financial exposure.

Question 3Architecting for governance, risk and compliance (GRC)

An architect must determine which party is accountable for a specific control when workloads run in a public cloud. Which artifact primarily defines this allocation?

  1. Business impact analysis
  2. Statement of work
  3. Shared responsibility model Correct answer.
  4. Service level agreement

Explanation

The shared responsibility model divides security and compliance duties between the cloud provider and the customer across service and deployment models. An SLA defines performance commitments, a BIA identifies critical processes, and a statement of work scopes project deliverables.

Question 4Architecting for governance, risk and compliance (GRC)

Which security architecture principle most directly limits the damage an attacker can cause after compromising a single component?

  1. Economy of mechanism
  2. Defense in depth
  3. Separation of duties
  4. Least privilege Correct answer.

Explanation

Least privilege grants each subject only the access needed for its function, so a compromised component holds minimal authority and blast radius is constrained. Defense in depth adds layers, separation of duties splits tasks among people, and economy of mechanism favors simplicity.

Question 5Architecting for governance, risk and compliance (GRC)

A regulator requires that evidence of control operation be retained and be producible on demand. Which architecture decision best satisfies this requirement?

  1. Enabling verbose debug logging on production systems
  2. Centralizing tamper-evident logs with defined retention Correct answer.
  3. Deploying an intrusion prevention system at the perimeter
  4. Requiring annual security awareness training

Explanation

Compliance evidence depends on records that are complete, protected from alteration, and retained for the required period. Centralized tamper-evident logging with a defined retention schedule provides auditable evidence, whereas the other options address detection or awareness rather than evidentiary retention.

Question 6Architecting for governance, risk and compliance (GRC)

Which document typically records a formally accepted risk, its owner, and the rationale for acceptance?

  1. Risk register Correct answer.
  2. Incident response plan
  3. Configuration baseline
  4. Data flow diagram

Explanation

A risk register tracks identified risks with attributes such as owner, rating, treatment decision, and acceptance rationale. Incident response plans guide handling of events, configuration baselines define approved settings, and data flow diagrams depict information movement.

Question 7Architecting for governance, risk and compliance (GRC)

An architect is selecting a framework to structure an IT governance program that aligns IT objectives with enterprise goals. Which framework is designed primarily for that purpose?

  1. PCI DSS
  2. NIST SP 800-53
  3. COBIT Correct answer.
  4. ISO 27001

Explanation

COBIT is a governance framework for enterprise IT that links IT objectives to business goals and defines governance and management processes. PCI DSS is a payment card standard, ISO 27001 specifies an information security management system, and NIST SP 800-53 is a control catalog.

Question 8Architecting for governance, risk and compliance (GRC)

An organization must demonstrate that it processes personal data lawfully and can respond to data subject requests. Which architectural capability is most directly required?

  1. A data inventory with processing records Correct answer.
  2. Full-disk encryption on endpoints
  3. A web application firewall
  4. Data loss prevention at the network edge

Explanation

Privacy obligations require knowing what personal data exists, where it flows, and why it is processed so that lawful basis and subject rights can be honored. A data inventory with records of processing supports this, while the other options are protective controls that do not establish accountability.

Question 9Architecting for governance, risk and compliance (GRC)

A business unit proposes a new SaaS tool that will store regulated data. The architect must ensure risk is evaluated before deployment. Which governance mechanism is most appropriate?

  1. A quarterly access recertification
  2. A post-incident review after go-live
  3. An annual penetration test of all systems
  4. A pre-deployment risk and compliance review Correct answer.

Explanation

A pre-deployment review evaluates the tool against policy, regulatory, and risk criteria before regulated data is introduced, allowing conditions or rejection. Post-incident reviews occur after harm, annual testing is periodic and broad, and access recertification addresses existing entitlements.

Question 10Architecting for governance, risk and compliance (GRC)

An architect is mapping controls to a regulatory requirement and finds that one control satisfies multiple requirements. What is the primary benefit of recording this mapping?

  1. It eliminates the need for a risk assessment
  2. It guarantees the regulator will accept the design
  3. It removes the need for audit evidence
  4. It reduces the number of controls that must be tested independently Correct answer.

Explanation

Control mapping shows where one control satisfies several obligations, enabling consolidated testing and reducing duplicated assurance effort. It does not remove the need for risk assessment or evidence, and it cannot guarantee regulatory acceptance.

Question 11Architecting for governance, risk and compliance (GRC)

A system owner proposes accepting a high residual risk without executive involvement. Which governance response is most appropriate?

  1. Transfer the risk to the security team
  2. Close the risk as mitigated without further action
  3. Allow the owner to accept it because they operate the system
  4. Escalate acceptance to the accountable executive Correct answer.

Explanation

Risk acceptance authority should match the level of impact; high residual risk typically exceeds a system owner's delegated authority and must be accepted by an accountable executive. Risk cannot be transferred to the security team, which advises rather than owns business risk.

Question 12Architecting for governance, risk and compliance (GRC)

During architecture review, a designer proposes a single sign-on service that all applications will trust. Which governance concern should the architect raise first?

  1. The user interface consistency across applications
  2. The licensing cost of the identity provider
  3. The concentration of authentication risk in one component Correct answer.
  4. The frequency of password resets

Explanation

Centralizing authentication makes the identity provider a single point of trust whose compromise affects every relying application, so resilience and assurance of that component are primary governance concerns. Interface consistency, licensing, and password reset frequency are secondary operational matters.

Question 13Architecting for governance, risk and compliance (GRC)

An organization must retain audit logs for seven years but also must honor data minimization. Which design decision best reconciles these obligations?

  1. Store logs only on the systems that generate them
  2. Retain full logs indefinitely to avoid deleting needed evidence
  3. Archive logs with defined retention and access controls Correct answer.
  4. Delete all logs after ninety days to minimize data

Explanation

A defined retention period with access controls satisfies the legal hold requirement while limiting unnecessary exposure, reconciling retention with minimization. Indefinite retention conflicts with minimization, premature deletion violates the retention obligation, and distributed storage undermines integrity and availability.

Question 14Architecting for governance, risk and compliance (GRC)

A vendor contract requires the provider to notify the organization of breaches within 24 hours. Which architecture artifact should link this obligation to technical monitoring?

  1. A capacity management plan
  2. A control and obligation register tied to monitoring Correct answer.
  3. A user acceptance test plan
  4. A network diagram of the provider's data center

Explanation

Linking contractual obligations to controls and monitoring ensures that notification duties are operationally enforceable and auditable. Network diagrams, test plans, and capacity plans do not connect contractual duties to detection and reporting activities.

Question 15Architecting for governance, risk and compliance (GRC)

A security architect is asked to justify a control investment to the board. Which framing is most aligned with governance expectations?

  1. The control uses the newest available technology
  2. The control matches a competitor's architecture
  3. The control reduces quantified risk below tolerance at acceptable cost Correct answer.
  4. The control is required by the security team's preference

Explanation

Boards govern by comparing risk reduction against cost and appetite, so framing investment as reducing quantified risk below tolerance supports a defensible decision. Novelty, internal preference, and competitor imitation do not demonstrate value relative to risk.

Question 16Architecting for governance, risk and compliance (GRC)

An architect must ensure that privileged administrative actions are attributable to individuals. Which design choice most directly supports this?

  1. Shared administrative accounts with rotation
  2. Unique accounts with session logging Correct answer.
  3. Role-based access with generic service accounts
  4. Password vaulting without identity binding

Explanation

Attribution requires that each privileged action be tied to a specific individual, which unique accounts plus session logging provide. Shared accounts, generic service accounts, and vaulting without identity binding obscure who performed an action.

Question 17Architecting for governance, risk and compliance (GRC)

A regulated workload must be isolated from other tenants to satisfy a compliance boundary. Which architecture approach most directly establishes that boundary?

  1. A dedicated account with enforced network isolation Correct answer.
  2. Tagging resources with a compliance label
  3. Encrypting data at rest with a shared key
  4. Enabling multi-factor authentication for users

Explanation

A dedicated account combined with enforced network isolation creates a technical and administrative boundary that limits cross-tenant interaction. Tagging is metadata, shared keys do not isolate tenants, and multi-factor authentication protects identities rather than workload boundaries.

Question 18Architecting for governance, risk and compliance (GRC)

An organization operates in multiple jurisdictions with conflicting data residency rules. What should the architect do first?

  1. Identify data flows and applicable obligations per jurisdiction Correct answer.
  2. Encrypt all data and treat residency as satisfied
  3. Choose the strictest jurisdiction's rules for all locations
  4. Delegate the decision to each local business unit

Explanation

Resolving conflicting residency obligations begins with knowing where data is created, stored, and transferred and which rules apply in each location. Applying one jurisdiction globally, assuming encryption resolves residency, or fragmenting decisions without oversight can create gaps.

Question 19Architecting for governance, risk and compliance (GRC)

A control is designed and documented but testing shows it operates inconsistently. How should this be characterized in compliance reporting?

  1. As an operating deficiency requiring remediation Correct answer.
  2. As an effective control because it is documented
  3. As a compensating control
  4. As a risk acceptance

Explanation

A control that exists but does not operate reliably is an operating deficiency, distinct from a design deficiency, and must be reported and remediated. Documentation alone does not establish effectiveness, and a deficiency is neither a compensating control nor a risk acceptance.

Question 20Architecting for governance, risk and compliance (GRC)

An architect is defining metrics for a security governance dashboard. Which metric best indicates whether risk treatment is keeping pace with identified risk?

  1. Percentage of high risks with approved treatment plans on schedule Correct answer.
  2. Number of security incidents reported
  3. Number of employees trained
  4. Count of firewall rules configured

Explanation

Tracking the proportion of high risks with approved, on-schedule treatment plans shows whether remediation is progressing relative to exposure. Incident counts, rule counts, and training counts measure activity or outcomes but not treatment timeliness.

Question 21Architecting for governance, risk and compliance (GRC)

A new regulation requires controls that the current architecture cannot satisfy without redesign. What should the architect produce to guide leadership decisions?

  1. An incident response runbook
  2. A gap analysis with remediation options and cost implications Correct answer.
  3. A change advisory board schedule
  4. A penetration test report

Explanation

A gap analysis identifies where the architecture falls short of the regulation and presents remediation options with cost and risk implications for leadership. Runbooks, test reports, and change schedules do not frame the strategic decision required.

Question 22Architecting for governance, risk and compliance (GRC)

An architect proposes a compensating control because a mandated encryption standard cannot be met on a legacy system. What must the compensating control demonstrate to be accepted?

  1. It provides comparable risk mitigation with documented justification Correct answer.
  2. It uses a newer technology than the standard
  3. It is approved by the system administrator
  4. It costs less than the original control

Explanation

A compensating control must mitigate the same risk to a comparable degree and be supported by documented justification and approval at the appropriate level. Cost, administrator approval, or novelty alone do not establish equivalence of risk reduction.

Question 23Architecting for governance, risk and compliance (GRC)

An organization wants assurance that a critical cloud provider's controls remain effective over time, not just at onboarding. Which approach provides the strongest ongoing evidence?

  1. A marketing brochure describing the provider's security
  2. A verbal assurance from the account manager
  3. Continuous control monitoring with independent attestations Correct answer.
  4. A one-time security questionnaire completed at contract signing

Explanation

Ongoing assurance requires continuous monitoring data combined with independent attestations such as audits covering the relevant period. One-time questionnaires, marketing material, and verbal assurances do not provide verifiable, current evidence of control effectiveness.

Question 24Architecting for governance, risk and compliance (GRC)

A global firm must reconcile a legal requirement to delete personal data on request with an immutable backup architecture. Which design decision best addresses the conflict?

  1. Disable backups for systems holding personal data
  2. Retain backups indefinitely to preserve audit trails
  3. Index backup contents and apply deletion at restore or expiry Correct answer.
  4. Encrypt backups and consider the requirement satisfied

Explanation

Indexing backup contents allows deletion requests to be honored when data is restored and supports suppression until backup expiry, balancing immutability with erasure duties. Disabling backups harms resilience, indefinite retention conflicts with erasure, and encryption does not satisfy deletion obligations.

Question 25Architecting for governance, risk and compliance (GRC)

An architect must design logging so that administrators of a production system cannot alter their own audit records. Which approach best achieves this?

  1. Rotating logs daily on the same host
  2. Encrypting logs with a key held by administrators
  3. Forwarding logs to an independent, append-only repository Correct answer.
  4. Storing logs locally with restricted file permissions

Explanation

Forwarding audit records to a separate append-only repository removes the administrator's ability to modify or delete them locally. Local storage, administrator-held keys, and same-host rotation all leave records under the control of the very principals being monitored.

Question 26Architecting for governance, risk and compliance (GRC)

An enterprise architect is defining the scope of a GRC architecture capability. Which statement best describes how governance, risk, and compliance responsibilities differ across the three functions?

  1. Governance performs control testing, risk management sets policy, and compliance owns the enterprise architecture roadmap.
  2. Governance produces audit evidence, risk management sets decision rights, and compliance manages residual risk acceptance.
  3. Governance sets decision rights and accountability, risk management identifies and treats uncertainty, and compliance verifies adherence to obligations. Correct answer.
  4. Governance and compliance are interchangeable, while risk management is limited to insurance purchasing decisions.

Explanation

GRC separates three complementary functions: governance establishes decision rights, accountability, and oversight; risk management identifies, assesses, and treats uncertainty; compliance demonstrates adherence to laws, regulations, and contracts. Keeping these roles distinct prevents gaps such as controls being documented without an accountable owner.

Question 27Architecting for governance, risk and compliance (GRC)

A security architect is building a risk register for a new payment platform. Which attribute is most essential for making the register actionable by architecture and engineering teams?

  1. A clear linkage between each risk, the affected architecture components, and the planned treatment Correct answer.
  2. The historical count of incidents across the entire enterprise
  3. The name of the auditor who will later test the control
  4. The vendor's marketing description of its security features

Explanation

A risk register becomes actionable when each risk is traceable to the specific components it affects and to a defined treatment, so architects can see where design changes are required. Without that linkage the register becomes a static list that cannot drive architecture decisions.

Question 28Architecting for governance, risk and compliance (GRC)

Which concept describes the level of risk an organization is willing to retain after controls are applied, and which must be formally endorsed by accountable leadership?

  1. Control deficiency threshold
  2. Audit materiality
  3. Residual risk tolerance Correct answer.
  4. Inherent risk appetite

Explanation

Residual risk is what remains after controls are applied, and the acceptable level of that residual risk is the risk tolerance endorsed by accountable leadership. Inherent risk is the level before controls, so it cannot describe post-control acceptance.

Question 29Architecting for governance, risk and compliance (GRC)

An architect is defining the control environment for a system that must satisfy both an internal security standard and an external regulatory obligation. What is the most effective way to structure the control set?

  1. Map each control to the requirements it satisfies so a single implemented control provides evidence for multiple obligations. Correct answer.
  2. Maintain two fully separate control catalogs so each obligation is tracked independently with no overlap.
  3. Document controls only after the first audit finding so effort is not wasted on unused controls.
  4. Adopt only the external regulation's controls and retire the internal standard entirely.

Explanation

Mapping controls to the requirements they satisfy creates traceability and allows one well-designed control to provide evidence for several obligations, reducing duplication and testing burden. Separate catalogs typically produce redundant controls and inconsistent evidence.

Question 30Architecting for governance, risk and compliance (GRC)

A regulated workload must be hosted in a jurisdiction where the organization has no data centers. Which governance artifact should the architect establish first to guide provider selection and ongoing oversight?

  1. A data residency and third-party risk policy defining permitted locations and provider obligations Correct answer.
  2. A disaster recovery runbook for the organization's own facilities
  3. A network diagram of the provider's internal switching fabric
  4. A penetration test report from a comparable customer

Explanation

Before selecting a provider, governance must define the rules: which jurisdictions are permitted, what contractual and assurance obligations apply, and how the provider will be overseen. That policy then constrains and justifies the architecture and vendor choice.

Question 31Architecting for governance, risk and compliance (GRC)

An architect is designing a system to support continuous compliance monitoring rather than periodic manual attestation. Which design choice best enables that goal?

  1. Collecting configuration and access data automatically and evaluating it against codified compliance rules on a schedule Correct answer.
  2. Relying on the external auditor to detect configuration drift during the annual review
  3. Requiring business units to submit annual self-assessment spreadsheets
  4. Storing compliance evidence in individual team email archives

Explanation

Continuous compliance depends on automated collection of configuration and access state evaluated against codified rules, so drift is detected quickly and evidence is generated consistently. Manual periodic methods cannot provide timely detection of control failures.

Question 32Architecting for governance, risk and compliance (GRC)

A risk assessment identifies a threat that is likely but whose impact would be limited to a non-critical internal tool. Leadership asks the architect how to prioritize treatment. Which approach best reflects sound risk-based decision making?

  1. Escalate only risks that have already produced a confirmed incident
  2. Defer all treatment until the next annual audit cycle
  3. Treat every identified risk with equal urgency to avoid accusations of inconsistency
  4. Prioritize using likelihood combined with business impact, and document the rationale for the assigned priority Correct answer.

Explanation

Risk-based prioritization weighs likelihood against business impact and records the reasoning so decisions are defensible and repeatable. Equal treatment ignores scarce resources, and waiting for an incident converts a manageable risk into a realized loss.

Question 33Architecting for governance, risk and compliance (GRC)

An architect is asked to design segregation of duties into an approval workflow for production changes. Which design most directly prevents a single individual from both authoring and approving a high-risk change?

  1. Logging all approvals so that conflicts are visible during the next audit
  2. Enforcing workflow rules that block the author from serving as approver and route approval to an independent role Correct answer.
  3. Relying on the change author's professional judgment to escalate risky changes
  4. Requiring the change author to obtain a second personal login for approval

Explanation

Segregation of duties is enforced when the workflow itself prevents the author from approving and routes the decision to an independent role. Preventive design removes the conflict rather than merely detecting it later.

Question 34Architecting for governance, risk and compliance (GRC)

An organization wants its architecture governance board to add value rather than only approve or reject designs. Which operating model best achieves that outcome?

  1. Restrict the board to post-implementation reviews after systems are already live
  2. Allow the board to review only projects that have already failed a security assessment
  3. Review every design decision regardless of size so the board maintains complete control
  4. Define tiered review thresholds, publish architecture principles, and delegate low-risk decisions with clear accountability Correct answer.

Explanation

Effective architecture governance uses risk-tiered thresholds, published principles, and explicit delegation so the board focuses on consequential decisions while teams move quickly with clear accountability. Reviewing everything or only failures either bottlenecks delivery or defeats preventive oversight.

Question 35Identify security architecture approach, legal, regulatory, organizational and industry requirements

A security architect is mapping controls to a regulation that requires protecting cardholder data. Which approach best demonstrates that the architecture satisfies the requirement?

  1. Relying on annual penetration test results as the sole compliance artifact
  2. Documenting a control objective, the mapped regulatory clause, and the technical and procedural controls that satisfy it Correct answer.
  3. Listing every firewall rule in the environment as evidence of segmentation
  4. Adopting the vendor reference architecture without modification

Explanation

Compliance traceability requires linking each regulatory obligation to a control objective and then to the specific technical and procedural controls that implement it. Raw configuration listings and single test artifacts do not show coverage of a requirement. A vendor reference architecture is a starting point, not evidence of satisfaction.

Question 36Identify security architecture approach, legal, regulatory, organizational and industry requirements

A multinational retailer must comply with a data protection law that restricts cross-border transfers. Which architectural decision most directly addresses the legal requirement?

  1. Encrypting data at rest in the primary regional data center
  2. Adding multi-factor authentication for privileged administrators
  3. Implementing data residency controls that keep regulated records within approved jurisdictions Correct answer.
  4. Increasing the frequency of vulnerability scans on internet-facing systems

Explanation

Cross-border transfer restrictions are addressed by controlling where regulated data is stored and processed, which is a data residency and localization decision. Encryption, scanning, and authentication are valuable controls but do not by themselves prevent an unlawful transfer. The architect must design placement and flow controls to match the legal boundary.

Question 37Identify security architecture approach, legal, regulatory, organizational and industry requirements

During architecture review, a stakeholder proposes storing full payment card numbers in an analytics platform to simplify reporting. Which principle should the architect apply first?

  1. Least privilege, restricting analytics queries to senior staff
  2. Defense in depth, adding a second firewall in front of the analytics platform
  3. Separation of duties, splitting report development from report approval
  4. Data minimization, substituting tokenized or truncated values where reporting permits Correct answer.

Explanation

Privacy and regulatory frameworks generally require collecting and retaining only the data needed for a stated purpose, so the architect should first reduce or de-identify the data. Defense in depth, least privilege, and separation of duties are valuable but do not remove the unnecessary exposure of regulated data. Minimization addresses the root cause rather than compensating around it.

Question 38Identify security architecture approach, legal, regulatory, organizational and industry requirements

Which artifact is the most appropriate primary source for an architect to confirm the specific security obligations imposed by a new industry standard the organization has contractually adopted?

  1. A peer-reviewed journal article summarizing common industry practices
  2. The standard's published normative requirements and the organization's signed contractual commitments Correct answer.
  3. A conference presentation from a competing organization's security team
  4. The internal help desk knowledge base article on password resets

Explanation

Normative requirements in the standard plus the organization's actual contractual commitments define the enforceable obligations. Secondary summaries and peer experiences may inform but cannot establish what the organization must do. The architect should work from authoritative text and the executed agreement.

Question 39Identify security architecture approach, legal, regulatory, organizational and industry requirements

An architect is defining the scope boundary for a compliance assessment of a system that processes health information. Which scoping decision is most defensible?

  1. Scope only systems owned by the clinical department
  2. Scope only the servers that store the primary database
  3. Scope only externally facing internet systems
  4. Scope every system that creates, receives, transmits, or stores regulated health information, including supporting infrastructure Correct answer.

Explanation

Compliance scope follows the data: every component that creates, receives, transmits, or stores regulated information, plus connected supporting infrastructure, must be considered. Narrowing scope by ownership or network exposure risks leaving regulated flows unprotected. The architect should document the data flow to justify the boundary.

Question 40Identify security architecture approach, legal, regulatory, organizational and industry requirements

A regulator requires that security incidents affecting personal data be reported within a fixed number of hours. Which architectural capability most directly supports meeting that obligation?

  1. A monthly patch cycle for all servers
  2. Annual security awareness training for all staff
  3. A documented incident response plan with automated detection, triage, and notification workflows Correct answer.
  4. A configuration management database listing all assets

Explanation

Meeting a short regulatory notification window depends on detecting, triaging, and escalating incidents quickly, which requires an exercised response plan with automated workflows. Patching, training, and asset inventory support security generally but do not by themselves deliver timely notification. The architect should design the detection-to-notification path end to end.

Question 41Identify security architecture approach, legal, regulatory, organizational and industry requirements

Which statement best describes how an architect should treat a conflict between a contractual security obligation and an internal convenience standard?

  1. Follow the internal standard because it was written by the security team
  2. Ignore both and rely on the vendor's default configuration
  3. Escalate to legal and business owners, then design to the stricter binding obligation unless a formal exception is approved Correct answer.
  4. Defer the decision until the next annual audit

Explanation

Contractual obligations are binding, so the architecture must satisfy the stricter requirement unless a formal, documented exception is granted. Internal standards do not override executed agreements. Escalation ensures legal and business owners accept any residual risk explicitly.

Question 42Identify security architecture approach, legal, regulatory, organizational and industry requirements

An architect is selecting controls to satisfy a regulatory requirement for protecting data in transit across public networks. Which control set most directly addresses the requirement?

  1. Full-disk encryption on employee laptops
  2. Role-based access control on the reporting database
  3. TLS with strong cipher suites and certificate validation for all external data flows Correct answer.
  4. Offline backups stored in a secure facility

Explanation

Protecting data in transit requires cryptographic protection of the communication channel, such as TLS with strong ciphers and validated certificates. Disk encryption, access control, and offline backups protect data at rest or govern access and do not secure the transmission path. The architect should map the control to the transit requirement explicitly.

Question 43Identify security architecture approach, legal, regulatory, organizational and industry requirements

A financial services firm must retain transaction records for a statutory period and also honor customer deletion requests where the law permits. Which design best balances these obligations?

  1. Retain all records indefinitely to avoid any risk of premature deletion
  2. Store all records in a single unclassified archive with open access
  3. Classify records by legal retention obligation and apply deletion only to data outside mandated retention scope Correct answer.
  4. Delete all customer data immediately upon request in every system

Explanation

The architect must reconcile deletion rights with statutory retention by classifying records and applying each rule to the correct data category. Blanket deletion violates retention law, and indefinite retention violates deletion and minimization obligations. Classification makes both obligations auditable.

Question 44Identify security architecture approach, legal, regulatory, organizational and industry requirements

Which document most clearly establishes the security architect's authority to require compensating controls when a business unit requests an exception to a mandated control?

  1. The enterprise security policy and exception management process approved by executive management Correct answer.
  2. A vendor's product datasheet describing built-in security features
  3. The project risk register maintained by the delivery team
  4. A team charter for the network operations group

Explanation

Authority to require compensating controls derives from approved policy and a formal exception process endorsed by executive management. Product datasheets, project risk registers, and team charters describe context but do not grant governance authority. The architect should cite the policy basis when imposing conditions.

Question 45Identify security architecture approach, legal, regulatory, organizational and industry requirements

An architect learns that a new privacy regulation requires purpose limitation for personal data. Which architecture change best demonstrates compliance?

  1. Tagging data with its collection purpose and enforcing purpose-based access in downstream systems Correct answer.
  2. Increasing the password length requirement for all users
  3. Enabling verbose debug logging on all application servers
  4. Adding a web application firewall in front of the customer portal

Explanation

Purpose limitation requires that personal data be used only for the purpose for which it was collected, which is enforced through purpose metadata and access decisions. A web application firewall, password policy, and verbose logging do not constrain the use of data to an approved purpose. Metadata-driven enforcement makes the limitation auditable.

Question 46Identify security architecture approach, legal, regulatory, organizational and industry requirements

Which consideration is most important when an architect designs logging for systems in scope of a regulation that restricts the recording of certain personal data?

  1. Ensuring logs exclude or mask regulated data elements while retaining security-relevant events Correct answer.
  2. Storing logs only on the endpoint that generated them
  3. Disabling log retention to avoid privacy exposure
  4. Maximizing log verbosity to capture every field for forensic value

Explanation

Logs must remain useful for security monitoring while avoiding the capture of regulated personal data, so masking or excluding sensitive fields is the appropriate design. Maximum verbosity can create a new privacy exposure, and disabling retention destroys the audit trail. Endpoint-only storage also weakens integrity and availability of evidence.

Question 47Identify security architecture approach, legal, regulatory, organizational and industry requirements

A security architect is asked to justify a control that is required by regulation but has no obvious business benefit. What is the most appropriate rationale?

  1. The control reduces the organization's legal and regulatory risk exposure and avoids penalties Correct answer.
  2. The control eliminates the need for user authentication
  3. The control improves application performance under peak load
  4. The control reduces cloud hosting costs

Explanation

A mandated control is justified by reducing legal and regulatory risk, including penalties and enforcement action, even when direct business benefit is unclear. Performance, authentication, and cost outcomes are unrelated or incorrect claims. Framing the rationale in risk terms supports informed executive decisions.

Question 48Identify security architecture approach, legal, regulatory, organizational and industry requirements

An organization operates in multiple jurisdictions with differing breach notification timelines. Which architecture approach best supports consistent compliance?

  1. Maintaining a jurisdictional ruleset that drives notification decisions based on data type and affected population Correct answer.
  2. Applying the longest notification timeline uniformly to all jurisdictions
  3. Notifying only the primary regulator regardless of where affected individuals reside
  4. Waiting for a confirmed data breach before designing any notification process

Explanation

Differing timelines require a ruleset that evaluates the data involved and the residency of affected individuals to determine which obligations apply. Applying the longest timeline uniformly may miss stricter deadlines, and notifying a single regulator ignores other jurisdictions. The process must exist before an incident occurs.

Question 49Identify security architecture approach, legal, regulatory, organizational and industry requirements

Which element is essential in a data flow diagram used to support a regulatory compliance assessment?

  1. The classification of data, its movement between systems, and the trust boundaries it crosses Correct answer.
  2. The names of all administrators with root access
  3. The licensing tier of each installed application
  4. The physical rack location of every server

Explanation

Compliance assessment depends on knowing what data is involved, where it moves, and where trust boundaries are crossed, because obligations attach to data and its handling. Rack locations, administrator names, and license tiers are operational details that do not establish regulatory scope. The diagram should make regulated flows visible.

Question 50Identify security architecture approach, legal, regulatory, organizational and industry requirements

A security architect must ensure third-party service providers meet the organization's regulatory obligations. Which contract and architecture combination is most effective?

  1. A verbal assurance from the provider's sales representative
  2. Transferring all regulatory responsibility to the provider without oversight
  3. Contractual security and audit clauses paired with technical controls that limit the data shared and verify provider compliance Correct answer.
  4. Relying on the provider's public marketing claims about security

Explanation

Third-party compliance requires enforceable contractual obligations plus technical limits on data sharing and ongoing verification of the provider's controls. Verbal assurances and marketing claims are unverifiable, and regulatory responsibility generally cannot be fully transferred away. The architect should design both the contract terms and the monitoring mechanism.