Examkin

Security Architecture

405 questions

All types405Multiple choice207Multiple select87Matching93Ordering18
Question 401Question →

An enterprise financial services organization is redesigning its hybrid cloud infrastructure to transition from a legacy perimeter security model to a Zero Trust Architecture (ZTA). The security architecture team must define mandatory implementation standards that adhere strictly to NIST SP 800-207 Zero Trust tenets. Which of the following architectural requirements must be enforced to align with Zero Trust principles? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Decouple Policy Decision Point (PDP) logic from Policy Enforcement Points (PEPs) to evaluate continuous contextual telemetry before granting resource access.; Enforce explicit per-session authorization and microsegmentation for all resource requests, treating internal network traffic with the same baseline distrust as external traffic.

Answer

The correct architectural requirements are decoupling the Policy Decision Point from Policy Enforcement Points to evaluate dynamic contextual telemetry, and enforcing explicit per-session authorization with microsegmentation across all network traffic.
Zero Trust Architecture relies on continuous verification and explicit authorization for every resource request regardless of network position. Decoupling the Policy Decision Point (PDP) from Policy Enforcement Points (PEPs) ensures central, dynamic policy decisions driven by continuous telemetry, while microsegmentation and per-session validation enforce granular control across all enterprise environments.

Step-by-Step Solution

1
Analyze core Zero Trust Architecture principles
Identified tenets including assumed breach, explicit verification, continuous authentication, dynamic policy evaluation, and microsegmentation.
Zero Trust rejects implicit trust based on network position or single point-in-time authentication.
2
Evaluate control plane architectural components
Confirmed that the Policy Decision Point must dynamically process endpoint telemetry and enterprise policy, instructing Policy Enforcement Points to grant or restrict granular resource access.
Separating policy decision logic from policy enforcement enables adaptive access management.
3
Differentiate Zero Trust controls from legacy perimeter assumptions
Disqualified options that assume internal network safety or treat initial authentication as permanent authorization for a session.
Initial VPN authentication or perimeter location cannot confer implicit trust in a Zero Trust model.

Key Concept

Zero Trust Architecture Principles and Component Roles (PDP/PEP)
Question 402Question →

An autonomous vehicle research firm stores large volumes of sensor telemetry and machine learning datasets on distributed block storage arrays. The security team needs to protect data at rest against physical drive theft from the data center while minimizing processor performance impact on host hypervisors. Which of the following storage security controls best satisfies this requirement?

Show answer & explanation

Answer: Implementing Self-Encrypting Drives (SEDs) with dedicated cryptographic hardware built into the disk controllers

Answer

Implementing Self-Encrypting Drives (SEDs) with dedicated cryptographic hardware built into the disk controllers
Implementing Self-Encrypting Drives (SEDs) provides hardware-assisted encryption directly on the drive controller. This ensures that all data written to the drive is encrypted at rest using symmetric ciphers without introducing computational overhead on the host hypervisors.

Step-by-Step Solution

1
Analyze the technical requirements in the scenario.
Identified two key criteria: protecting data at rest against physical drive theft, and avoiding host hypervisor CPU performance penalties.
Storage security architectures must balance security guarantees with system throughput and host overhead.
2
Evaluate hardware offload vs software encryption solutions.
Hardware-based encryption integrated into storage drive controllers (SEDs) offloads cryptographic operations completely from the host CPU.
SEDs encrypt data seamlessly at media line rate using onboard hardware keys.
3
Select the appropriate storage control.
SED deployment fulfills both data-at-rest protection and zero host CPU performance degradation requirements.
Disks automatically decrypt content upon authorized drive controller power-up, securing stolen media when powered off.

Key Concept

Data at Rest Encryption and Self-Encrypting Drives (SED)
Question 403Question →

Match each Identity and Access Management (IAM) architectural protocol component to its corresponding enterprise security implementation requirement.

Click a left item, then click its matching right item

Items

OAuth 2.0 Mutual-TLS (mTLS) Client Authentication
OpenID Connect (OIDC) Back-Channel Logout
SAML 2.0 Artifact Resolution Profile
SCIM 2.0 Bulk Endpoint

Matches

Show answer & explanation

Answer

OAuth 2.0 Mutual-TLS Client Authentication pairs with cryptographically binding access tokens to X.509 client certificates. OpenID Connect Back-Channel Logout pairs with direct server-to-server HTTP notifications to invalidate sessions out-of-band. SAML 2.0 Artifact Resolution Profile pairs with passing a reference string through the browser to fetch full assertions back-channel. SCIM 2.0 Bulk Endpoint pairs with batching identity provisioning operations into a single HTTP payload.
Each IAM protocol mechanism strictly aligns with its enterprise architecture role: mTLS client authentication provides cryptographic token binding for sender constraint; OIDC Back-Channel Logout handles reliable out-of-band federated session termination; SAML 2.0 Artifact Resolution avoids passing full XML assertions through user browsers; and SCIM 2.0 Bulk Endpoint reduces HTTP request overhead during identity provisioning.

Step-by-Step Solution

1
Analyze token binding and client authentication requirements
OAuth 2.0 mTLS Client Authentication (RFC 8705) uses X.509 certificate matching during TLS handshakes to ensure sender-constrained access token validation.
Prevents token replay across microservices in zero trust IAM architectures.
2
Evaluate federated session lifecycle and logout mechanisms
OIDC Back-Channel Logout delivers direct server-to-server HTTP POST requests containing a Logout Token from the IdP to the RP.
Bypasses browser restrictions (such as third-party cookie blocking) to reliably invalidate relying party sessions.
3
Examine federated assertion transport security profiles
SAML 2.0 Artifact Resolution Profile sends a 44-byte SAML artifact through the user agent, prompting the Service Provider to resolve the actual SAML Assertion over an out-of-band back-channel TLS connection.
Protects sensitive identity attributes from interception, referrer leaks, or URL length constraints in the front channel.
4
Identify automated provisioning scalability patterns
SCIM 2.0 specifies the /Bulk endpoint to aggregate multiple HTTP POST, PUT, PATCH, and DELETE identity operations into a single request payload.
Reduces network latency and API traffic during mass identity lifecycle updates across cloud platforms.

Key Concept

Enterprise IAM Architecture and Federated Identity Protocols
Estimated Time:2m 0s
Question 404Question →

A security engineer is documenting the automated failover process for an active-passive cluster of perimeter firewalls. When the primary node experiences an unrecoverable hardware failure, specific high-availability failover events must occur. Place the following operational steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order is: 1) The standby firewall node detects consecutive missed heartbeat signals from the primary firewall node, 2) The standby firewall node transitions its internal cluster state from passive to active, 3) The newly active node broadcasts Gratuitous ARP (GARP) requests across the local network segment, and 4) The newly active node begins receiving, inspecting, and forwarding stateful network traffic.
In high-availability active-passive clustering, failover begins when the passive node notices consecutive missing heartbeats from the primary. The passive node promotes itself to active status, then broadcasts Gratuitous ARP (GARP) packets to update surrounding switch MAC address tables with its interface details for the virtual IP, and finally starts processing network traffic.

Step-by-Step Solution

1
Identify the initial failover trigger in an active-passive cluster.
The failure detection phase is triggered when heartbeat health checks fail.
The passive node cannot take action until it detects that the primary node is unreachable.
2
Determine the operational state transition of the surviving node.
The passive node promotes itself to the active state.
Role promotion is required before the standby hardware can assume cluster ownership.
3
Identify how network traffic is redirected to the new hardware instance.
The newly active node issues Gratuitous ARP (GARP) broadcasts.
GARP updates neighbor switch forwarding tables so traffic addressed to the virtual IP maps to the new node's physical MAC address.
4
Determine when stateful security enforcement resumes.
Active session processing and packet filtering resume on the new active node.
Traffic flow can only resume after surrounding network infrastructure switches learn the updated Layer 2 destination path.

Key Concept

Active-Passive Cluster Failover Sequence
Question 405Question →

An organization is migrating its enterprise authentication framework to a modern cloud Identity Provider (IdP) supporting OpenID Connect (OIDC). However, several legacy internal web applications only support HTTP header-based authentication and cannot natively process OIDC tokens. Which of the following architectural components should be deployed between the legacy applications and the cloud IdP to translate federated identity assertions into secure local application headers?

Show answer & explanation

Answer: An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applications

Answer

An Identity-Aware Proxy (IAP) acting as a reverse proxy to authenticate requests via the cloud IdP and inject validated identity headers to the target applications
An Identity-Aware Proxy (IAP) acts as an intermediary reverse proxy. It intercepts user web traffic, redirects unauthenticated requests to the cloud IdP for OIDC authentication, and upon successful authentication, attaches verified identity attributes as secure HTTP headers before forwarding requests to legacy target applications.

Step-by-Step Solution

1
Analyze the architectural gap between modern authentication protocols and legacy application capabilities.
Identified that the cloud IdP issues OIDC tokens while legacy applications require HTTP header injection.
Legacy applications cannot be modified directly to parse federated JSON Web Tokens (JWTs).
2
Evaluate access control proxy components capable of token translation and session mediation.
An Identity-Aware Proxy (IAP) intercepts incoming application traffic, authenticates via the cloud IdP, and injects validated identity header values.
IAPs function as application-level reverse proxies designed specifically to bridge modern IdP identity assertions with legacy web applications.

Key Concept

Identity-Aware Proxy (IAP) and legacy application integration in IAM architecture
PreviousPage 21 / 21
Security Architecture Practice Questions — CompTIA Security+ — Page 21 | Examkin