Security Architecture and Engineering practice questions

Answer: A) A compromised account or process can only cause damage within the narrow set of permissions it was granted

Least privilege gives each account and process only the permissions its task requires. Its main benefit is that any single compromised identity or component can do only limited damage. Separation of duties, authentication and fail-secure design are related but separate principles.

• ACorrect. Least privilege means granting only the permissions a task actually needs. If an identity or component is compromised, the attacker can do only what it was allowed to do, which limits the blast radius.
• BIncorrect. This is the benefit of separation of duties, which splits critical tasks among several people. Least privilege limits how much access each identity has; it does not require more than one person per transaction.
• CIncorrect. This describes authentication. Least privilege is an authorization principle: it decides how much access an identity gets after its identity has been established.
• DIncorrect. This describes fail-secure (fail-safe defaults) design, which controls how a system behaves when it fails. It is not about limiting the permissions given to accounts and processes.

Answer: A) It limits how much data and how much time any single version of the key material covers if that version is compromised

Periodic key rotation limits the cryptoperiod, which caps how much data and time a compromised key version affects. It does not re-encrypt existing data or make older key versions unnecessary.

• ARotation bounds the cryptoperiod. New data is protected with new key material, so exposure from a compromised version is limited to what that version protected. This also avoids the risks of extensive key reuse.
• BRotation changes only the current key material used for new encryption operations. It does not re-encrypt data that is already protected.
• CEarlier key material must be kept so that ciphertext encrypted under it can still be decrypted. AWS KMS, for example, keeps all prior key material and selects the right version automatically.
• DRotating the wrapping key does not rotate data keys it previously generated or encrypted. It does not mitigate a compromised data key.

Answer: A) Fault injection

• AFault injection deliberately induces errors, such as voltage glitches, to bypass security logic.
• BFrequency analysis studies letter patterns in classical ciphers.
• CPass the hash reuses captured password hashes.
• DThat works only from ciphertext, without manipulating hardware.

Answer: A) Mutual TLS, with each service presenting its own X.509 certificate

Mutual TLS has both sides of a connection authenticate with certificates and encrypts the session. That makes it the standard way to secure service-to-service traffic in microservice architectures.

• AMutual TLS requires two-way authentication: both client and server present certificates, and the session is encrypted. This meets both requirements for every call.
• BOne-way TLS encrypts the traffic and authenticates the server, but the calling service never proves its identity with a certificate. The mutual authentication requirement is not met.
• CAPI keys give some identification of the caller, but over plain HTTP the keys and data travel unencrypted and can be intercepted. The receiving service is also never authenticated to the caller.
• DACLs limit which network locations can communicate, but they don't verify service identity cryptographically and they don't encrypt anything.

Answer: A) Badge-controlled locks that admit only authorized network staff, with access logs reviewed regularly

Wiring closets give direct access to network infrastructure, so the main physical control is restricted entry with logs that are reviewed. CCTV, fire suppression and port disabling complement it but don't prevent physical tampering.

• ACorrect. Limiting entry to approved staff stops unauthorized people from reaching the equipment, and reviewed access logs record who entered and when. This is the same approach used to protect server rooms: least-privilege physical access that is logged and reviewed.
• BIncorrect. CCTV is a useful detective control, but it doesn't keep anyone out of an unlocked closet. It also only gives a recording to look at after tampering has happened.
• CIncorrect. Fire suppression protects equipment from environmental damage and supports availability. It does nothing to stop people from tampering with switches or patch panels.
• DIncorrect. Disabling unused ports is a good logical hardening step, but it isn't a physical control. Anyone who can get into the closet can still re-patch cables, reach console ports or remove devices.

Answer: A) The Bell-LaPadula model

• ABell-LaPadula is a confidentiality-focused model where a subject cannot read data at a higher classification (no read up) or write data down to a lower classification (no write down).
• BBiba focuses on integrity ('no write up, no read down'), the inverse concern from Bell-LaPadula's confidentiality focus.
• CClark-Wilson focuses on integrity through well-formed transactions and separation of duties, not primarily confidentiality classification levels.
• DBrewer-Nash (Chinese Wall) prevents conflicts of interest by dynamically restricting access based on prior access, a different concern.

Answer: A) Identifying the trust boundaries between components controlled by different parties

In a system that spans several sites and organizations, defining trust boundaries shows where control changes hands, and therefore where authentication, authorization and input validation are required. Encryption, hardening and logging are useful but do not answer that question.

• ACorrect. Trust boundaries mark where control changes from one entity to another, such as between sites or between your organization and a partner. Data and requests that cross a boundary are where spoofing, tampering and elevation of privilege are possible, so that is where authentication, authorization and validation must be applied.
• BIncorrect. TLS protects data in transit, but it does not show which components should trust which. Data received from a partner over TLS can still be malicious and must be authenticated and validated at the boundary.
• CIncorrect. Consistent hardening reduces host vulnerabilities, but it does not identify where control passes between parties. It therefore cannot tell the architect where to enforce access checks and input validation.
• DIncorrect. Centralized logging supports detection and accountability after the fact. It does not determine where preventive checks such as authentication and validation must be placed.

Answer: A) Fenced, lit and camera-monitored perimeter; guarded lobby; badge-plus-biometric mantrap to the server floor; role-based cage access; clean-agent suppression with smoke and leak sensors

Defense in depth for a data center means concentric physical layers (perimeter, building, server floor, rack) with stronger and least-privilege controls toward the core, combined with suitable environmental protection such as clean-agent suppression and leak and smoke detection.

• AThis design applies controls in concentric layers (site, building, floor, rack), enforces least privilege inside the building, prevents tailgating at the sensitive entry, and protects equipment from fire and water.
• BA strong control at a single point does not provide depth: there are no outer layers to deter or delay intruders, and wet-pipe sprinklers over energized equipment are a poor choice for a server room.
• CThe outer layer is strong, but there is no interior zoning or least-privilege access, so anyone who passes the gate can reach the servers, and nothing suppresses a detected fire.
• DCPTED is a useful outer layer, but a keyed lock offers weak, unaudited access control, and portable extinguishers alone are not adequate data center fire protection.

Answer: A) PP: security requirements for a class of products; ST: the scope and security claims for the specific product evaluated; EAL: how rigorously those claims were evaluated

Under the Common Criteria, a Protection Profile defines requirements for a product category, a Security Target describes what the specific product claims and was evaluated for, and the EAL reflects evaluation rigor and assurance rather than security strength.

• ACorrect. A PP is a reusable requirements set for a product category, such as general-purpose operating systems. The ST describes the specific product's editions in scope, its security functionality, and the assurance measures used. The EAL expresses evaluation assurance (depth and rigor), not how strong or feature-rich the product's security is.
• BIncorrect. This swaps the PP and ST. Products are certified against a Protection Profile that defines requirements for a product category, and the Security Target is the product-specific document describing what was evaluated.
• CIncorrect. The PP and ST are described correctly, but the EAL measures confidence that the claims were properly evaluated, not the strength of the security functions. A product with a higher EAL doesn't necessarily have stronger or more numerous security features.
• DIncorrect. Configuration guidance is in the Administrative Guide, and evaluation results are in the Certification or Validation Report. The EAL isn't a vulnerability count; it shows the level of assurance of the evaluation.

Answer: A) Replace the early-exit check with a comparison whose run time depends only on the tag's length

Measuring response time to recover a secret byte by byte is a timing side-channel attack. The direct fix is a constant-time (fixed-time) comparison, so execution time does not depend on secret data.

• ACorrect. This is a timing side-channel attack: the attacker exploits leakage from the implementation, not a weakness in the HMAC algorithm. A fixed-time comparison takes the same time whatever the byte values are, which removes the signal the attacker is measuring. .NET provides CryptographicOperations.FixedTimeEquals for exactly this purpose.
• BIncorrect. A longer tag means the attacker has to recover more bytes, but each byte still leaks through timing. The leak is in the comparison code, not in the strength of the hash.
• CIncorrect. Nonces and timestamps stop replay attacks. Here the attacker is not replaying captured messages. They are submitting new forgeries and timing the responses.
• DIncorrect. TLS protects confidentiality in transit, but the attacker is a legitimate client of the endpoint and can still measure how long each response takes. Encryption does not remove the timing difference.