CISSP Security Architecture and Engineering: 156 practice questions

12 of the 156 Security Architecture and Engineering questions in the Certsqill CISSP bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CISSP? Take the free 5-min readiness check →

1. Place the second room in a separate utility and network: Which control most directly addresses the demonstrate

1. Increase backup frequency for both computing rooms.

   More frequent backups improve recovery points but do not maintain operation during simultaneous facility loss.
2. Install additional disk replicas inside both existing rooms.

   Local replicas preserve data availability only if the shared facilities remain accessible during failure.
3. Purchase a larger uninterruptible power supply for each room.

   Larger UPS units bridge interruptions but cannot sustain a failed shared substation indefinitely.
4. Place the second room in a separate utility and network region. ✓

   Geographic and infrastructure separation reduces the demonstrated shared-substation and shared-network failure domain.

Separate utility and network regions remove the shared failure dependency that interrupted both rooms.

2. Document the conflict: Which action best resolves the conflict before procurement?

1. Choose local control and defer patching until deployment, when operational conditions are clearer.

   Deferring a known requirement leaves the conflict unresolved and may create avoidable exposure.
2. Document the conflict, obtain risk-owner decisions, and define verifiable compensating requirements. ✓

   Accountable resolution can balance patching, continuity, safety, operating conditions, and verification before procurement.
3. Choose remote patching because centralized administration generally appears more secure.

   A general security preference does not override legitimate operational and safety constraints.
4. Require both capabilities without documenting precedence, operating conditions, controls, or acceptance evidence.

   Unqualified requirements do not explain how the conflicting capabilities will work or be verified.

Use accountable owners, explicit conditions, compensating controls, and verification criteria.

3. Use an authenticated-encryption mode with managed: Which control best satisfies the stated requirements?

1. Use an authenticated-encryption mode with managed symmetric keys. ✓

   Authenticated encryption efficiently combines confidentiality and integrity protection for high-volume symmetric data processing.
2. Use recipient public-key encryption for every tenant record.

   Asymmetric encryption can provide confidentiality but is inefficient and does not inherently authenticate ciphertext changes.
3. Use digital signatures alone for each encrypted tenant record.

   Digital signatures provide integrity and authenticity but do not provide confidentiality without encryption.
4. Use a cryptographic hash beside the existing encryption mode.

   A standalone hash lacks key-based authenticity unless protected and correctly integrated with encryption.

Authenticated encryption combines efficient confidentiality and integrity for high-volume symmetric data.

4. Check current authorization before every protected: Which design change best applies complete mediation?

1. Check current authorization before every protected retrieval. ✓

   Complete mediation requires each protected retrieval, including a cached response, to receive a current authorization decision.
2. Increase the session timeout so authorization decisions expire more frequently.

   Session expiration timing does not ensure authorization is checked for every protected request.
3. Require multifactor authentication again whenever the record is requested.

   Reauthentication strengthens identity assurance but does not itself evaluate current authorization to the record.
4. Encrypt the cached record so unauthorized sessions cannot read its contents.

   Encryption does not enforce changed authorization if the session retains access to the decryption capability.

Evaluate current authorization for every protected retrieval, including cached responses.

5. Use the generator after the UPS bridges the interruption: Which option best addresses the stated continuity co

1. Use the generator after the UPS bridges the interruption. ✓

   The UPS covers short transfer gaps, while a maintained generator supports operation through longer outages.
2. Replace the generator with a larger UPS bank.

   A larger battery bank remains limited by stored energy and does not match multi-hour outage duration.
3. Perform a restoration test after each electrical interruption.

   Restoration testing validates recoverability but cannot prevent an outage from stopping the cluster.
4. Add more replicated storage to the rendering cluster.

   Storage replication does not supply electrical power or keep systems running during facility outages.

The UPS bridges transfer time; a maintained generator provides the required multi-hour autonomy.

6. Add TPM-based measured boot with attestation reporting: Which control most directly addresses this demonstrate

1. Disable secure boot to permit more recovery software.

   Disabling secure boot removes rejection of unauthorized boot components and worsens the demonstrated integrity risk.
2. Install full-disk encryption without changing boot measurements.

   Full-disk encryption protects offline media but does not establish which approved software or configuration started.
3. Add TPM-based measured boot with attestation reporting. ✓

   Measured boot records startup measurements, while attestation lets the center evaluate reported platform state remotely.
4. Require longer passwords before allowing laptop startup.

   Password strength protects authentication but does not measure boot state or detect altered approved configuration.

TPM measured boot and attestation provide evidence of startup measurements beyond secure boot’s execution decision.

7. Use constant-time operations independent of secret values: Which improvement most directly reduces the demonst

1. Hash each timing result before storing operational metrics.

   Hashing stored measurements does not prevent observers from seeing execution-time differences during signing.
2. Add a public certificate to the signing service.

   A certificate supports key identity and trust but does not equalize secret-dependent execution timing.
3. Increase the signing key length without changing execution behavior.

   A longer key may affect cryptographic strength but leaves the demonstrated timing dependency unchanged.
4. Use constant-time operations independent of secret values. ✓

   Constant-time behavior removes secret-dependent branches and operation counts that create timing leakage.

Use constant-time execution to reduce secret-dependent timing leakage.

8. Each need maps to a control: Which conclusion best demonstrates requirements traceability?

1. The architecture is secure because it contains three different controls.

   Control count alone does not demonstrate that each protection need has suitable evidence or coverage.
2. The signed audit records prevent unauthorized schedule changes before they occur.

   Audit signatures support attribution and integrity of records, not preventive authorization enforcement.
3. The replicated standby proves schedule integrity because it preserves another copy.

   Replication supports availability but can reproduce unauthorized or corrupted schedule changes.
4. Each need maps to a control, accountable owner, and verifiable acceptance criterion. ✓

   Traceability connects protection needs to responsible controls and evidence demonstrating their intended effectiveness.

Traceability is demonstrated when every protection need maps to accountable controls and verifiable acceptance evidence.

9. Classify submitted claims data and configure permitted: Select TWO actions that remain appropriate customer re

Select two. More than one option is correct — every correct one is ticked below.

1. Replace the provider’s facility access controls with customer-owned guards.

   Physical facility protection remains the provider’s responsibility under the stated service scope.
2. Classify submitted claims data and configure permitted tenant sharing accordingly. ✓

   The customer retains data governance and tenant configuration, including classification and authorized sharing decisions.
3. Rebuild the provider’s application servers using customer-approved operating-system images.

   SaaS customers generally do not manage provider application servers or their operating-system images.
4. Implement customer-controlled multifactor authentication for tenant administrators. ✓

   Customer-controlled identities remain in scope, so administrators require customer-selected authentication and access governance.
5. Require the SaaS provider to patch its hypervisor and physical hosts.

   Those infrastructure components fall within the provider’s contracted operational responsibility, not the customer’s retained scope.

Customer responsibility remains for identities, data, and tenant configuration, despite provider-managed SaaS infrastructure.

10. Read Confidential and write Secret data: Which operation pair is permitted by the stated model?

1. Read Secret and write Confidential data.

   Reading Secret is allowed, but writing Confidential is prohibited because it writes down.
2. Read Confidential and write Secret data. ✓

   A Secret subject may read lower information and write at its level without violating no-read-up or no-write-down.
3. Read Secret and write Public data after administrator approval.

   Administrative approval does not create a trusted-subject exception in the explicitly stated model.
4. Read Secret and write Public data.

   Writing from Secret to Public violates Bell-LaPadula’s simple security property against writing down.

Bell-LaPadula permits reading down and writing up or at the same level; Secret cannot write to lower levels.

11. The records room should be treated as independently: Select TWO inferences justified by this evidence.

Select two. More than one option is correct — every correct one is ticked below.

1. The records room should be treated as independently requiring authorization. ✓

   Separate control boundaries mean lobby access cannot substitute for records-room authorization.
2. Layered zoning limits exposure but does not guarantee prevention of every intrusion. ✓

   Multiple barriers reduce opportunities and exposure, yet the evidence does not establish absolute prevention.
3. The staffed lobby barrier necessarily failed before the visitor entered.

   The evidence says lobby entry was legitimate and does not show that barrier malfunctioned.
4. Successful lobby entry proves records-room authorization was also valid.

   Authorization at one zone does not establish authorization for a separately controlled inner zone.
5. The hospital’s network VLANs provided complete physical isolation between zones.

   VLANs provide logical segmentation and do not establish physical facility isolation.

The evidence supports defense-in-depth and independent inner-zone authorization, not guaranteed prevention or an earlier barrier failure.

12. Verification passed: What best diagnoses the situation?

1. Verification passed, but validation of operational suitability remains incomplete. ✓

   The implementation matches specified requirements, while stakeholder experience indicates the solution may not satisfy actual operational needs.
2. Validation passed because the written allowlist is technically enforced.

   Enforcing written requirements does not demonstrate that the solution serves intended operational use.
3. Verification failed because researchers dislike the approved workflow.

   The available evidence shows implementation conformance, not a failure to build the specified control.
4. The result proves the application needs stronger encryption rather than requirement review.

   The evidence concerns workflow suitability and approved destinations, not confidentiality strength or encryption failure.

Implementation conformance supports verification, while unmet operational needs require validation and possibly approved requirement revision.

Other CISSP domains

• Security and Risk Management — 192 questions →
• Communication and Network Security — 156 questions →
• Identity and Access Management (IAM) — 156 questions →
• Security Operations — 156 questions →
• Security Assessment and Testing — 144 questions →
• All 1200 CISSP questions →
• CISSP certification: requirements, cost and exam format →