Security+ Security Architecture: 349 practice questions

12 of the 349 Security Architecture questions in the Certsqill Security+ bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Security+? Take the free 5-min readiness check →

1. Configure role-based access with multifactor: Which control should the firm implement?

1. Deploy a customer-managed hypervisor around the SaaS application.

   SaaS customers do not normally control the provider's application hosting hypervisor or underlying virtualization layer.
2. Configure role-based access with multifactor authentication for firm users. ✓

   Customer-configured identity and authorization controls directly restrict SaaS project-file access by authorized business roles.
3. Require the provider to patch its physical database servers weekly.

   The provider owns and operates the SaaS infrastructure, including server patching and maintenance activities.
4. Build a separate network perimeter around the provider's application.

   A customer cannot usually place a traditional network perimeter around a provider-operated SaaS application.

In SaaS, the customer still manages user identities and data access, even though the provider manages the application platform.

2. Federate cloud authentication through the nonprofit’s: Which control should be implemented next?

1. Federate cloud authentication through the nonprofit’s identity provider. ✓

   Federation lets cloud services rely on the nonprofit’s managed identity boundary and its established authentication policy.
2. Place the cloud applications behind an internal network firewall.

   A firewall can restrict traffic but cannot unify authentication policies or prevent unmanaged cloud accounts.
3. Replicate each local password into every cloud application database.

   Password replication increases exposure and still lacks centralized policy enforcement and modern federation benefits.
4. Use a separate cloud password vault.

   A vault may protect stored secrets but does not connect cloud authentication to the approved identity policy.

Federation connects cloud authentication to the existing identity provider and reduces unmanaged parallel credentials.

3. Complete a supplier assessment and put security duties: Which control should occur before integration?

1. Complete a supplier assessment and put security duties in the contract. ✓

   Due diligence and contractual requirements establish expectations for data handling, availability, incident reporting, and other supplier responsibilities before integration.
2. Migrate the scheduling application to larger infrastructure before connection.

   Additional capacity does not evaluate supplier trust, data handling, contractual duties, or dependency risk.
3. Require provider endpoint protection and quarterly evidence before connection.

   Endpoint protection may be relevant, but this narrow measure does not replace a broader supplier assessment and contractual requirements.
4. Defer the connection until business approval is renewed.

   The business need is already approved; delaying it without assessing the supplier does not address the missing security governance.

Assess the supplier and establish contractual security requirements before creating the dependency.

4. Require peer review and automated policy checks before IaC: Which control best prevents the same mistake from

1. Disable infrastructure as code and build every server manually.

   Manual construction removes repeatability and increases configuration drift without addressing the underlying review weakness.
2. Allow administrators to edit each environment independently after deployment.

   Manual divergence reduces consistency and makes repeated configuration errors harder to detect and control.
3. Increase production server memory before the next deployment.

   Additional memory affects capacity and does not identify or prevent repeated insecure infrastructure settings.
4. Require peer review and automated policy checks before IaC deployment. ✓

   Review and automated validation detect insecure configurations before approved code is applied broadly.

Predeployment review and policy validation stop a flawed template from propagating across many environments.

5. Run the untrusted workload in a separate virtual machine: Which design is most appropriate?

1. Increase the container registry retention period.

   Image retention supports recovery or version management but does not isolate running workloads from each other.
2. Run the untrusted workload in a separate virtual machine. ✓

   A VM normally provides a stronger isolation boundary because workloads do not directly share the host kernel.
3. Place both workloads in the same container image.

   Combining workloads increases coupling and does not strengthen isolation between untrusted and claims-processing functions.
4. Add more containers to the existing host without changing placement.

   Additional containers still share the same host kernel and do not address the requested stronger boundary.

Containers share a host kernel; placing the higher-risk workload in a separate VM creates a stronger isolation boundary.

6. Place each service in a separate virtual machine: Which architectural change most directly strengthens their s

1. Store the workloads on separate virtual disks and restrict access.

   Separate virtual disks can protect storage access, but they do not provide independent execution boundaries equivalent to separate VMs.
2. Place each service in a separate virtual machine. ✓

   Separate virtual machines provide distinct guest execution boundaries between the public and internal workloads.
3. Place both services behind separate application roles.

   Application roles improve authorization but do not create a stronger workload or operating-system boundary.
4. Assign additional CPU capacity to the enrollment service.

   Resource allocation can improve performance but does not establish a security boundary between the services.

Separate virtual machines create a stronger execution boundary between the public and internal services.

7. Enforce firewall policy between network segments: Which control directly meets the objective?

1. Enforce firewall policy between network segments. ✓

   Inter-segment firewall rules restrict permitted paths and directly limit unauthorized movement toward payment systems.
2. Place all systems on a single VLAN.

   A shared VLAN reduces administrative complexity but does not create meaningful separation between application tiers.
3. Create a physically separate payment network.

   Physical separation can isolate systems, but it may unnecessarily prevent approved application communication and increase operational complexity.
4. Encrypt traffic between every application component.

   Encryption protects data in transit but does not prevent an authorized or compromised host from reaching payment services.

Firewall-enforced segmentation directly restricts traffic between tiers while allowing specifically approved application flows.

8. Enforce corporate standards locally and forward buffered: Which control best supports this decentralized opera

1. Connect all sites through one flat network.

   A flat network may simplify connectivity but increases lateral movement risk and does not provide policy governance.
2. Require every decision to use headquarters.

   Headquarters-only decisions create operational dependence on connectivity and can delay necessary site work.
3. Enforce corporate standards locally and forward buffered audit reports centrally. ✓

   Local enforcement continues during connectivity loss, corporate minimum standards constrain site decisions, and buffered reports provide central visibility when connections return.
4. Allow each site unrestricted policy autonomy.

   Complete autonomy supports independence but eliminates consistent safeguards and makes enterprise oversight difficult.

Local enforcement supports disconnected work, while corporate standards preserve consistent baseline protection.

9. Deploy passive network monitoring: Which control should be implemented first?

1. Place an inline prevention device.

   Inline prevention can introduce latency, packet handling changes, or a failure point into safety-sensitive communications.
2. Run authenticated vulnerability scans.

   Authenticated scans can consume resources or alter fragile devices, making them unsuitable as the first industrial control.
3. Deploy passive network monitoring. ✓

   Passive sensors observe industrial traffic without inserting packets or changing controller behavior, preserving operational availability.
4. Patch controllers during production.

   Production patching may require restarts or testing and can disrupt equipment timing and safe operation.

Passive monitoring provides visibility without inserting traffic or disrupting safety-critical controller communications.

10. Use gateway filtering: Which approach is most appropriate?

1. Deploy a general-purpose endpoint agent.

   A general-purpose agent may introduce variable CPU, memory, and scheduling overhead that conflicts with deterministic timing.
2. Encrypt every local process exchange continuously.

   Encryption may protect confidentiality, but repeated processing can add timing overhead and does not directly provide suitable endpoint protection.
3. Use gateway filtering. ✓

   A separate gateway can enforce communication controls without adding unpredictable endpoint workload to the real-time process.
4. Run scheduled full-device scans during production.

   Full scans consume resources and can create timing interruptions that are unacceptable for robotic control.

Gateway enforcement protects communications while avoiding unpredictable endpoint workload in the RTOS.

11. Isolate and allow required traffic through a monitored: Which compensating control most directly reduces expos

1. Disable all device communications until patches arrive.

   Total isolation may reduce exposure but prevents required safety reporting and does not satisfy the operational requirement.
2. Isolate and allow required traffic through a monitored gateway. ✓

   Isolation, allowlisting, and gateway monitoring reduce reachable attack paths while preserving required safety reporting.
3. Enable automatic patch installation on the devices.

   Automation cannot provide a vendor patch that is unavailable and may introduce untested operational changes.
4. Perform routine unauthenticated vulnerability scans.

   Scanning may identify weaknesses but does not prevent reachable exploitation or compensate directly for missing patches.

Isolation, allowlisting, and monitored required communications reduce exposure when patching is unavailable.

12. Maintain isolated: Which control should be added to improve recoverability?

1. Deploy geographically separated replication with continuous synchronization and automated failover.

   Geographic replication can improve resilience, but continuous synchronization may spread logical corruption to the remote copy.
2. Add another failover node.

   Another synchronized node may improve availability but can also replicate corrupted records.
3. Increase load-balancer capacity.

   A larger load balancer handles traffic volume but does not preserve recoverable record versions.
4. Maintain isolated, tested backups with restoration procedures. ✓

   Independent, tested backups provide a separate recovery path when corruption replicates through production systems.

Isolated, tested backups provide recovery when failover systems replicate corruption.

Other Security+ domains

• Security Operations — 528 questions →
• Threats, Vulnerabilities, and Mitigations — 425 questions →
• Security Program Management and Oversight — 384 questions →
• General Security Concepts — 232 questions →
• All 1918 Security+ questions →