Security Architect

Sample question 1

Ferrow Retail deployed a new API gateway architecture six months ago specifically to stop credential stuffing attacks against its customer login endpoint, combining device fingerprinting, rate limiting, and risk based step up MFA challenges. The VP of Engineering wants to know whether the design is actually working before committing budget to expand it elsewhere. As security architect, which approach best determines the design's effectiveness?

1. A.Confirm that the gateway configuration in production matches the original design document, verifying that device fingerprinting, rate limiting, and step up MFA are all enabled exactly as specified in the design.
2. B.Review login telemetry for blocked and attempted credential stuffing activity and account takeover rates before and after deployment, and run a controlled adversarial test replicating known stuffing techniques against the gateway.
3. C.Survey the engineering team that built the gateway about their confidence that it prevents credential stuffing, since they implemented the controls and understand the threat model best.
4. D.Compare Ferrow's deployed control set against a vendor's published checklist of recommended anti credential stuffing features to confirm every listed capability is present in the deployment.

Sample question 2

Vantage Payments is designing a new instant-payouts feature involving five internal microservices, an external card processor, and two internal data stores holding cardholder data. The design document submitted for architecture review is twelve pages of prose describing each service's responsibilities, with no diagrams. During review, two reviewers already disagree about which service is responsible for encrypting cardholder data in transit between two of the internal services, and even about whether that particular traffic crosses a trust boundary at all. The security architect must decide what to require before the design proceeds to build. Which requirement reflects correct application of design modeling knowledge?

1. A.Accept the design document as submitted, since the two reviewers who disagree about encryption responsibility and boundary crossing can settle both questions by comparing the responsibility statements already written for each of the two services in the twelve pages of prose, without needing any diagram to be produced
2. B.Require the team to produce a UML sequence diagram tracing the exact order of calls between the two disputed services, since whichever service is shown issuing the encryption call in that sequence is thereby established as the service responsible for protecting the data at that boundary
3. C.Require the team to produce a data flow diagram showing every data store and every service-to-service and external flow, with trust boundaries marked, since a boundary crossing is a property of the data flow itself, and marking it shows which service must protect the data there regardless of call order
4. D.Require the team to produce a network topology diagram showing which subnet each service sits in, since any two services placed in different subnets are thereby shown to cross a trust boundary, which settles both whether a boundary exists and which side carries protection responsibility

Sample question 3

Fairview Regional Hospital's clinical file-sharing platform lets whoever uploads a patient record decide who else can view or edit it. Frontline clinicians, trying to keep care teams moving quickly, routinely add 'entire department' as a viewer on charts containing protected health information, so a chart meant for a five-person care team ends up visible to forty clinicians with no role in that patient's care. Care-team membership changes shift to shift as patients are handed off, and hospital leadership will not create a role whose sole job is manually classifying and re-classifying every chart's sensitivity level as those handoffs happen. A security architect is asked to recommend an access control model that removes each uploader's ability to individually decide how broadly a chart is shared, while still giving legitimate care-team members the access they need without manual per-chart classification. Which model should the architect recommend?

1. A.A mandatory model in which the specific patient's chart inherits a fixed sensitivity tier and every clinician holds a standing clearance tier set at hire, so the platform grants access automatically whenever a clinician's clearance tier meets or exceeds that chart's tier.
2. B.An attribute-based model in which access to the specific patient's chart is granted automatically to any clinician whose current care unit and shift match the care unit and shift recorded on that chart, with no upload-time decision by any individual.
3. C.A role-based model in which access follows each clinician's care-team role for the specific patient, such as attending physician or care-team nurse, with role assignments driven automatically by the care-team handoff records clinicians already log at every shift change, so the chart is visible to whoever currently holds that patient's care-team role and to no one else.
4. D.A model in which each patient has a standing care-team access group that a designated unit coordinator curates by hand as a separate administrative task, adding and removing individual clinicians as staff rotate on and off the patient's care across successive shifts.