01
Choose one
1 point
A booking system must remain accessible so patients can schedule appointments when they need to. Which security objective most directly addresses this need?
Free Practice Quiz Question List
1 Security Architecture Foundations Online Quiz Questions
Use this free practice quiz with 20 questions to review 1 Security Architecture Foundations, test your knowledge, and prepare for your next test or exam.
20 questions
02
True or false
1 point
True or false: A security objective such as protecting customer records is already an implementation instruction that specifies exactly how the system must enforce protection.
- A
True
- B
False
03
Written response
1 point
What term describes the outcomes stakeholders need from a system, such as confidentiality, integrity, or availability?
04
Fill in the blank
1 point
When documenting an important asset, record its as well as its value and sensitivity.
05
Choose one
1 point
Two services run on the same network, but one has more privileges than the other. What should the architecture recognize at their interaction?
- A
Only a physical connection between separate buildings
- B
A point where information is stored permanently
- C
A point where data or control crosses between different trust assumptions
- D
The outer limit of the organization’s network
06
True or false
1 point
True or false: Threat modeling is useful before implementation because it can help identify security concerns while design changes are still less expensive.
- A
True
- B
False
07
Choose one
1 point
A company is protecting customer records. Users must authenticate through an identity service before accessing those records. How should the identity service be treated in the asset analysis?
- A
It is not an asset because it is not customer data.
- B
It is a supporting asset because it is needed to access the customer records.
- C
It is a direct asset only if it stores the customer records itself.
- D
It is outside the analysis unless it is physically located beside the records.
08
Written response
1 point
What term describes the risk that remains after safeguards have been proposed?
09
Fill in the blank
1 point
To make an architectural requirement verifiable, it should be specific, , and traceable to the concern it addresses.
10
Choose all
1 point
When analyzing a component or data flow in a threat model, select all the useful questions to ask.
- A
Identify the assets involved and what could go wrong.
- B
Consider who or what could cause harm, intentionally or accidentally.
- C
Assume that only deliberate actions can cause harm.
- D
Examine what access, capabilities, or weaknesses could make harm possible.
- E
Consider safeguards and the risk that remains.
11
Choose all
1 point
An architecture team is deciding what kinds of safeguards its requirements may call for. Select all categories supported by the material.
- A
Technical safeguards
- B
Physical safeguards
- C
Procedural safeguards
- D
Safeguards must be technical; physical and procedural measures do not belong in requirements.
12
Choose one
1 point
An appointment service sends information to an external notification provider. Which architectural requirement best addresses the information crossing that boundary?
- A
Allow the provider to access every appointment record to simplify integration.
- B
Rely on the provider to decide which appointment data is appropriate to disclose.
- C
Specify which appointment information may be disclosed to the provider and restrict disclosures accordingly.
- D
Remove the provider from the system model because it is external.
13
True or false
1 point
True or false: Using STRIDE guarantees that a team has identified every threat to a system.
- A
True
- B
False
14
Open ended
1 point
A team is designing an online appointment service with patient records, staff credentials, a database, and an external notification provider. Describe a security-architecture workflow the team could use to move from protection needs to verifiable design requirements. Include how it should treat trust boundaries and threats.
15
Choose one
1 point
A hospital must ensure authorized clinicians can access clinical records during an emergency. Which security objective most directly addresses keeping the system and its information accessible when needed?
- A
Confidentiality
- B
Integrity
- C
Availability
- D
Privacy
16
Choose one
1 point
A team is identifying assets for a system that stores customer records. Users depend on an identity service to access those records. Which assets should the team include?
- A
Only the customer records, because the identity service is not itself a record
- B
Both the customer records and the identity service needed to access them
- C
Only the identity service, because it controls access
- D
Neither, until a threat has caused harm
17
Choose one
1 point
Two services share a network but have different privileges and trust assumptions. What is the sound architectural conclusion?
- A
There cannot be a trust boundary unless the services are on separate physical networks.
- B
The services can automatically trust each other because they share a network.
- C
Their different privileges can create a logical trust boundary that needs explicit security decisions.
- D
Only the system boundary matters; trust assumptions between services are irrelevant.
18
Choose one
1 point
A team needs to turn the vague requirement “secure access to records” into a specific, testable architectural requirement. Which option best does that?
- A
The records service should provide strong security to all users.
- B
The records service shall authenticate every calling service before returning a record.
- C
The team should consider access risks during development.
- D
Records should be protected using appropriate methods.
19
Written response
1 point
An attacker uses a forged identity to impersonate a legitimate patient when sending a request. Which STRIDE category best describes this threat?
20
Written response
1 point
A threat model for an appointment service considers an attacker changing a patient's appointment record without authorization. Which STRIDE category best describes this threat?