Free Practice Quiz Question List

8 Secure Architecture Review and Practice Online Quiz Questions

Use this free practice quiz with 20 questions to review 8 Secure Architecture Review and Practice, test your knowledge, and prepare for your next test or exam.

20 questions

True or false

1 point

A security architecture review should be revisited if the system's requirements, threats, or constraints change.

A
True
B
False

Choose one

1 point

A review team consults NIST SP 800-53 while assessing a system. Which conclusion about using the catalog is justified?

A
It proves that every risk has been eliminated once the listed controls are selected.
B
It replaces the need to tailor controls to the system's context.
C
It provides candidate controls that reviewers should tailor to the system's context and risk.
D
It shows that controls operate as designed without further validation.

Written response

1 point

A control statement identifies the protected asset, the expected behavior, and evidence that the control works, but it does not say where the control is applied. What element is missing?

Choose all

1 point

A design specifies that a compromised service identity must not be able to reach a protected database. Which activities could provide evidence about whether the implemented system behaves as intended? Select all that apply.

A
Inspect identity permissions and system configurations.
B
Have operators demonstrate how they revoke a credential.
C
Test a prohibited connection in an authorized test environment.
D
Analyze logs and recovery-test results for gaps.
E
Count the number of security products deployed.

Fill in the blank

1 point

A review diagram should mark flows crossing organizational or privilege boundaries, including and .

True or false

1 point

A team may use low, medium, and high to organize risk discussion, but those labels should not be treated as precise measurements.

A
True
B
False

Written response

1 point

A team prioritizes threat scenarios by business impact and likelihood. What should it also record to avoid presenting uncertain assumptions as facts?

Fill in the blank

1 point

In a threat scenario, an attacker takes an action through a system path, causing harm to an asset because a makes the event plausible.

Choose one

1 point

A system must recover after a destructive event. Which backup approach best supports that goal?

A
Rely on network location as proof that backup access is trustworthy.
B
Protect backups from compromise or deletion and test restoration.
C
Confirm that backups are created, without testing whether they can be restored.
D
Keep backups in the same environment and under the same administrative access as production.

Choose all

1 point

An organization uses a cloud service to store sensitive records. Which review actions address the customer's cloud-governance responsibilities? Select all that apply.

A
Confirm which party operates each control and how provider evidence will be obtained.
B
Check whether service configuration meets organizational requirements.
C
Check whether data location and logging meet organizational requirements.
D
Check whether recovery meets organizational requirements.
E
Assume provider capabilities satisfy the customer's responsibilities without review.

Choose one

1 point

An organization considers stronger authentication for administrators. Which trade-off should the review team account for?

A
It eliminates the need to maintain emergency access procedures.
B
It removes the need to test whether staff can recover access.
C
It can reduce risk from stolen passwords, but safe recovery procedures must also be maintained.
D
It guarantees that administrators cannot lose access.

Open ended

1 point

A cloud customer service must remain available during a regional outage, and customer records must not be exposed through routine developer access. Propose a focused architecture-review response: describe one plausible outage scenario, identify controls for the availability and data-access concerns, compare at least two regional-recovery alternatives, and define validation evidence. Include the assumptions and residual risks that should be documented.

Choose one

1 point

A review team has several plausible threat scenarios. Which approach best supports prioritizing them?

A
Prioritize only by how easy a scenario is to explain.
B
Consider business impact and likelihood, and record uncertainty.
C
Prioritize only scenarios involving external attackers.
D
Treat a high qualitative rating as a precise measurement.

Choose one

1 point

Which description best captures a useful threat scenario for an architecture review?

A
A list of security products installed in the system and their general capabilities.
B
A plausible sequence linking a threat source, starting condition, system path, weakness, threatened asset, and impact.
C
A summary of every vulnerability ever reported for a similar system.
D
A ranking of business services by importance, without describing how they could be harmed.

True or false

1 point

True or false: Selecting controls from NIST SP 800-53, by itself, proves that a system is secure.

A
True
B
False

Written response

1 point

What should reviewers define before a test so they can judge whether the observed behavior meets the intended outcome?

Choose one

1 point

A team is preparing to review a cloud service that depends on a third-party identity provider and an operational recovery process. Which scoping approach is most appropriate?

A
Include only the application code, since infrastructure and operations are outside architecture.
B
Include every system owned by the organization, even if unrelated to the service being reviewed.
C
Identify the relevant applications, infrastructure, services, third parties, environments, and processes, and record what is excluded.
D
Limit the review to components that have already experienced a security incident.

Choose one

1 point

A cloud application component is compromised, and its service credential could be used to query customer records. Which control design most directly limits the credential's potential impact while supporting detection?

A
Limit the service identity to necessary operations, restrict its reachable database endpoint, and monitor meaningful access events.
B
Allow broad database permissions but rely on encryption at rest to prevent unauthorized queries.
C
Trust requests from the application network because network location establishes that the service is safe.
D
Disable access logging so an attacker cannot learn what events are monitored.

Written response

1 point

What approach emphasizes verifying access to individual resources instead of relying on implicit trust from network position?

Choose one

1 point

A service must remain available during a regional outage. Which evidence would most directly show whether its recovery design works as intended?

A
Confirm that backup jobs report successful completion, then treat the service as recoverable.
B
Check that backup storage is separate, but do not attempt restoration because testing could reveal problems.
C
Ask the backup administrator to describe the recovery procedure without examining evidence or system behavior.
D
Perform an authorized restore test and check whether a clean recovery meets the approved recovery objectives.