Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 3.1: Secure design principles: threat modeling, least privilege, defense in depth, secure defaults, fail securely, segregation of duties, simplicity, zero trust, privacy by design, shared responsibility, and SASE
A badge-controlled exit door protects a restricted office but is also part of the building's emergency egress path. How should the lock behave when building power is lost?
- A.Remain locked from both directions to preserve confidentiality
- B.Disable the fire alarm until badge service is restored
- C.Unlock only after the security operations center approves each exit
- D.Permit emergency egress while maintaining entry restrictions where safely supported
Show answer and explanation
Best answer: D. Permit emergency egress while maintaining entry restrictions where safely supported
Life safety and emergency egress take priority. The design should allow occupants to exit while preserving external entry control where codes and safe mechanisms permit.
A: Trapping occupants creates unacceptable safety risk.
B: Disabling fire detection compounds the hazard.
C: Manual approval can delay emergency escape.
D: Life safety and emergency egress take priority. The design should allow occupants to exit while preserving external entry control where codes and safe mechanisms permit.
Question 2·Objective 3.2: Security models, including Biba, Star, and Bell-LaPadula
A laboratory uses a strict Biba integrity model. A high-integrity process must not be contaminated by untrusted measurements, and low-integrity users must not modify validated results. Which rule set supports this goal?
- A.No read up and no write down
- B.Unrestricted reads with owner-controlled writes
- C.Read and write only at lower levels
- D.No read down and no write up
Show answer and explanation
Best answer: D. No read down and no write up
Biba protects integrity through no read down, preventing high-integrity subjects from consuming lower-integrity data, and no write up, preventing lower-integrity subjects from modifying higher-integrity objects.
A: That pairing is associated with confidentiality-oriented Bell-LaPadula behavior.
B: Owner discretion is not the stated mandatory integrity model.
C: This permits downward writes and does not express Biba's rules.
D: Biba protects integrity through no read down, preventing high-integrity subjects from consuming lower-integrity data, and no write up, preventing lower-integrity subjects from modifying higher-integrity objects.
Question 3·Objective 3.5: Vulnerabilities and mitigations across clients, servers, databases, cryptographic systems, ICS, cloud, distributed systems, IoT, microservices/APIs, containers, serverless, embedded systems, HPC, edge, and virtualization
A company stores sensitive objects in a managed cloud storage service. The provider patches the underlying infrastructure, but a public-access setting exposes a bucket. Which party is primarily responsible for correcting the exposure?
- A.The cloud customer, because it configured access to its data
- B.The provider, because it owns the physical servers
- C.The internet service provider, because traffic crosses its network
- D.The external auditor, because it evaluates the service
Show answer and explanation
Best answer: A. The cloud customer, because it configured access to its data
Under shared responsibility, the provider secures managed infrastructure while the customer remains responsible for its data and customer-controlled access configuration.
A: Under shared responsibility, the provider secures managed infrastructure while the customer remains responsible for its data and customer-controlled access configuration.
B: Infrastructure ownership does not transfer responsibility for customer configuration.
C: Network transport does not make the ISP the bucket's access administrator.
D: Auditors assess controls; they do not operate the customer's configuration.
Question 4·Objective 3.6: Cryptographic lifecycle, methods, key management, PKI, elliptic curves, quantum considerations, and quantum key distribution
A monitoring alert confirms that the private key for an internet-facing server certificate was copied by an unauthorized party. Which action BEST re-establishes trust in the service?
- A.Renew the existing certificate while retaining its current key pair
- B.Increase the server's TLS logging and shorten the certificate's remaining lifetime
- C.Generate a new key pair, replace the certificate, and revoke the certificate associated with the compromised key
- D.Encrypt the compromised private key with a stronger password before returning the service to production
Show answer and explanation
Best answer: C. Generate a new key pair, replace the certificate, and revoke the certificate associated with the compromised key
A copied private key can no longer be trusted. A new key pair and certificate establish new keying material, while revocation tells relying parties that the old certificate-to-key binding should no longer be accepted.
A: Renewal with the same compromised key preserves the compromise.
B: Monitoring and a shorter lifetime reduce neither the current ability to misuse the copied key nor the need to invalidate it.
C: A copied private key can no longer be trusted. A new key pair and certificate establish new keying material, while revocation tells relying parties that the old certificate-to-key binding should no longer be accepted.
D: Protecting the organization's remaining copy does not invalidate the attacker's copy.
Question 5·Objective 3.9: Physical/environmental facility controls, utilities, HVAC, fire, and power
A data center requires computing systems to continue operating without interruption when utility power fails, including during the time needed for an onsite generator to start. Which design BEST satisfies the requirement?
- A.A generator without battery support
- B.A second utility invoice from the same electrical feed
- C.Surge protectors on each server rack
- D.An online UPS sized for the transition, backed by a tested generator
Show answer and explanation
Best answer: D. An online UPS sized for the transition, backed by a tested generator
The UPS provides immediate conditioned power through the startup interval, and the generator supports longer outages when properly sized and tested.
A: Generator startup creates an interruption without bridging power.
B: Billing arrangements do not create an independent power path.
C: Surge protection does not supply outage power.
D: The UPS provides immediate conditioned power through the startup interval, and the generator supports longer outages when properly sized and tested.
Question 6·Objective 3.1: Secure design principles: threat modeling, least privilege, defense in depth, secure defaults, fail securely, segregation of duties, simplicity, zero trust, privacy by design, shared responsibility, and SASE
A payment service denies access when its authorization service becomes unavailable. Which design principle is demonstrated?
- A.Open design
- B.Shared responsibility
- C.Fail securely
- D.Economy of mechanism
Show answer and explanation
Best answer: C. Fail securely
Denying access on control failure preserves the secure state.
A: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
B: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
C: Denying access on control failure preserves the secure state.
D: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
Question 7·Objective 3.2: Security models, including Biba, Star, and Bell-LaPadula
A system must prevent users from reading information above their clearance. Which model most directly addresses this?
- A.Biba
- B.Clark-Wilson
- C.Brewer-Nash only after access
- D.Bell-LaPadula
Show answer and explanation
Best answer: D. Bell-LaPadula
Bell-LaPadula focuses on preserving confidentiality through information-flow rules.
A: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
B: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
C: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
D: Bell-LaPadula focuses on preserving confidentiality through information-flow rules.
Question 8·Objective 3.3: Control selection from system security requirements
Architects receive a requirement that transaction approvals need two independent people. What should they do?
- A.Select and design controls enforcing separation of duties
- B.Rely on annual awareness training
- C.Use longer session timeouts
- D.Encrypt transaction totals only
Show answer and explanation
Best answer: A. Select and design controls enforcing separation of duties
Control selection should trace directly to the stated security requirement.
A: Control selection should trace directly to the stated security requirement.
B: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
C: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
D: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
Question 9·Objective 3.4: System security capabilities such as memory protection, TPM, and cryptography
A laptop's disk encryption key must be protected from offline extraction. Which capability BEST helps?
- A.A screen privacy filter
- B.A properly configured trusted platform module
- C.A network intrusion sensor
- D.A redundant power supply
Show answer and explanation
Best answer: B. A properly configured trusted platform module
A TPM can protect cryptographic material and bind release to platform state.
A: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
B: A TPM can protect cryptographic material and bind release to platform state.
C: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
D: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
Question 10·Objective 3.5: Vulnerabilities and mitigations across clients, servers, databases, cryptographic systems, ICS, cloud, distributed systems, IoT, microservices/APIs, containers, serverless, embedded systems, HPC, edge, and virtualization
Containers run as root and share the host kernel. What should be prioritized?
- A.Add more container images
- B.Disable image signing
- C.Reduce privileges and strengthen workload and host isolation
- D.Place secrets in environment logs
Show answer and explanation
Best answer: C. Reduce privileges and strengthen workload and host isolation
Least privilege and isolation reduce the impact of container compromise.
A: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
B: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
C: Least privilege and isolation reduce the impact of container compromise.
D: This option may be useful in another context, but it does not meet the stated architecture or engineering objective.
Continue studying Security Architecture and Engineering
Review the complete Domain 3 guide, then mix this material with the other seven domains in an adaptive mock exam.