Enterprise Secure System Design Quiz

1. Which control type is most effective for preventing unauthorized access to sensitive systems?

Detective controls only

Preventive controls combined with detective and corrective controls

Corrective controls only

No controls; rely on user awareness

2. In enterprise security governance, what is the primary purpose of a Security Baseline?

To eliminate all security costs

To establish minimum security standards and configurations across the organization

To replace individual security policies

To reduce compliance requirements

3. Which of the following best describes the principle of 'fail-secure' in security design?

Systems should operate normally even when security controls fail

When a security control fails, the system should default to a secure state, denying access

All failures should be logged and ignored

Failures should be hidden from users

4. In secure configuration management, what is the primary goal of hardening a system?

To increase processing speed

To remove unnecessary services and disable non-essential features to reduce attack surface

To add more applications

To simplify user interfaces

5. What does 'privilege escalation' refer to in enterprise security?

Promoting employees to management roles

An attacker gaining higher-level permissions than initially granted

Increasing system performance

Upgrading software licenses

6. In secure API design, what is the primary security risk to mitigate?

Slow API response times

Unauthorized access, injection attacks, and data exposure through inadequate authentication and validation

Too many API endpoints

High API documentation costs

7. What is the primary purpose of a Secure Access Service Edge (SASE) architecture?

To replace all employee workstations

To converge network and security functions for secure remote access

To eliminate the need for VPNs

To reduce cloud adoption

8. Which authentication method provides the strongest security for enterprise systems?

Single password

Multi-factor authentication combining something you know, have, and are

Security questions only

Username alone

9. In enterprise risk management, what is the purpose of conducting a Business Impact Analysis (BIA)?

To identify which business processes are most critical and their recovery priorities

To eliminate all operational risks

To replace disaster recovery planning

To reduce IT budgets

10. What is the primary benefit of implementing network segmentation in enterprise security?

It eliminates the need for firewalls

It limits lateral movement and contains breaches within isolated network zones

It guarantees no data loss

It reduces bandwidth usage

11. In a defense-in-depth strategy, what is the primary advantage of layering multiple security controls?

It eliminates the need for incident response planning

It ensures that failure of one control does not compromise the entire system

It reduces the cost of security infrastructure

It guarantees 100% protection against all threats

12. In secure system design, what does 'security by design' mean?

Adding security features after system development is complete

Integrating security requirements from the beginning of system architecture and design

Using only open-source security tools

Implementing security only at the network perimeter

13. What is the primary function of a Security Information and Event Management (SIEM) system?

To encrypt all data in transit

To centrally collect, analyze, and correlate security logs for threat detection

To replace intrusion detection systems

To manage user passwords

14. Which encryption standard is most widely recommended for protecting data at rest in enterprise environments?

DES

AES-256

MD5

RC4

15. In enterprise security, what does 'defense-in-width' refer to?

Protecting only the perimeter of the network

Implementing security controls across multiple layers and domains of the infrastructure

Using a single comprehensive security tool

Focusing security efforts only on the database layer

16. What is the primary goal of implementing a Zero Trust architecture in enterprise networks?

To eliminate all firewalls

To assume no user or device is trustworthy by default; verify every access request

To reduce the number of security tools

To allow unrestricted internal network access

17. Which of the following is a critical component of a secure software development lifecycle (SDLC)?

Security testing integrated throughout development phases

Code review and threat modeling before deployment

Secure handling of secrets and credentials

All of the above

18. In enterprise cryptography, what is the primary purpose of using a key management system (KMS)?

To encrypt all email communications

To centrally manage, store, and rotate cryptographic keys

To eliminate the need for password policies

To replace authentication mechanisms

19. What does the principle of 'least privilege' mandate in access control design?

Users should have maximum access to all systems

Users should have only the minimum permissions necessary to perform their role

All employees should share the same access level

Access controls should be removed after initial login

20. Which threat modeling framework is most commonly used in enterprise security engineering?

STRIDE

PASTA

Attack trees