Enterprise security architecture, risk governance, security engineering, operations, automation and cryptographic implementation at the advanced level.
39 cards · basic cards · AI-written, checked twice. Edit anything.
- Define the Zero Trust security model
Show answer
Security architecture that assumes no implicit trust, requires continuous verification of all users and devices regardless of network location, and enforces least privilege access.- What is defense in depth?
Show answer
Layered security approach using multiple controls at different levels so compromise of one layer does not result in total breach.- Distinguish between secure by design and secure by default
Show answer
Secure by design integrates security into the architecture from inception. Secure by default means security controls are enabled without additional configuration.- What is STRIDE in threat modeling?
Show answer
Mnemonic for six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.- Define Privileged Access Management (PAM)
Show answer
Technology and processes for controlling, monitoring, and auditing access to privileged accounts and their activities across the enterprise.- What is federated identity management?
Show answer
System allowing users to authenticate once and access multiple independent, related systems without re-entering credentials.- What is API security critical for in modern applications?
Show answer
APIs are primary attack vectors for data breach and unauthorized access, requiring authentication, rate limiting, input validation, and encryption.- What is the shared responsibility model in cloud security?
Show answer
Customer is responsible for security of data, applications, and user access. Cloud provider is responsible for infrastructure, platform, and physical security.- Explain container security at the image level
Show answer
Container images must be scanned for vulnerabilities, signed to ensure integrity, and stored in secure registries with access controls.- List the five functions of the NIST Cybersecurity Framework
Show answer
Identify, Protect, Detect, Respond, Recover.- Differentiate between risk analysis and risk assessment
Show answer
Risk analysis is the process of identifying and examining risks. Risk assessment combines analysis with context and determines impact and likelihood.- Define risk appetite
Show answer
The amount and type of risk an organization is willing to accept in pursuit of its business objectives.- What is the key difference between business continuity and disaster recovery?
Show answer
Business continuity keeps operations running during disruption through preventive measures. Disaster recovery restores systems after a disruptive event.- What does COBIT provide for security governance?
Show answer
Framework for IT governance and management covering strategic alignment, value delivery, risk management, and resource management.- Explain the purpose of a risk matrix or heat map
Show answer
Visualizes risks by plotting likelihood against impact to prioritize which risks require immediate attention and resources.
FlashKeepers