🏗️ Security Architecture - SECX Practice Questions

Design enterprise security architecture, zero trust, secure cloud, and resilient systems.

9Questions Available
1Exam Domains

Practice Security Architecture Questions Now

Start a timed practice session focusing on Security Architecture topics from the SECX question bank.

Start SECX Practice Quiz →

SECX Security Architecture Question Bank (9 Questions)

Browse all 9 practice questions covering Security Architecture for the SECX certification exam. Each question includes the full answer and a detailed explanation to help you understand the concepts.

  1. Question 1Security Architecture

    An enterprise is designing a multi-cloud security architecture spanning AWS, Azure, and GCP. Which approach provides the MOST consistent security posture across all three providers?

    AUsing each cloud provider's native security tools independently
    BImplementing a cloud-native application protection platform (CNAPP) with a unified policy engine across all providers
    CDeploying identical on-premises firewalls in each cloud
    DRelying on the default security configurations of each provider
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    A CNAPP with a unified policy engine provides consistent visibility, compliance assessment, and threat detection across multiple cloud providers. Provider-native tools create silos, while identical on-premises appliances don't leverage cloud-native capabilities.

  2. Question 2Security Architecture

    An organization stores sensitive data in an S3 bucket. A security architect needs to ensure data is encrypted at rest with customer-managed keys and that key rotation occurs automatically every 90 days. Which AWS service configuration achieves this?

    AS3 default encryption with SSE-S3
    BAWS KMS with a customer-managed key (CMK) configured for automatic annual rotation, supplemented by manual rotation every 90 days
    CClient-side encryption with keys stored in plaintext on the application server
    DS3 bucket versioning without encryption
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    AWS KMS CMKs support automatic rotation annually by default. For 90-day rotation, manual rotation must supplement automatic rotation by creating new key material and updating the alias. SSE-S3 uses AWS-managed keys without customer control over rotation frequency.

  3. Question 3Security Architecture

    A security architect is implementing a service mesh (e.g., Istio) for microservices running in Kubernetes. Which security benefit does mutual TLS (mTLS) within the service mesh provide?

    AIt prevents SQL injection in microservices
    BIt provides authentication and encryption for all service-to-service communication without modifying application code
    CIt replaces the need for container image scanning
    DIt eliminates the need for network policies
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    mTLS within a service mesh automatically encrypts all service-to-service traffic and provides mutual authentication between services. This is implemented at the infrastructure layer (sidecar proxies), requiring no application code changes while enforcing zero trust between microservices.

  4. Question 4Select All That ApplySecurity Architecture

    A security architect needs to protect serverless functions (AWS Lambda) that process sensitive data. Which security controls are MOST important? (Choose two.)

    ALeast-privilege IAM roles per function and encryption of environment variables
    BInstalling antivirus agents on the Lambda runtime
    CUsing security groups to block Lambda internet access by default
    DDisabling CloudWatch logging to prevent data leakage
    Show Answer & Explanation
    Correct Answer: A
    Explanation:

    Serverless security relies on least-privilege IAM roles (each function gets only the permissions it needs) and encrypting environment variables (which often contain secrets). Traditional agents can't be installed on serverless runtimes, and CloudWatch logging is essential for security monitoring.

  5. Question 5Security Architecture

    An organization is implementing a zero trust architecture (ZTA). Which of the following principles is MOST fundamental to zero trust?

    AImplicit trust for all internal network traffic
    BNever trust, always verify — every access request must be authenticated, authorized, and continuously validated
    CTrust but verify using periodic audits
    DFull trust for VPN-connected users
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    Zero trust's core principle is 'never trust, always verify.' Every access request, regardless of network location, must be explicitly authenticated, authorized, and continuously validated. This eliminates implicit trust based on network perimeter or VPN connection.

  6. Question 6Select All That ApplySecurity Architecture

    In a zero trust architecture, the policy decision point (PDP) determines access based on multiple signals. Which combination of signals provides the MOST comprehensive access decision? (Choose two.)

    AUser identity, device health posture, and real-time risk score
    BOnly the source IP address
    CTime of day only
    DThe color of the user's desktop wallpaper
    Show Answer & Explanation
    Correct Answer: A
    Explanation:

    A comprehensive zero trust access decision should incorporate user identity (who), device health posture (what condition), and real-time risk scoring (contextual threat level). Relying on a single signal like IP address contradicts zero trust principles.

  7. Question 7Security Architecture

    An enterprise is evaluating zero trust network access (ZTNA) solutions to replace its legacy VPN. Which capability differentiates ZTNA from traditional VPN the MOST?

    AZTNA provides encrypted tunnels
    BZTNA grants access to specific applications based on identity and context rather than providing broad network-level access
    CZTNA uses stronger encryption algorithms
    DZTNA is always cloud-hosted
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    The fundamental differentiator of ZTNA is application-level access control based on identity and context, versus VPN's network-level access. ZTNA hides applications from unauthorized users and grants least-privilege access per-application, reducing the attack surface.

  8. Question 8Security Architecture

    A security architect is implementing continuous adaptive trust for a zero trust architecture. The system must dynamically adjust access permissions during an active session. Which mechanism achieves this?

    AOne-time authentication at session start
    BContinuous evaluation of user behavior, device posture, and threat signals with real-time policy enforcement that can step-up authentication or revoke access mid-session
    CSession tokens that never expire
    DStatic role-based access control
    Show Answer & Explanation
    Correct Answer: B
    Explanation:

    Continuous adaptive trust requires real-time evaluation of multiple signals (user behavior analytics, device posture changes, threat intelligence) throughout the session. If risk increases, the system can dynamically enforce step-up authentication, reduce privileges, or terminate the session.

  9. Question 9Select All That ApplySecurity Architecture

    An enterprise is deploying a software-defined wide area network (SD-WAN). Which security considerations are MOST critical during the architecture design? (Choose two.)

    AImplementing end-to-end encryption for all overlay traffic across sites
    BHardening the orchestrator management plane with MFA and role-based access control
    CUsing only MPLS connections without internet breakout
    DDisabling quality of service (QoS) for security traffic
    Show Answer & Explanation
    Correct Answers: A, B
    Explanation:

    SD-WAN security requires end-to-end encryption for all overlay traffic and hardened management plane protection. A compromised orchestrator could affect the entire WAN, and unencrypted overlay traffic is vulnerable to interception across internet transport links.

Key Security Architecture Concepts for SECX

architecturezero trustcloud securityresiliencesegmentationenterprise

SECX Security Architecture Exam Tips

Security Architecture questions in SECX are typically scenario-based. Focus on service-level decision making aligned to official exam objectives. Priority concepts: architecture, zero trust, cloud security, resilience, segmentation, enterprise.

What SECX Expects

  • Anchor your answer in select the most practical, secure, and scalable answer for the stated scenario.
  • Security Architecture scenarios for SECX are frequently mapped to Domain 1 (25%), so read the objective carefully before picking controls or architecture.
  • Expect multi-service scenarios where Security Architecture interacts with IAM, networking, storage, or observability patterns rather than appearing as an isolated service question.
  • When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Expert) and managed-service best practices.

High-Value Security Architecture Concepts

  • Know the core Security Architecture building blocks cold: architecture, zero trust, cloud security, resilience.
  • Review the edge-case features and limits for segmentation, enterprise; these details are commonly used to differentiate answer choices.
  • Practice service-integration reasoning: how Security Architecture pairs with Security Engineering, Governance & Risk in real deployment patterns.
  • For SECX, explain why the chosen Security Architecture design meets reliability, security, and cost expectations better than the alternatives.

Common SECX Traps

  • Watch for answers that partially solve the requirement but miss operational constraints.
  • Questions in Security Architecture often include distractors that look correct for Security Architecture but violate least-privilege, durability, or availability requirements.
  • Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
  • If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.

Fast Review Checklist

  • Can you compare at least two Security Architecture implementation paths and justify which one best fits the scenario?
  • Can you map the chosen answer back to Security Architecture (25%) outcomes for SECX?
  • Can you explain security and access boundaries for Security Architecture without relying on default-open assumptions?
  • Can you describe how Security Architecture integrates with Security Engineering and Governance & Risk during failure, scaling, and monitoring events?

Exam Domains Covering Security Architecture

Related Resources

More SECX Study Resources