Home / Summaries / CISSP All-in-One Exam Guide, Eighth Edition / architecture-security-enterprise

Domain 1: Security and Risk Management - Security Frameworks - Enterprise Architecture Development

35 important questions on Domain 1: Security and Risk Management - Security Frameworks - Enterprise Architecture Development

Which two approaches are there when securing an organization?

1. Ad hoc approach
2. Enterprise security Architecture

What is the OSI model?

This is an abstract model used to illustrate the architecture of a networking stack.

What is the difference between a architecture framework and an actual architecture?

The framework is being used as a guideline on how to build an architecture that best fits your company's needs.

Why do companies have different architectures?

Different....
1. business drivers
2. Security and regulatory requirements
3. Cultures
4. Organizational structures

What's the first step in developing an architecture?

Identify the stakeholders

What's the second step of developing an architecture?

The different viewpoints within the organization.

What are the advantages of using an enterprise architecturen?

1. It gives you inside about the company from several different views
2. It gives you inside about how a change on one level will affect items at other levels. Example: Will new networking devices be required when i change level above.

Why do we need enterprise architecture frameworks?

Because business people or technology people use a lot of different words to explain things. Because of organizations around the world have implemented incorrect solutions because the business functionality to technical specifications requirements was not understood.

What law is being introduced in the U.S. To minimize the failure cost of implementing the wrong systems and application?

Clinger-Cohen Act for federal agencies to improve their IT expenditures.

Which enterprise architecture framework was one of the first that has been introduced and by who?

Zachman architecture framework by John Zachman

During which period in time was the Zachman architecture framework being developed?

1980s

What is the goal of the Zachman framework?

To be able to look at the same organization from different viewpoints

Who created the TOGAF framework?

U.S. Department of defense

In which way can individual architecture types be created by TOGAF?

With the use of Architecture Development Method (ADM)

Where is the DoDAF framework good at?

Spanning many different complex government agencies to allow interoperability and proper hierarchical communication channels.

On which 7 areas lies the focus of DoDAF?

The focus lies on:
1. Command
2. Control
3. Communications
4. Computer
5. Intelligence
6. Surveillance and reconnaissance systems
7. Processes

What is a very important aspect of DoDAF to work properly?

That different devices communicate using the same protocol types and interoperable software components and also using the same data elements.

Who developed the MODAF?

British MOD

Besides DoDAF and MODAF being used only for military purposes, where it is also being used for?

For enterprise environments

How do you determine which framework is best for your organization?

By finding out who the stakeholders are and what information they need from the architecture and how the architecture would provide this information.

What is the enterprise security architecture about?

It's a subset of the enterprise architecture and defines the information security strategy. that consists of layers of solutions, processes, and procedures and the way the linked across an enterprise strategically, tactically and operationally.

Where does ISMS stand for?

Information Security Management System

What is the main reason to develop a enterprise security architecture?

To ensure that security efforts align with business practices in a standardized and cost-effective manner. The architecture works at an abstraction level and provides a frame of reference.

Why do many organizations not develop and roll out an enterprise security architecture?

Because they do not fully understand what one is and the task seems overwhelming. Fighting fires is more understandable and straightforward so many companies stay with this familiar approach

Where does SABSA stand for?

Sherwood Applied Business Security Architecture

SABSA provides a life-cycle model, what is meant by that?

The architecture can be constantly monitored and improved upon over time by using this model.

Which 4 things are important to understood to develop en implement a successfull enterprise security architecture

1. Strategic alignment
2. Business enablement
3. Process enhancement
4. Security effectiveness

What is meant by strategic alignment?

It means the business drivers and the regulatory and legal requirements are being met by the security enterprise architecture.

Security efforts need to provide survival for a company, but also.....

It need the company to be able to thrive.

What does Business Enablement mean?

The core business processes are integrated into the security operating model. They are standards-based and follow a risk tolerance criteria.

What is meant with process reengineering?

In organizations, duplicated processes can take place. Maybe it's possible to automate manual steps, or are their ways to streamline and reduce time and effort involved in certain tasks. This is called process reengineering.

What is meant by process enhancement?

The effort that is being put into the chance to enhance and improve upon process to improve and increase productivity.

What is Security Effectiveness about?

Deals with:
1. Metrics
2. Meeting service level agreement (SLA) requirements
3. Achieving a return on investment (ROI)
4. Meeting set baselines
5. Providing management with a dashboard or a balanced scorecard system

These are ways to determine how useful the current security solutions and architecture as a whole are performing. Are the controls in place providing the necessary level of protection?

What are the differences between Enterprise and system architectures?

1. Enterprise architecture addresses the structure of an organization.
2. System architecture addresses the structure of software and computing components.

What layers should the rules within an organizational security policy support?

1. Application code
2. The security kernel of OS
3. Hardware security provided by computer's CPU

The question on the page originate from the summary of the following study material:

CISSP All-in-One Exam Guide, Eighth Edition | 9781260142655 | Fernando Maymi, et al

View summary

A unique study and practice tool
Never study anything twice again
Get the grades you hope for
100% sure, 100% understanding

Remember faster, study better. Scientifically proven.

Topics that are related to Domain 1: Security and Risk Management - Security Frameworks - Enterprise Architecture Development

Domain 1: Security and Risk Management - Security Frameworks