How to design systems that are secure by default: design principles, formal security models, cryptography, cloud and embedded architectures, and physical security.
Try each question before opening the answer. The full bank has many more Domain 3 questions with filters and progress tracking.
Question 1 · FIRST
To avoid the pattern leakage of ECB, an engineer selects a block cipher mode that XORs each plaintext block with the previous ciphertext block and seeds the FIRST block with a random initialization vector. Which mode is this?
ECB mode, encrypting each block independently
OFB mode, feeding output back as a keystream
CTR mode, using a counter to form a keystream
CBC mode, chaining each block with the previous ciphertext and an IV
Show answer & explanation
Answer: D — CBC mode, chaining each block with the previous ciphertext and an IV
Cipher Block Chaining XORs each plaintext block with the prior ciphertext and uses a random IV for the first block, removing ECB's pattern leakage, though it must be implemented carefully to avoid padding oracle attacks. ECB encrypts blocks independently, and CTR and OFB generate keystreams rather than chaining ciphertext, so none of them is the described chaining mode.
Question 2 · NEXT
A smoke detector in the data centre triggers. The pre-action sprinkler system's first condition has now been met. What happens NEXT before water is released onto equipment?
The gas suppression system discharges to back up the sprinklers
Water is released immediately into all sprinkler pipes and heads
The fire department must manually approve water release
A sprinkler head must also open from heat before water flows
Show answer & explanation
Answer: D — A sprinkler head must also open from heat before water flows
Pre-action systems need two triggers: detection fills the pipes, then an individual head must fuse from heat before water is discharged. This reduces accidental water damage, which is why it suits data centres.
Question 3 · LEAST
Which block cipher mode is LEAST suitable for encrypting large images or structured data?
Counter Mode (CTR)
Cipher Block Chaining (CBC)
Electronic Codebook (ECB)
Galois/Counter Mode (GCM)
Show answer & explanation
Answer: C — Electronic Codebook (ECB)
ECB encrypts identical plaintext blocks to identical ciphertext blocks, leaking patterns (the 'ECB penguin'). GCM, CBC and CTR hide repetition; GCM also provides integrity.
Question 4 · NOT
Which of the following is NOT one of the essential characteristics of cloud computing defined by NIST?
Guaranteed zero downtime
Measured service
On-demand self-service
Rapid elasticity
Show answer & explanation
Answer: A — Guaranteed zero downtime
NIST's five: on-demand self-service, broad network access, resource pooling, rapid elasticity, measured service. 'Guaranteed zero downtime' is not one, and it's an absolute. For a NOT question, eliminate what IS one.
Question 5 · BEST
A government agency must transmit highly sensitive information so that it remains confidential even against an adversary with unlimited computing power, provided the method is implemented correctly. Which is the BEST choice?
One-time pad
Elliptic-curve Diffie-Hellman
SHA-512 hashing
AES-256 asymmetric encryption
Show answer & explanation
Answer: A — One-time pad
Unbreakable even against unlimited computing power, when implemented correctly = one-time pad (Vernam). Option D contains a factual error (AES is SYMMETRIC), SHA is a hash, and ECDH is key agreement only.
Question 6 · PRIMARY
An engineer must encrypt many gigabytes of streaming backup data quickly and already has a secure way to exchange a shared key. Compared with asymmetric encryption, what is the PRIMARY advantage of using a symmetric algorithm here?
Built-in non-repudiation of the data's origin
Elimination of any need to protect the key
Native public key distribution to all parties
Far greater speed and efficiency for encrypting bulk data
Show answer & explanation
Answer: D — Far greater speed and efficiency for encrypting bulk data
Symmetric ciphers are far faster and more efficient than asymmetric ones, making them ideal for bulk data once a shared key is established. Symmetric encryption does not provide non-repudiation, which requires asymmetric signatures, it still requires protecting the shared key, and it does not perform public key distribution, so those advantages are incorrectly attributed.
Question 7 · MOST
Diffie-Hellman key exchange is used WITHOUT any authentication of the parties. Which attack is it MOST vulnerable to?
Birthday attack
Rainbow table attack
Man-in-the-middle
Brute force of the hash
Show answer & explanation
Answer: C — Man-in-the-middle
✅ With unauthenticated DH, an attacker sits in the middle and does a separate key exchange with each side. ❌ Birthday: hash collisions. ❌ Rainbow tables: password hashes. ❌ Hash brute force: unrelated to DH.
Question 8
A building design uses large windows, good lighting and low shrubs so employees and passers-by can easily see any intruder. Which CPTED strategy is this?
Target hardening
Territorial reinforcement
Natural surveillance
Natural access control
Show answer & explanation
Answer: C — Natural surveillance
✅ Natural surveillance: maximize visibility. ❌ Natural access control: guiding people via paths and doors. ❌ Territorial reinforcement: showing ownership (signs, fences). ❌ Target hardening: locks and bars (not a CPTED design element).
Question 9 · FIRST
An architect is designing a new payment platform. Which activity should be completed FIRST?
Select the cryptographic library for card data encryption
Define security requirements and threat model the design
Configure the web application firewall rules
Book a penetration test for the week before go-live
Show answer & explanation
Answer: B — Define security requirements and threat model the design
Security requirements and threat modelling drive every later decision (crypto choices, WAF rules, test scope). Doing them first is cheapest and most effective.
Question 10 · LEAST
Which physical control is LEAST effective at preventing tailgating into a server room?
A guard who checks each badge at the door
A turnstile linked to badge authentication
A security awareness poster about holding doors
A mantrap that admits one person at a time
Show answer & explanation
Answer: C — A security awareness poster about holding doors
Mantraps, badge turnstiles and guards technically or physically enforce one-person entry. A poster is a weak directive control that depends on voluntary compliance.
Ready for the full bank?
2,000+ explained questions, timed mocks and a CAT simulator that behaves like the real exam.
