SABSA Master Practice Test

SABSA Master preparation should emphasize leadership and review judgment: architecture coherence, assurance strategy, governance, risk ownership, stakeholder tradeoffs, and defensible recommendations.

These 12 original questions are a public preview, not official SABSA questions.

What these questions test

• leading security architecture review across business, risk, and technology stakeholders
• evaluating whether the architecture remains traceable, operable, and assured
• communicating residual risk and tradeoffs without hiding uncertainty

Official-source check

Verify current certification levels, policies, and training requirements with the SABSA certification page .

Sample Exam Questions

Question 1

Topic: architecture review

What is the strongest focus for a senior security architecture review?

• A. Whether the architecture is traceable to business attributes, risk scenarios, design decisions, operations, and evidence
• B. Whether every slide has the same icon
• C. Whether one vendor is named most often
• D. Whether review minutes are shorter than one page

Best answer: A

Explanation: Master-level review should test coherence across requirements, risk, design, operation, and assurance.

Question 2

Topic: residual risk

What should happen when a control gap leaves material residual risk?

• A. Ignore it until an incident occurs
• B. Document the gap, quantify or qualify impact, identify options, and obtain risk-owner decision
• C. Hide it from leadership
• D. Delete the requirement

Best answer: B

Explanation: Residual risk needs transparent ownership, decision rights, and treatment options.

Question 3

Topic: governance

Which governance pattern is strongest?

• A. No standards or exception process
• B. Central approval of every minor configuration
• C. Clear guardrails, decision rights, exceptions, evidence requirements, and review cadence
• D. Security decisions made only by vendors

Best answer: C

Explanation: Effective governance provides accountability and guardrails without unnecessary friction.

Question 4

Topic: assurance maturity

What indicates a mature assurance approach?

• A. Evidence is defined, collected, reviewed, challenged, and improved over time
• B. Evidence is collected only after audit failure
• C. Assurance is replaced by trust
• D. Controls are never tested

Best answer: A

Explanation: Mature assurance is an ongoing system of evidence and improvement, not a one-time checklist.

Question 5

Topic: enterprise tradeoff

A business wants rapid market entry, but the architecture has unresolved data-protection risk. What is the best senior response?

• A. Frame options with business impact, risk exposure, control choices, residual risk, and decision ownership
• B. Block all delivery without explaining why
• C. Ignore the risk because speed matters
• D. Let the project team hide the issue

Best answer: A

Explanation: Senior architecture work clarifies tradeoffs and decision rights. It should not hide risk or use unexplained vetoes.

Question 6

Topic: architecture principles

What makes a security architecture principle useful?

• A. It guides decisions, is testable in context, and connects to business attributes and risk
• B. It is vague enough to mean anything
• C. It replaces all design
• D. It belongs only in a slide archive

Best answer: A

Explanation: Principles are useful when they shape choices and can be reviewed against business and risk context.

Question 7

Topic: stakeholder communication

Which message is strongest for an executive committee?

• A. “The control product is popular.”
• B. “The architecture reduces the top account-takeover scenario, but residual risk remains in third-party recovery time; here are the options.”
• C. “No risk exists.”
• D. “We cannot explain the design.”

Best answer: B

Explanation: Senior communication should connect architecture to risk reduction, residual exposure, options, and decision impact.

Question 8

Topic: dependency risk

What should be reviewed when a critical security control depends on a supplier?

• A. Contractual obligations, resilience, evidence, monitoring, exit options, and residual risk
• B. Only the supplier logo
• C. Nothing after purchase
• D. The office location only

Best answer: A

Explanation: Supplier dependency can affect control effectiveness. Architecture review should include operational and assurance concerns.

Question 9

Topic: enterprise pattern

Why use reusable security architecture patterns?

• A. They can improve consistency, speed, assurance, and design quality when applied with context
• B. They remove the need to understand risk
• C. They must never be adapted
• D. They replace business requirements

Best answer: A

Explanation: Patterns are useful starting points, but senior architects must adapt them to business and risk context.

Question 10

Topic: exception management

What is a strong exception process?

• A. Defined owner, rationale, compensating controls, expiry/review date, and residual-risk acceptance
• B. Permanent undocumented exceptions
• C. No compensating controls
• D. No review after approval

Best answer: A

Explanation: Exceptions should be controlled, temporary where possible, and visible to the right risk owners.

Question 11

Topic: architecture evidence

Which evidence is most useful for an access-control architecture?

• A. Role model, approval workflow, privileged-access logs, recertification results, and exception records
• B. A screenshot of the homepage only
• C. A meeting lunch receipt
• D. A list of desk numbers

Best answer: A

Explanation: Useful evidence demonstrates design, operation, review, and exceptions for the control area.

Question 12

Topic: common trap

Which statement is weakest?

• A. Senior security architecture includes governance and assurance.
• B. Senior security architecture should clarify residual-risk ownership.
• C. Senior security architecture means approving any product labeled secure.
• D. Senior security architecture communicates tradeoffs.

Best answer: C

Explanation: Product labels are not evidence. Senior architecture requires traceability, assurance, and accountable risk decisions.