ISC2 CISSP Practice Question

The correct answer is To centralize authentication and authorization decisions. The Secure Gateway design pattern centralizes authentication and authorization decisions, providing a single point for enforcing security policies. This pattern creates a security choke point that ensures consistent access control across the application and reduces the risk of security policy violations that might occur with distributed security checks. It separates the authentication and authorization logic from business logic.

To encrypt all communication between components is incorrect because while a Secure Gateway might use encryption, its primary purpose is centralized access control rather than encryption. Encryption would typically be implemented using different patterns like Secure Communication or Encrypted Storage.

To generate security event logs is incorrect because event logging is typically handled by separate patterns like Security Logger or Audit Interceptor. While a Secure Gateway might generate logs, this is a secondary function rather than its primary purpose.

To scan for malware in uploaded files is incorrect because malware scanning is a specific security function typically handled by specialized components rather than being the primary purpose of the Secure Gateway pattern. Content validation patterns would be more appropriate for this functionality.