(ISC)² · Free Practice Questions · Last reviewed May 2026
24real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?
Azure Monitor
Microsoft Defender for Servers
This service includes the agent-based FIM and vulnerability assessment capabilities required.
Network Watcher
Azure Bastion
To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?
MAC Sets
Logical Ports
IP Sets
Security Groups
Security Groups support dynamic membership based on tags, facilitating intent-based policy.
A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?
AppArmor
AppArmor uses profiles to restrict programs to a limited set of resources.
iptables
SELinux
SELinux uses security contexts to enforce fine-grained access control.
Auditd
PAM
A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?
Configure static route tables on all subnets to point to the firewall's ENI.
Implement a transparent bridge on each EC2 instance in the destination subnet.
Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.
Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.
GWLB is the standard architectural pattern for centralized inspection in AWS.
You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?
Traditional VPN
Network Perimeter Firewall
Policy-Based Access Control (PBAC)
Uses attributes for fine-grained authorization decisions.
Identity-Aware Proxy (IAP)
Verifies identity and context before granting access to applications.
Micro-segmentation
Limits lateral movement by isolating workloads.
You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?
VPC Flow Logs
AWS WAF
Security Groups for Pods
AWS App Mesh with Envoy sidecars
App Mesh uses Envoy proxies to manage traffic, providing identity-based security rather than network-layer security.
Want more Infrastructure And System Security practice?
Practice this domainYou are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?
NIST SP 800-30
NIST SP 800-144
This specifically addresses cloud security architecture and guidelines.
NIST SP 800-53
NIST SP 800-160
In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?
Conceptual Layer
Physical Layer
Contextual Layer
The Contextual layer defines the business scope and 'What' the business needs.
Logical Layer
In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?
To reduce software defects
To purchase better hardware
To identify all existing threats
To standardize organizational processes
CMM is used to measure and improve the maturity of security processes.
You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?
Risk Analysis
Technical Scope Definition
Stage 2 involves identifying the architecture and technical scope.
Business Impact Analysis
Threat Analysis
When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?
Information Disclosure
Elevation of Privilege
Elevation of privilege is the correct category for unauthorized access escalation.
Spoofing
Denial of Service
You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?
Architecture Vision
The Architecture Vision phase is where the scope is defined and stakeholders are identified.
Business Architecture
Transition Planning
Architecture Requirements Repository
Want more Security Architecture Modeling practice?
Practice this domainTo satisfy SOC2 Type II requirements regarding access lifecycle management, which TWO configurations should an architect verify within Okta for all privileged administrative accounts?
Enable self-service password reset.
Enforce Phishing-resistant MFA (FIDO2).
This mitigates credential theft, a key SOC2 requirement.
Configure password complexity to 16 characters.
Configure group-based assignments for all apps.
Enable Just-In-Time (JIT) access requests.
Reduces the attack surface and ensures least privilege.
An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?
Enable S3 Object Lock in compliance mode.
Utilize S3 Access Points per region.
Enforce s3:RequestedRegion in a Deny statement.
This explicitly prevents bucket creation in unauthorized regions.
Configure S3 Cross-Region Replication with filter.
When implementing a Zero Trust Architecture in Google Cloud Platform (GCP), which component is the core Policy Decision Point (PDP) used to govern access to applications based on context-aware identity and device posture?
VPC Service Controls
Identity-Aware Proxy (IAP)
Access Context Manager
This is the engine where access levels are defined for PDP decisions.
Cloud Resource Manager
An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?
Azure Key Vault
This is the specific feature for automated key rotation.
Azure Policy
Microsoft Entra ID Privileged Identity Management
Azure Monitor
Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?
ISO/IEC 27001
ITIL 4
NIST CSF
COBIT 2019 Framework
The core framework document for governance.
An organization is migrating to Azure and must align with NIST SP 800-53 controls. Which THREE actions should the architect perform within Microsoft Defender for Cloud to facilitate continuous compliance posture management?
Enable the NIST SP 800-53 regulatory compliance standard in the Environment Settings.
This enables the specific control mapping and monitoring.
Configure workflow automation for continuous assessment findings.
This ensures remediation of deviations against NIST controls.
Configure Log Analytics workspace to export to Sentinel.
Deploy Azure Policy guest configuration extensions to VMs.
This allows for OS-level compliance monitoring required for NIST.
Assign the 'Security Reader' role to the compliance auditor.
Want more Governance Risk And Compliance practice?
Practice this domainIn a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?
Encryption algorithm mismatch
Expired metadata
Assertion Consumer Service (ACS) URL mismatch
Subject NameID mismatch
A mismatch in the unique identifier mapping often results in the SP rejecting the session due to unknown identity.
You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?
Zscaler Client Connector
Zscaler App Connector
Zscaler Cloud Broker
The broker facilitates the handshake between the user session and the app connector.
Zscaler Central Authority
When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?
Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.
This is the definition of the Vault Database secrets engine operation.
Clients authenticate to the DB via Vault using LDAP delegation.
Vault retrieves static credentials from a PKI backend and rotates them.
Vault hashes existing database passwords and stores them in transit.
In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?
To manage user identities in the directory.
To log all access attempts for compliance.
To evaluate access requests against defined security policies.
The PDP is the 'brain' of the Zero Trust access flow.
To intercept and inspect network packets.
When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?
CyberArk AIM (Application Identity Manager)
CyberArk PSM (Privileged Session Manager)
PSM acts as a secure proxy to provide session isolation.
CyberArk EPM (Endpoint Privilege Manager)
CyberArk Vault Agent
You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?
Permission Sets
Permission sets allow for defining specific roles applied to accounts, providing a clean, centralized way to manage elevated access.
IAM User Inline Policies
Cross-account IAM Roles
IAM User Access Keys
Want more Identity And Access Management Architecture practice?
Practice this domainThe ISC exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Infrastructure And System Security, Security Architecture Modeling, Governance Risk And Compliance, Identity And Access Management Architecture. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official (ISC)² ISC exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.