ISC Exam Questions and Answers

Contextual Layer

The Contextual Layer directly satisfies the 'What' constraint from a business perspective by defining the overarching business requirements, assets, and operational scope. Within the SABSA matrix, this highest layer operates on the foundational six-W interrogatives—specifically addressing *what* business value must be protected—before translating those high-level enterprise goals into operational security services and architectural blueprints at the subsequent conceptual and logical layers.

To standardize organizational processes

Standardising organisational processes serves as the fundamental mechanism for achieving the Capability Maturity Model integration, directly satisfying the requirement for consistent architectural governance. By establishing a structured framework, organisations move from ad-hoc activities to repeatable, defined, and managed workflows. This transition ensures that security controls are applied uniformly across the enterprise, reducing variance in risk posture. Such standardisation allows security teams to measure performance against established benchmarks, facilitating continuous improvement and ensuring that identity-centric solutions, such as Microsoft Entra ID, operate within a predictable, mature operational environment.

Technical Scope Definition

Stage 2 of the PASTA framework directly satisfies the requirement to define the technical boundaries of the application by establishing the Technical Scope Definition. During this phase, threat modellers enumerate the underlying architecture, system components, trust boundaries, and operational dependencies that constrain the target environment. This ensures subsequent simulation stages accurately reflect the targeted infrastructure rather than theoretical abstractions, directly fulfilling the necessity to map out the technical parameters before attack simulation begins.

Elevation of Privilege

An unauthorized user transitioning from a standard user context to an administrative account directly satisfies the Elevation of Privilege category within the STRIDE methodology, as this threat vector involves exploiting insufficient boundary validation or flaws in access control lists to assume a security context with higher privileges than originally granted. This misuse of authorization boundaries allows an attacker to bypass intended restrictions, execute administrative functions, and fully compromise system integrity or confidentiality, aligning precisely with the mechanics of privilege escalation attacks.

Architecture Vision

Architecture Vision serves as the foundational phase within the ADM to establish the project’s boundaries and engagement parameters. By mandating the creation of a Statement of Architecture Work, this phase directly satisfies the requirement to define the scope and identify stakeholders before technical development commences. It formalises the architectural objectives and ensures that all relevant parties are aligned with the organisational goals, thereby providing the necessary governance structure to guide subsequent phases and ensure the enterprise architecture remains coherent throughout its lifecycle.

Managing architectural artifacts

The Architecture Repository serves as the central hub for storing, categorising, and managing architectural artifacts, satisfying the TOGAF requirement for a structured knowledge base. By housing the Architecture Landscape, Standards Information Base, and Governance Log, it provides a persistent mechanism to track design assets throughout the lifecycle. This repository enables practitioners to retrieve reusable components and maintain traceability across complex enterprise environments, ensuring that all architectural documentation remains consistent, accessible, and aligned with the organisation’s strategic objectives.

Azure Key Vault

Azure Key Vault integrates directly with Azure storage accounts to manage and automatically rotate storage account access keys through a managed storage account feature. By acting as the key service, it periodically regenerates the keys without requiring manual intervention, thereby satisfying the compliance mandate for automated key rotation. This eliminates the operational overhead and security risks associated with manual processes while maintaining seamless authentication access for the migrating workloads.

COBIT 2019 Framework

COBIT 2019 Framework serves as the core foundational document by integrating governance and management objectives into a unified structure. It satisfies the stem’s constraint regarding the provision of a governance perspective by aligning IT processes with enterprise business objectives through its governance system components. By establishing this strategic link, it enables organisations to practise effective oversight, ensuring that information technology investments directly facilitate the achievement of broader corporate goals and value creation requirements within the governance framework.

Service Control Policies (SCPs)

Service Control Policies (SCPs) applied at the AWS Organization root or OU level within AWS Control Tower enforce preventative guardrails by explicitly denying API actions that violate security baselines. For PCI-DSS 4.0 compliance, SCPs directly satisfy the requirement to prevent non-compliant Amazon S3 bucket configurations—such as public read access or unencrypted storage—from being created in any new member account, ensuring continuous posture enforcement without relying on manual intervention.

Regulatory and legal obligations.

Regulatory and legal obligations dictate mandatory data residency, sovereignty, and compliance baselines that directly constrain the risk appetite for a cloud-native architecture. When defining acceptable risk thresholds for distributed microservices and ephemeral serverless components, organisations must ensure that automated data processing pipelines do not violate cross-border data transfer restrictions or industry-specific statutes like GDPR. These external compliance frameworks establish non-negotiable boundaries within which the risk appetite must be formulated, ensuring that operational agility in cloud environments never supersedes statutory mandates.

Business strategic objectives.

Aligning risk parameters with overarching corporate goals satisfies the imperative for cloud-native architectural velocity, ensuring that operational parameters for containerised microservices directly support commercial scalability targets. When designing distributed serverless components, the risk appetite must accurately reflect enterprise growth objectives to balance strict cryptographic isolation with rapid software delivery pipelines, directly satisfying the strategic alignment constraint mandated by the business-driven architecture.

Audit

The `Audit` effect directly satisfies the requirement to log non-compliance without blocking resource deployments. When an Azure Policy assigned with this effect evaluates existing or newly submitted resource properties against defined rules, it generates a non-compliant event in the Azure Activity Log if a mismatch occurs. Crucially, the Azure Resource Manager engine does not halt the deployment pipeline or reject the API request, allowing developers and administrators to track governance deviations passively while maintaining operational velocity.

API-based integration with cloud providers.

API-based integration with cloud providers is essential because a centralized governance, risk, and compliance platform must continuously ingest resource configurations and telemetry across heterogeneous architectures without manual intervention. In an enterprise multi-cloud environment, static compliance assessments fail due to rapid resource churn; programmatic interfaces allow the platform to query provider control planes in real time, satisfying the critical requirement for dynamic visibility across disparate hyperscalers.

Integrated risk assessment workflow.

Centralising governance, risk, and compliance in a multi-cloud architecture requires automated mapping between distinct cloud provider APIs and compliance frameworks, a constraint satisfied by an integrated risk assessment workflow. This capability dynamically harmonises control evaluations across AWS, Google Cloud, and Microsoft Azure by triggering automated evidence collection and remediation tasks within a unified pipeline. Without this automated workflow, security teams cannot continuously validate posture against multi-tenant policy drift, rendering enterprise oversight fragmented and manual across hyperscale boundaries.

Automated mapping of controls to multiple standards.

Managing security posture across an enterprise multi-cloud environment requires continuous alignment against diverse regulatory frameworks such as NIST, ISO, and PCI-DSS. Automated mapping of controls to multiple standards directly satisfies the core constraint of multi-cloud complexity by dynamically translating a single implementation of a technical safeguard into continuous compliance evidence across all distinct frameworks. This capability eliminates manual audit overhead and policy duplication by establishing a unified control baseline that scales efficiently across heterogeneous cloud service providers without requiring bespoke configuration for each environment.

Microsoft Defender for Servers

Microsoft Defender for Servers satisfies the hybrid environment constraint by integrating Microsoft Defender for Cloud to deliver host-based intrusion detection systems alongside native file integrity monitoring. By deploying the Azure Monitor Agent or Log Analytics agent across both Azure and on-premises infrastructure, it continuously tracks registry changes, file modifications, and suspicious operating system activities. This unified architecture enables centralised security management and automated threat protection, directly fulfilling the requirement for integrated host-based monitoring across disparate deployment models.

AppArmor

AppArmor satisfies the requirement for mandatory access control by utilising path-based labels to restrict program capabilities. By associating security profiles with specific executable files, it enforces granular constraints on system resources, such as file access, network sockets, and capabilities. This kernel-level enforcement mechanism ensures that processes operate within defined security boundaries, effectively mitigating the risk of unauthorised actions and privilege escalation, which is essential when hardening a Linux-based server environment against potential threats.

SELinux

SELinux utilises the Linux Security Modules (LSM) framework to implement mandatory access control by enforcing fine-grained security policies based on labels assigned to processes and files. By requiring explicit policy definitions for every interaction, it prevents unauthorised subjects from accessing objects regardless of user permissions. This mechanism satisfies the stem’s constraint for kernel-level enforcement, as it operates within the kernel space to restrict system calls and resource access, ensuring that even root-level compromises remain contained within the defined security context.

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.

Gateway Load Balancer (GWLB) provides the most resilient design by transparently scaling a fleet of virtual appliances across multiple availability zones. By leveraging VPC Ingress Routing to redirect traffic through the GWLB endpoints, the architecture ensures that all inter-subnet packets are inspected without introducing single points of failure. This mechanism satisfies the requirement for a resilient, centralized inspection point, as the load balancer automatically handles health checks and traffic distribution, ensuring high availability for the security stack compared to static routing configurations.

Policy-Based Access Control (PBAC)

Policy-Based Access Control enables the granular access control required for a remote workforce by evaluating dynamic attributes—such as device health, geolocation, and user risk—rather than relying solely on static roles. By integrating these contextual variables into the authorisation decision, organisations can enforce precise, least-privilege policies at the application layer. When managed through Microsoft Entra ID, this mechanism ensures that access is continuously validated against real-time security constraints, effectively mitigating risks associated with remote connections to sensitive corporate resources.

Identity-Aware Proxy (IAP)

Identity-Aware Proxy (IAP) facilitates granular access control by intercepting connection requests and verifying user identity and context before granting access to specific applications. By shifting the security perimeter from the network level to the individual application, it satisfies the requirement for application-layer enforcement. It integrates seamlessly with Microsoft Entra ID to evaluate conditional access policies, ensuring that only authorised users can reach protected resources, thereby mitigating the risks inherent in a remote workforce environment.

Micro-segmentation

Micro-segmentation enables the granular access control required by the remote workforce by decoupling security policies from network topology and applying them directly to individual workloads or applications. By creating secure zones around specific services, it restricts lateral movement and ensures that access is granted based on identity and context rather than network location. This approach satisfies the requirement for application-layer enforcement, working in tandem with identity providers like Microsoft Entra ID to ensure that only authorised users reach specific, segmented resources.

NAT Gateway

A NAT Gateway resides in a public subnet and performs source NAT for outbound traffic originating in private subnets, allowing database instances to reach internet patch repositories. Return traffic cannot initiate inbound connections, satisfying the constraint that instances remain unreachable from the public internet.

Configure Istio with an mTLS PeerAuthentication policy.

Configuring Istio with a mutual TLS (mTLS) PeerAuthentication policy satisfies the strict constraint of encrypting local service-to-service communication without requiring any application code modifications. Istio achieves this transparently by injecting Envoy sidecar proxies into the application pods, which intercept network traffic at the infrastructure layer. These sidecars automatically negotiate and establish mTLS connections, enforcing zero-trust transport encryption across the hybrid environment while leaving the underlying software logic entirely untouched.

To evaluate access requests against defined security policies.

Evaluating access requests against defined security policies serves as the fundamental function of the Policy Decision Point within a Zero Trust architecture. By acting as the central authority, the PDP processes contextual signals—such as user identity, device health, and location—to determine whether to grant or deny access. This mechanism satisfies the constraint of centralised policy enforcement, ensuring that services like Microsoft Entra ID can consistently apply granular authorisation logic before any connection is established, thereby maintaining the principle of least privilege across the network.

CyberArk PSM (Privileged Session Manager)

CyberArk PSM acts as a secure proxy, establishing a remote session between the target resource and the end-user without transmitting the actual credentials to the local machine. By brokering the connection through a hardened jump server, the solution ensures that the password remains encrypted within the Vault. This mechanism satisfies the constraint that privileged credentials are never exposed to the end-user workstation, effectively mitigating the risk of credential theft or local caching, which is a common vulnerability when managing access via Microsoft Entra ID or traditional RDP clients.

Permission Sets

Permission Sets bundle AWS-managed or customer-managed IAM policies and assign them to users or groups per account, giving temporary, scoped elevated access without persistent credentials. This provides the granular, account-specific architectural control the stem requires for the developer.

nonce

The nonce claim binds the ID Token to the original authentication request; the application checks it matches the value it generated, rejecting replayed tokens. This directly satisfies the requirement to prevent token replay attacks in the OIDC flow.

Require device to be marked as compliant

Enforcing the "Require device to be marked as compliant" grant control directly satisfies the requirement to restrict access to managed, compliant devices. This mechanism leverages the device compliance state reported by Microsoft Intune to Microsoft Entra ID. When a user attempts to access a sensitive application, the policy evaluates the device's current compliance status against the defined security baselines. If the device fails to meet these criteria or is not registered as compliant, Microsoft Entra ID blocks the authentication request, ensuring only trusted hardware gains entry.

DPoP (Demonstrating Proof-of-Possession)

DPoP (Demonstrating Proof-of-Possession) satisfies the Zero Trust constraint of binding a token to a specific client instance by utilising an asymmetric cryptographic key pair generated locally by the client. When requesting a token, the client signs a Proof-of-Possession HTTP header using its private key, whilst the authorisation server registers the corresponding public key within the issued access token. Consequently, even if an adversary exfiltrates the bearer token, they cannot use it without possessing the client's private key, effectively neutralising token theft.