ISC Practice Test 1 — 10 Questions

Question 1

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 2

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Accepted Answer

Identify design-level security flaws. Threat modeling identifies design flaws and helps prioritize security investments.

Answer

Automate patch management

Answer

Perform penetration testing

Answer

Manage hardware inventory

Question 3

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 4

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

Accepted Answer

Organizational silos. Managing organizational silos and maintaining alignment with changing business needs are top challenges.

Answer

Cable length limitations

Answer

OS license costs

Answer

Lack of hardware vendors

Question 5

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Accepted Answer

Exchange the IdP's public signing certificate. For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

Answer

Configure the SP to use the NameID format

Answer

Exchange the SP's private key with the IdP

Answer

Enable encrypted assertions using the SP's public key

Question 6

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 7

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 8

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Accepted Answer

Implement an SSH Certificate Authority (CA) system.. Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.

Answer

Restrict SSH to a hardened bastion host.

Answer

Use a central password manager to rotate keys.

Answer

Require MFA for every single SSH connection.

Question 9

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 10

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.