ISC Practice Test 10 — 10 Questions

Question 1

Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?

Accepted Answer

Automated de-provisioning upon employment termination.. Automated provisioning, role-based access assignment, and automated de-provisioning are pillars of IAM LCM.

Answer

Static account creation without audits.

Answer

Manual password resets via email.

Question 2

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

Accepted Answer

Security Groups. Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.

Answer

MAC Sets

Answer

Logical Ports

Answer

IP Sets

Question 3

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

Accepted Answer

Mutual TLS (mTLS) with client certificates.. Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.

Answer

OAuth 2.0 Client Credentials flow.

Answer

HTTP Basic Authentication over HTTPS.

Answer

IP address filtering on the load balancer.

Question 4

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Accepted Answer

Client SSL Profile. A Client SSL profile is required on the Virtual Server to handle the decryption of traffic from the client.

Answer

Server SSL Profile

Answer

SNAT Pool

Answer

iRule

Question 5

Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?

Accepted Answer

Specific application activities (e.g., file downloads).. CASBs monitor user location, device state, and the specific application activity (actions taken).

Answer

The user's home internet service provider.

Answer

The user's favorite website bookmarks.

Question 6

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.

Question 7

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

Accepted Answer

API Schema Validation (OpenAPI/Swagger).. BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.

Answer

SQL injection filtering.

Answer

DDoS rate limiting.

Answer

Geo-blocking.

Question 8

Which THREE components are involved in a standard OIDC authentication flow?

Accepted Answer

End User. The End User, the Relying Party (RP/Client), and the OpenID Provider (OP/IdP) are the standard actors in the OIDC flow.

Answer

Certificate Authority (CA)

Answer

DNS Server

Question 9

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

Accepted Answer

AWS App Mesh with Envoy sidecars. AWS App Mesh provides application-level networking, allowing for service-to-service communication control using mutual TLS (mTLS) and fine-grained traffic routing independent of IP addresses.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security Groups for Pods

Question 10

What is the primary security goal of an 'Air-Gapped' network segment?

Accepted Answer

To eliminate the possibility of remote network-based exploitation.. Total physical isolation ensures that no network traffic can enter or leave the segment, protecting critical systems from remote attacks.

Answer

To increase network bandwidth.

Answer

To simplify patch management.

Answer

To improve log collection.