ISC Practice Test 10 — 10 Questions

Question 1

In a VMware NSX-T environment, you need to implement a 'Distributed Firewall' (DFW) policy that separates traffic based on the application tier regardless of which ESXi host the VM is running on. What is the primary object used to achieve this logical grouping?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NSX Groups. NSX-T Distributed Firewall policies are applied to NSX Groups, which are logical containers of VMs defined by dynamic criteria such as tags, VM names, or security groups. Because DFW enforcement happens at the vNIC level on each ESXi host, grouping by NSX Groups allows consistent tier-based rules (e.g., web, app, db) regardless of physical host placement. This decouples security policy from network topology.

Answer

VLAN ID

Answer

Logical Switch Port ID

Answer

Physical NIC MAC Address

Question 2

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 3

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Accepted Answer

Azure Key Vault. Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.

Answer

Azure Policy

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Monitor

Question 4

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 5

You are designing an OIDC implementation. An application needs to obtain user profile information without including it in the ID Token to keep the token size small. Which endpoint should the application call?

Accepted Answer

The UserInfo Endpoint. The UserInfo endpoint is the OIDC standard for fetching claims about the authenticated user using an Access Token.

Answer

The Authorization Endpoint

Answer

The Discovery Endpoint

Answer

The Token Endpoint

Question 6

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

Accepted Answer

AWS CloudFormation Guard. CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 7

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Accepted Answer

CyberArk PSM (Privileged Session Manager). CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.

Answer

CyberArk AIM (Application Identity Manager)

Answer

CyberArk EPM (Endpoint Privilege Manager)

Answer

CyberArk Vault Agent

Question 8

Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?

Accepted Answer

Specific application activities (e.g., file downloads).. CASBs monitor user location, device state, and the specific application activity (actions taken).

Answer

The user's home internet service provider.

Answer

The user's favorite website bookmarks.

Question 9

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 10

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Accepted Answer

Permission Sets. AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.

Answer

IAM User Inline Policies

Answer

Cross-account IAM Roles

Answer

IAM User Access Keys