ISC Practice Test 11 — 15 Questions

Question 1

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Accepted Answer

Govern. NIST CSF 2.0 (released February 2024) introduced the new 'Govern' function as its sixth core function, elevating governance from a category within Identify to a standalone function. Govern explicitly addresses organizational context, risk management strategy, roles and responsibilities, and — critically — supply chain risk management (GV.SC category). This reflects the recognition that third-party and supply chain risk must be governed at the leadership level rather than treated as a sub-activity of Identify.

Answer

Identify

Answer

Respond

Answer

Protect

Question 2

Which TWO types of certificates are used in a standard mTLS implementation?

Accepted Answer

Server Certificate.. mTLS requires both a Server Certificate (to verify the server identity) and a Client Certificate (to verify the client identity).

Answer

Root CA Certificate only.

Answer

Public SSH Key.

Answer

Self-signed user password.

Question 3

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Accepted Answer

Deploy to a pilot group in 'Audit Mode' first.. Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.

Answer

Push a mass deployment with blocking enabled immediately.

Answer

Manually install the agent on every endpoint.

Answer

Exempt all legacy applications from EDR monitoring.

Question 4

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 5

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 6

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults

Question 7

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Accepted Answer

Permissions should be granted based on the user's job role and the specific resources needed.. PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.

Answer

All users should have read access to the root directory.

Answer

Administrators should have full control over all cloud resources.

Answer

Roles should be static and never changed to ensure stability.

Question 8

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 9

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Accepted Answer

To redirect the user to a specific resource after authentication.. RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

Answer

To provide the assertion signature.

Answer

To define the authentication method.

Answer

To encrypt the NameID.

Question 10

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 11

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Accepted Answer

To federate identity between on-premises and cloud environments.. An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Answer

To store user passwords in a central vault.

Answer

To enforce network firewall rules.

Answer

To perform real-time user activity monitoring.

Question 12

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Accepted Answer

Granular Role-Based Access Control (RBAC). Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

Answer

Automatic network topology mapping

Answer

Public cloud storage for logs

Question 13

Which THREE of the following are best practices for securing a remote worker's endpoint?

Accepted Answer

EDR solution for threat monitoring.. Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.

Answer

Disabling the lock screen.

Answer

Using a shared local account.

Question 14

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Accepted Answer

Implementing Network Policies to restrict pod communication.. Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.

Answer

Exposing the Kube API to the public internet.

Answer

Running all pods with root privileges.

Answer

Disabling RBAC.

Question 15

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.