ISC Practice Test 12 — 15 Questions

Question 1

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 2

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

Accepted Answer

Setting the 'Secure' and 'HttpOnly' flags.. The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.

Answer

Enabling HTTP/2.

Answer

Increasing cookie expiration time.

Answer

Disabling session persistence.

Question 3

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Accepted Answer

Always verify explicitly.. Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.

Answer

Trust all internal network traffic.

Answer

Use static, long-lived access tokens.

Question 4

Which THREE of the following are best practices for securing a remote worker's endpoint?

Accepted Answer

EDR solution for threat monitoring.. Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.

Answer

Disabling the lock screen.

Answer

Using a shared local account.

Question 5

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Accepted Answer

Implement an SSH Certificate Authority (CA) system.. Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.

Answer

Restrict SSH to a hardened bastion host.

Answer

Use a central password manager to rotate keys.

Answer

Require MFA for every single SSH connection.

Question 6

When using the 'Trike' methodology for threat modeling, which of the following is the main focus?

Accepted Answer

Risk management and balancing. Trike focuses on ensuring the risk management process is balanced between security, reliability, and functionality.

Answer

Network perimeter defense

Answer

Code vulnerability discovery

Answer

Attack simulation

Question 7

To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?

Accepted Answer

Hardware-enforced isolation and constant-time execution paths.. Constant Time (CT) instructions and hardware-based mitigations like Intel SGX or isolation features prevent information leakage through timing side-channels.

Answer

Unified Extensible Firmware Interface (UEFI) Secure Boot.

Answer

PCIe bus encryption.

Answer

Trusted Platform Module (TPM) 2.0

Question 8

Which of the following is the most effective way to secure a remote access connection for employees?

Accepted Answer

VPN with Multi-Factor Authentication (MFA).. A VPN using MFA provides both encryption for the transit path and strong verification of user identity.

Answer

Using a simple password.

Answer

Allowing SSH access directly from the internet.

Answer

Opening RDP port 3389 to the world.

Question 9

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.

Question 10

Which THREE elements are essential to define a trust boundary? (Select THREE)

Accepted Answer

Different access privileges. A trust boundary is defined by the transition between levels of access, authentication, or network zones.

Answer

Operating system type

Answer

Hardware vendor

Question 11

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Accepted Answer

Deploy to a pilot group in 'Audit Mode' first.. Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.

Answer

Push a mass deployment with blocking enabled immediately.

Answer

Manually install the agent on every endpoint.

Answer

Exempt all legacy applications from EDR monitoring.

Question 12

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

Accepted Answer

Security Groups. Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.

Answer

AWS PrivateLink

Answer

AWS Transit Gateway Route Tables

Answer

Network Access Control Lists (NACLs)

Question 13

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Accepted Answer

It verifies the integrity and origin of DNS responses.. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.

Answer

It hides DNS queries from ISP monitoring.

Answer

It prevents DDoS attacks against DNS servers.

Answer

It increases the speed of DNS resolution.

Question 14

What is the primary function of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a blueprint for security design. SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.

Answer

To manage incidents

Answer

To configure firewalls

Answer

To identify vulnerabilities

Question 15

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

Accepted Answer

Implementing Multi-Factor Authentication (MFA).. Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.

Answer

Limiting the password character set.

Answer

Increasing the session timeout.

Answer

Implementing a strong password policy.