ISC Practice Test 13 — 15 Questions

Question 1

You need to protect a legacy web application that cannot be patched. What is the best strategy?

Accepted Answer

Deploy a WAF to provide virtual patching.. Placing a Web Application Firewall (WAF) or an RASP solution in front of the application can filter malicious traffic before it reaches the vulnerable application.

Answer

Disable all logging.

Answer

Migrate the app to a new language.

Answer

Isolate the server on an isolated VLAN.

Question 2

Which TWO of the following are fundamental pillars of information security (CIA triad)?

Accepted Answer

Confidentiality.. The CIA triad consists of Confidentiality, Integrity, and Availability.

Answer

User Friendliness.

Answer

Cost effectiveness.

Answer

Performance.

Question 3

Which THREE of the following items should be addressed when designing a secure remote access architecture for a hybrid cloud environment using a VPN gateway?

Accepted Answer

AES-256 encryption for the IKE/IPsec tunnel. A secure design requires robust authentication (MFA), transport security (encryption), and granular authorization (least privilege).

Answer

Public IP address assignment for all internal nodes

Answer

Disabling logging to reduce overhead

Question 4

In the TOGAF ADM, which TWO phases are most critical for security architecture integration? (Select TWO)

Accepted Answer

Opportunities and Solutions. Phase A (Vision) and Phase E (Opportunities and Solutions) are where security requirements are integrated and evaluated.

Answer

Requirements Management

Answer

Preliminary Phase

Answer

Implementation Governance

Question 5

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

Accepted Answer

Automated Policy-as-Code scanning in the CI/CD pipeline.. Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.

Answer

Only allow senior architects to deploy resources.

Answer

Relying on developers to perform self-audits.

Answer

Manual code review of all commits.

Question 6

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 7

Which THREE of the following are components of a defense-in-depth strategy?

Accepted Answer

Network-based IDS/IPS.. Defense-in-depth uses layers of security including host, network, and application controls.

Answer

Allowing all traffic on all ports.

Answer

Ignoring all logs.

Question 8

Which type of diagram is used to represent the different zones in an architecture?

Accepted Answer

Trust Boundary Diagram. A trust boundary diagram or network architecture diagram is used to illustrate security zones.

Answer

Sequence diagram

Answer

Class diagram

Answer

Activity diagram

Question 9

Which THREE of the following are critical for a secure identity architecture?

Accepted Answer

Enforcing Multi-Factor Authentication (MFA).. Multi-factor authentication, least privilege, and robust auditing are required for identity security.

Answer

Sharing accounts between users.

Answer

Using passwords as the only factor.

Question 10

You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?

Accepted Answer

Vulnerability Protection Profile. Vulnerability protection profiles allow for specific signatures to be applied to block SQL injection attempts at the application layer.

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Answer

App-ID based policy enforcement

Question 11

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

Accepted Answer

Microsoft Threat Modeling Tool. Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap

Question 12

A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?

Accepted Answer

User Rights Assignment: Deny log on through Remote Desktop Services. Restricted Groups or the newer 'Group Policy Preferences > Local Users and Groups' can be used, but specifically, to mitigate lateral movement, 'Deny log on through Remote Desktop Services' is the standard hardening control for local admins.

Answer

Minimum Password Length

Answer

Audit Logon Events

Answer

Account Lockout Threshold

Question 13

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 14

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

Accepted Answer

Motivation. The 'Why' column in the Zachman Framework is the 'Motivation' column, which focuses on business goals and security drivers.

Answer

Data

Answer

Function

Answer

Time

Question 15

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults