ISC Practice Test 14 — 15 Questions

Question 1

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Accepted Answer

Centralized Governance. Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.

Answer

Ad-hoc Governance

Answer

Federated Governance

Answer

Decentralized Governance

Question 2

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 3

A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?

Accepted Answer

Deploy a PSM component in the target network segment. The PSM (Privileged Session Manager) acts as a proxy, allowing session recording and isolation without exposing the vault directly to the endpoint.

Answer

Install the CPM on the target workstations

Answer

Configure the Vault to use an external LDAP proxy

Answer

Deploy the PVWA directly in the DMZ

Question 4

You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?

Accepted Answer

UserInfo Endpoint. The UserInfo Endpoint is the correct OIDC endpoint to retrieve user information after obtaining an access token. It returns claims about the authenticated user when presented with a valid access token.

Answer

Token Endpoint

Answer

Authorization Endpoint

Answer

Discovery Endpoint

Question 5

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 6

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.

Question 7

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Accepted Answer

The PAM Vault/Secret Manager.. The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.

Answer

The MFA provider.

Answer

The jump server.

Answer

The session recorder.

Question 8

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Accepted Answer

Always verify explicitly.. Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.

Answer

Trust all internal network traffic.

Answer

Use static, long-lived access tokens.

Question 9

When using Google Cloud, which service is the primary point of integration for security policies to be applied across the entire organization hierarchy?

Accepted Answer

Organization Policy Service. The Organization Policy Service is the primary point of integration for security policies across the entire Google Cloud organization hierarchy. It allows administrators to define constraints that are inherited by all projects, folders, and resources under the organization node, ensuring consistent security posture. This service provides centralized control and is specifically designed to enforce policies at scale, unlike other services that focus on identity, logging, or resource metadata.

Answer

Google Cloud Identity

Answer

Cloud Logging

Answer

Cloud Resource Manager

Question 10

Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?

Accepted Answer

System Security Plan (SSP). The SSP is the primary document that details how security controls are met for a system.

Answer

Risk Assessment Report (RAR)

Answer

Plan of Action and Milestones (POA&M)

Answer

Authority to Operate (ATO)

Question 11

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

Accepted Answer

Mutual TLS (mTLS) with client certificates.. Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.

Answer

OAuth 2.0 Client Credentials flow.

Answer

HTTP Basic Authentication over HTTPS.

Answer

IP address filtering on the load balancer.

Question 12

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

Accepted Answer

Implement CI/CD pipeline security and IaC scanning.. Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.

Answer

Monitor CloudWatch logs for abnormal function execution.

Answer

Enable runtime application self-protection (RASP).

Answer

Regularly rotate the function's execution role.

Question 13

In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?

Accepted Answer

To standardize organizational processes. The Capability Maturity Model (CMM) provides a framework for assessing and improving the maturity of organizational processes across five levels, from ad hoc to optimized. Its primary goal in Enterprise Security Architecture is to standardize organizational processes so that security practices are repeatable, measurable, and continuously improving rather than dependent on individual heroics. This standardization enables consistent governance and predictable outcomes across the enterprise.

Answer

To reduce software defects

Answer

To purchase better hardware

Answer

To identify all existing threats

Question 14

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 15

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

Accepted Answer

COBIT 2019 Framework. COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.

Answer

ISO/IEC 27001

Answer

ITIL 4

Answer

NIST CSF