ISC Practice Test 14 — 15 Questions

Question 1

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra ID (formerly Azure AD) Conditional Access policies are used to evaluate device compliance status before granting access to M365 resources.

Answer

SharePoint Online Admin Center

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 2

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 3

In the context of the CISSP-ISSAP, which architecture framework is most commonly used for federal government IT systems?

Accepted Answer

FEAF. FEAF (Federal Enterprise Architecture Framework) is the standard for US federal government agencies.

Answer

TOGAF

Answer

SABSA

Answer

Zachman Framework

Question 4

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 5

Which THREE of the following are considered 'Assets' in security architecture? (Select THREE)

Accepted Answer

Customer database. Assets include data, hardware, software, and intellectual property.

Answer

Janitorial services

Answer

Office light bulbs

Question 6

When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?

Accepted Answer

mTLS. mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.

Answer

API Keys

Answer

IP Whitelisting

Answer

Basic Auth

Question 7

When evaluating architectural threats, which THREE categories are explicitly defined in the STRIDE methodology? (Select THREE)

Accepted Answer

Tampering. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege.

Answer

Phishing

Answer

Malware Injection

Question 8

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Accepted Answer

Business attribute profiles. SABSA requires business requirements documentation and security service specifications.

Answer

Daily status reports

Answer

Employee payroll records

Answer

Project budget sheets

Question 9

Which component is the most critical to protect in a web-based architecture?

Accepted Answer

Database. The database is typically the primary target for attackers as it contains the sensitive data.

Answer

Web server

Answer

Load balancer

Answer

CSS files

Question 10

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 11

Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)

Accepted Answer

Detailed design diagrams. Auditors require the design itself (diagrams) and the security controls implemented to protect the assets.

Answer

Developer social security numbers

Answer

Vendor marketing brochures

Answer

Employee cafeteria menu

Question 12

An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?

Accepted Answer

Azure Key Vault. Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.

Answer

Azure Policy

Answer

Microsoft Entra ID Privileged Identity Management

Answer

Azure Monitor

Question 13

An ISSAP architect is designing a system that must be compliant with the General Data Protection Regulation (GDPR). Which THREE technical safeguards should be implemented to ensure data confidentiality?

Accepted Answer

Enforced TLS 1.2+ for data in transit.. GDPR mandates technical and organizational measures for protection, specifically confidentiality via encryption and access control.

Answer

Automated document printing services.

Answer

Daily physical site tours.

Question 14

You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?

Accepted Answer

Implement JSON Web Encryption (JWE).. PII should be encrypted within tokens (e.g., using JWE - JSON Web Encryption) or minimized in the token payload to meet privacy regulations.

Answer

Use JWT exclusively.

Answer

Use symmetric keys for all token signing.

Answer

Disable all claims in the token.

Question 15

A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?

Accepted Answer

AWS CloudFormation Guard. CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor