ISC Practice Test 15 — 15 Questions

Question 1

Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?

Accepted Answer

System Security Plan (SSP). The SSP is the primary document that details how security controls are met for a system.

Answer

Risk Assessment Report (RAR)

Answer

Plan of Action and Milestones (POA&M)

Answer

Authority to Operate (ATO)

Question 2

You are implementing Zero Trust Network Access (ZTNA) using Zscaler Private Access (ZPA). Which component is responsible for the actual interception and brokering of the connection between the user and the private application?

Accepted Answer

Zscaler Cloud Broker. The Zscaler App Connector initiates an outbound-only connection to the Zscaler cloud, where the ZPA broker connects the user to the application without exposing the application to the internet.

Answer

Zscaler Client Connector

Answer

Zscaler App Connector

Answer

Zscaler Central Authority

Question 3

An ISSAP architect is designing a multi-region deployment on AWS. To ensure data sovereignty compliance for GDPR, which S3 configuration strategy must be enforced using Service Control Policies (SCPs)?

Accepted Answer

Enforce s3:RequestedRegion in a Deny statement.. Using 's3:RequestedRegion' in an SCP allows for the restriction of bucket creation to specific geographic regions, which is a common requirement for data sovereignty.

Answer

Enable S3 Object Lock in compliance mode.

Answer

Utilize S3 Access Points per region.

Answer

Configure S3 Cross-Region Replication with filter.

Question 4

Which document is the primary foundational document in the COBIT framework that provides a governance perspective on how information technology should support business objectives?

Accepted Answer

COBIT 2019 Framework. COBIT 2019 Framework: Governance and Management Objectives is the primary document outlining business alignment.

Answer

ISO/IEC 27001

Answer

ITIL 4

Answer

NIST CSF

Question 5

A healthcare provider is deploying a multi-tenant application on GCP. To comply with data isolation requirements, which service should the architect use to ensure traffic between VPCs is strictly governed by network policy?

Accepted Answer

VPC Service Controls. VPC Service Controls provides a security perimeter that prevents data exfiltration and enforces strict network boundary compliance in GCP.

Answer

Cloud Interconnect

Answer

Shared VPC

Answer

Cloud Armor

Question 6

An architect is deploying a global application and needs to ensure that all HTTP traffic is redirected to HTTPS. Which service in AWS should be used to enforce this compliance globally?

Accepted Answer

Amazon CloudFront Viewer Protocol Policy. AWS WAF (Web Application Firewall) attached to CloudFront can enforce protocols, but the most direct way to enforce HTTPS at the edge is via CloudFront Viewer Protocol Policy.

Answer

Route 53

Answer

AWS Certificate Manager

Answer

AWS Shield

Question 7

When using Google Cloud, which service is the primary point of integration for security policies to be applied across the entire organization hierarchy?

Accepted Answer

Organization Policy Service. Organization Policy Service allows for hierarchical policy enforcement across projects and folders.

Answer

Google Cloud Identity

Answer

Cloud Logging

Answer

Cloud Resource Manager

Question 8

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Separation of duties via multi-party approval in the pipeline prevents a single compromised account from pushing code to production.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest

Question 9

An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?

Accepted Answer

AWS CloudHSM. Using an external HSM (Hardware Security Module) like AWS CloudHSM ensures that administrators of the cloud infrastructure have no access to the keys, fulfilling the separation of duties requirement.

Answer

Client-Side Encryption with local storage

Answer

Azure Key Vault

Answer

AWS KMS with Multi-Region keys

Question 10

Which security principle is enforced when you restrict an application's ability to modify system files?

Accepted Answer

Least privilege. Least privilege ensures that the application has only the permissions required for its function, preventing system-wide modifications.

Answer

Defense in depth

Answer

Economy of mechanism

Answer

Complete mediation

Question 11

In the context of TOGAF, what is the 'Architecture Repository' used for?

Accepted Answer

Managing architectural artifacts. The repository acts as a central library for all architectural work products, models, and design patterns.

Answer

Storing source code

Answer

Logging security events

Answer

Defining business requirements

Question 12

When designing a privileged access management (PAM) solution using CyberArk, you must ensure that privileged credentials are never exposed to the end-user workstation. Which feature facilitates this?

Accepted Answer

CyberArk PSM (Privileged Session Manager). CyberArk PSM (Privileged Session Manager) provides an isolated 'jump' environment where the session is proxied, keeping the actual target credentials hidden from the end-user.

Answer

CyberArk AIM (Application Identity Manager)

Answer

CyberArk EPM (Endpoint Privilege Manager)

Answer

CyberArk Vault Agent

Question 13

You are designing a reference architecture for a cloud environment. Which NIST document provides the most relevant framework for cloud security architecture?

Accepted Answer

NIST SP 800-144. NIST SP 800-144 is the standard reference for cloud computing security and architecture guidelines.

Answer

NIST SP 800-30

Answer

NIST SP 800-53

Answer

NIST SP 800-160

Question 14

You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?

Accepted Answer

Permission Sets. AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.

Answer

IAM User Inline Policies

Answer

Cross-account IAM Roles

Answer

IAM User Access Keys

Question 15

When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?

Accepted Answer

Defense in depth. Defense in depth ensures that if one layer fails, others remain to protect the system.

Answer

Separation of duties

Answer

Principle of Least Privilege

Answer

Fail-safe defaults