ISC Practice Test 17 — 15 Questions

Question 1

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Accepted Answer

Because it must be kept confidential on the backend server.. The client secret is a shared secret between the Authorization Server and the application. If exposed to the browser, it can be easily extracted and used by attackers to impersonate the client.

Answer

Because the client secret is only used for PKCE.

Answer

Because the browser does not support SSL.

Answer

Because browsers block outbound requests with secrets.

Question 2

Which document is the primary deliverable of the TOGAF 'Architecture Definition Document'?

Accepted Answer

Architecture Definition Document. The ADD is the main container for all architectural descriptions and documentation.

Answer

Gap Analysis

Answer

Security Policy

Answer

Risk Register

Question 3

You are configuring an AWS IAM policy to allow a user to list S3 buckets only if they are connected from a specific IP range. Which policy element is required?

Accepted Answer

Condition: { "IpAddress": { "aws:SourceIp": "..." } }. The 'Condition' block is used to enforce context-based restrictions, such as 'aws:SourceIp', within an IAM policy.

Answer

Effect: Deny

Answer

Resource: *

Answer

Action: s3:ListBucket

Question 4

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

Accepted Answer

Stateful Failover (Failover Link). The Cisco Failover Link is used to synchronize the state table, session information, and configuration between the active and standby units.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 5

An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?

Accepted Answer

Azure Storage Firewalls and Virtual Networks. Virtual Network service endpoints or Azure Private Link allow for restricted network access, preventing data exfiltration to the public internet.

Answer

Azure AD Conditional Access

Answer

Azure Policy

Answer

Azure Bastion

Question 6

When designing a secure cloud architecture, which TWO security services are essential for identity and access management? (Select TWO)

Accepted Answer

Role-Based Access Control. IAM requires robust policy enforcement and federation for secure access.

Answer

Physical security

Answer

Packet inspection

Answer

Data backup

Question 7

What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?

Accepted Answer

ABAC provides more granular control using environmental and resource attributes.. ABAC uses dynamic attributes (user, environment, resource) to make fine-grained decisions, whereas RBAC relies on static assignments of users to roles.

Answer

ABAC eliminates the need for an Identity Provider.

Answer

ABAC relies exclusively on user hierarchy.

Answer

ABAC is faster to implement.

Question 8

You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?

Accepted Answer

UserInfo Endpoint. The UserInfo endpoint (defined in the OIDC discovery metadata) is used to retrieve claims about the authenticated user using an access token.

Answer

Token Endpoint

Answer

Authorization Endpoint

Answer

Discovery Endpoint

Question 9

You are auditing an OAuth 2.0 implementation. You discover that the application uses the 'Implicit Grant' flow. Why is this considered an architectural security weakness?

Accepted Answer

It exposes access tokens in the browser URL.. The Implicit Grant returns access tokens directly in the URL fragment, which is susceptible to browser history leaks, referrer header exposure, and interception via malicious extensions.

Answer

It requires the client secret to be stored on the client side.

Answer

It relies on symmetric encryption for all token exchanges.

Answer

It does not support refresh tokens, limiting usability.

Question 10

Which TWO security properties are provided by modern 'Passwordless' architectures?

Accepted Answer

Elimination of shared secrets.. FIDO2/WebAuthn eliminates shared secrets (passwords) and provides phishing resistance via origin binding.

Answer

Automatic network-level encryption.

Answer

Guaranteed anonymity for users.

Answer

Universal support for all legacy applications.

Question 11

What is the purpose of 'JWT Validation' on a resource server?

Accepted Answer

To ensure the token is authentic and valid.. Validation ensures that the JWT is authentic (signature check), has not expired (exp claim), and was issued by a trusted entity (iss claim) before granting access.

Answer

To encrypt the token payload.

Answer

To store the user's session data.

Answer

To generate a new token.

Question 12

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

Accepted Answer

Automated security assessment. SCAP provides a standardized way to automate security vulnerability management and configuration assessment.

Answer

Firewall management

Answer

Access control

Answer

Encryption

Question 13

You are designing an OIDC implementation. An application needs to obtain user profile information without including it in the ID Token to keep the token size small. Which endpoint should the application call?

Accepted Answer

The UserInfo Endpoint. The UserInfo endpoint is the OIDC standard for fetching claims about the authenticated user using an Access Token.

Answer

The Authorization Endpoint

Answer

The Discovery Endpoint

Answer

The Token Endpoint

Question 14

Which THREE components are typically included in an Enterprise Security Architecture (ESA) framework? (Select THREE)

Accepted Answer

Security Reference Architecture. ESA frameworks require governance, a design methodology, and a component reference library.

Answer

Help Desk Ticket Log

Answer

Hardware Inventory

Question 15

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Accepted Answer

Setting allowPrivilegeEscalation to false in the SecurityContext. To prevent escalation, you must restrict the container's ability to run as root and prevent it from gaining additional privileges that were not granted at start-up.

Answer

Using a default Namespace for all workloads

Answer

Increasing the memory limit for pods

Answer

Enabling ClusterIP services