ISC Practice Test 2 — 10 Questions

Question 1

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 2

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

Accepted Answer

Tenants. In Cisco ACI, security segmentation is enforced through the policy model built on Tenants (B), Contracts (C), and Endpoint Groups (D). Tenants (B) provide the logical container that isolates policy, routing, and security domains for different applications or business units within the fabric. Endpoint Groups (D) classify endpoints that share the same security and policy requirements, acting as the source/destination objects in the policy model. Contracts (C) define the permitted communication relationships between EPGs, specifying which protocols and ports are allowed, thereby enforcing segmentation between groups. Physical Port Security (A) is a Layer 2 switchport feature, not an ACI fabric segmentation construct, and VLAN Tagging (E) is a traditional network isolation mechanism that ACI abstracts away rather than using as a primary segmentation component.

Answer

Physical Port Security

Answer

VLAN Tagging

Question 3

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

Accepted Answer

Security Groups. Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.

Answer

AWS PrivateLink

Answer

AWS Transit Gateway Route Tables

Answer

Network Access Control Lists (NACLs)

Question 4

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Accepted Answer

Business attribute profiles. SABSA requires business requirements documentation and security service specifications.

Answer

Daily status reports

Answer

Employee payroll records

Answer

Project budget sheets

Question 5

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 6

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 7

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 8

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 9

Which component is the most critical to protect in a web-based architecture?

Accepted Answer

Database. The database is typically the primary target for attackers as it contains the sensitive data.

Answer

Web server

Answer

Load balancer

Answer

CSS files

Question 10

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.