ISC Practice Test 2 — 10 Questions

Question 1

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 2

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 3

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Accepted Answer

Centralized Governance. Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.

Answer

Ad-hoc Governance

Answer

Federated Governance

Answer

Decentralized Governance

Question 4

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 5

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests against defined security policies.. The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

Answer

To manage user identities in the directory.

Answer

To log all access attempts for compliance.

Answer

To intercept and inspect network packets.

Question 6

An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?

Accepted Answer

Infrastructure tags and cloud policy enforcement. Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.

Answer

Database schema constraints

Answer

Container image manifests

Answer

Application service mesh proxy tags

Question 7

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.

Answer

Require password change

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 8

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 9

In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?

Accepted Answer

Compliance Monitoring. Compliance Monitoring is the governance activity that ensures the implemented system remains aligned with business requirements and regulatory standards.

Answer

Threat Modeling

Answer

Risk Acceptance

Answer

Architecture Peer Review

Question 10

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.