ISC Practice Exam 1 — 20 Questions

Question 1

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 2

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

Accepted Answer

To document differences between current state and requirements.. A gap analysis identifies where the current architecture deviates from the target compliance framework.

Answer

To reduce cloud costs.

Answer

To increase the migration speed.

Answer

To select the best cloud provider.

Question 3

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 4

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 5

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Accepted Answer

Use of a 'nonce' in the OIDC request.. DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

Answer

Storing tokens in client-side cookies.

Answer

Disabling all token refresh capabilities.

Answer

Using long-lived access tokens.

Question 6

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 7

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 8

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 9

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 10

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

Accepted Answer

Vendor's SOC2 Type II report.. TPRM requires understanding the vendor's security posture before onboarding.

Answer

Vendor's physical office decor.

Answer

Vendor's marketing language.

Question 11

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 12

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 13

Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?

Accepted Answer

Centralized Governance. Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.

Answer

Ad-hoc Governance

Answer

Federated Governance

Answer

Decentralized Governance

Question 14

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 15

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests against defined security policies.. The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

Answer

To manage user identities in the directory.

Answer

To log all access attempts for compliance.

Answer

To intercept and inspect network packets.

Question 16

An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?

Accepted Answer

Infrastructure tags and cloud policy enforcement. Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.

Answer

Database schema constraints

Answer

Container image manifests

Answer

Application service mesh proxy tags

Question 17

You are designing an Azure AD (Entra ID) Conditional Access policy to restrict access to sensitive applications. You need to ensure that only compliant, managed devices can access the resource. Which Grant control must be configured?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' control enforces that the device must be registered in Intune and meet all defined compliance policies before access is granted.

Answer

Require password change

Answer

Require approved client app

Answer

Require hybrid Azure AD joined device

Question 18

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 19

In the context of the CISSP-ISSAP, which governance activity involves verifying that the architecture aligns with business requirements through regular audits?

Accepted Answer

Compliance Monitoring. Compliance Monitoring is the governance activity that ensures the implemented system remains aligned with business requirements and regulatory standards.

Answer

Threat Modeling

Answer

Risk Acceptance

Answer

Architecture Peer Review

Question 20

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.