ISC Practice Exam 2 — 20 Questions

Question 1

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Accepted Answer

Setting allowPrivilegeEscalation to false in the SecurityContext. Option C is correct because setting allowPrivilegeEscalation to false in a container's SecurityContext prevents processes from gaining more privileges than their parent process, specifically blocking the setuid/setgid and file capability mechanisms that enable privilege escalation. Option D is correct because running containers as a non-root user (via runAsUser/runAsNonRoot in the SecurityContext) removes the default root privileges inside the container, so even if an attacker compromises the application, they lack the UID 0 capabilities needed to escalate. Option A is not a best practice for privilege escalation prevention; using a default Namespace for all workloads weakens isolation and RBAC scoping rather than restricting container privileges. Option B is unrelated, as increasing a pod's memory limit only affects resource allocation and has no bearing on privilege escalation. Option E is also unrelated, since enabling ClusterIP services merely exposes pods on an internal virtual IP for network access and does not affect container privilege levels.

Answer

Using a default Namespace for all workloads

Answer

Increasing the memory limit for pods

Answer

Enabling ClusterIP services

Question 2

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

Accepted Answer

COBIT. COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.

Answer

ITIL

Answer

NIST RMF

Answer

ISO/IEC 27005

Question 3

Which security principle is enforced when you restrict an application's ability to modify system files?

Accepted Answer

Least privilege. Least privilege means granting a subject only the minimum access rights necessary to perform its function — no more. Restricting an application from modifying system files enforces least privilege by removing write access the application does not need, thereby limiting the blast radius if the application is compromised. This is the canonical example of least privilege applied at the process/application level.

Answer

Defense in depth

Answer

Economy of mechanism

Answer

Complete mediation

Question 4

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 5

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Accepted Answer

Because it must be kept confidential on the backend server.. The client_secret is a confidential credential that authenticates the client application to the authorization server. It must remain on the backend server and never be exposed to the browser, because the browser is an untrusted environment where the secret could be intercepted or extracted. This is why C is correct.

Answer

Because the client secret is only used for PKCE.

Answer

Because the browser does not support SSL.

Answer

Because browsers block outbound requests with secrets.

Question 6

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 7

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

Accepted Answer

Organizational maturity. Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.

Answer

Hardware vendor preference

Answer

Office location

Question 8

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 9

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 10

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 11

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 12

Which THREE of the following are indicators of a potential system compromise?

Accepted Answer

Unexpected outbound network traffic.. Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).

Answer

Normal user logons.

Answer

Scheduled system backups.

Question 13

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Accepted Answer

Verify explicitly. Zero Trust relies on explicit verification, least privilege, and assuming breach.

Answer

Trust but verify

Answer

Maximize perimeter defense

Question 14

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 15

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 16

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

Accepted Answer

To document differences between current state and requirements.. A gap analysis identifies where the current architecture deviates from the target compliance framework.

Answer

To reduce cloud costs.

Answer

To increase the migration speed.

Answer

To select the best cloud provider.

Question 17

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 18

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 19

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 20

When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?

Accepted Answer

AWS Config. AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.

Answer

AWS CloudFormation

Answer

AWS IAM

Answer

AWS Organizations