ISC Practice Exam 2 — 20 Questions

Question 1

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

Accepted Answer

COBIT. COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.

Answer

ITIL

Answer

NIST RMF

Answer

ISO/IEC 27005

Question 2

When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?

Accepted Answer

AWS Config. AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.

Answer

AWS CloudFormation

Answer

AWS IAM

Answer

AWS Organizations

Question 3

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 4

Which authentication factor is considered 'inherence'?

Accepted Answer

A fingerprint scan.. Inherence factors are based on something the user is, such as biometrics (fingerprint, iris scan, facial recognition).

Answer

A strong passphrase.

Answer

A one-time password (OTP).

Answer

A hardware security key.

Question 5

What is the function of 'Token Introspection' in OAuth 2.0?

Accepted Answer

To allow a resource server to validate a token's status.. Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

Answer

To generate a new token for the client.

Answer

To map the user to a new role.

Answer

To refresh an expired token.

Question 6

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Accepted Answer

Exposure of static, long-lived credentials.. Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

Answer

Incompatible authentication protocols.

Answer

Network latency during authentication.

Answer

Lack of granular auditing of privileged actions.

Question 7

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.

Question 8

In a SAML 2.0 federation architecture, the Service Provider (SP) returns a 403 error during the assertion consumption phase. After verifying the digital signature, what is the most likely cause?

Accepted Answer

Subject NameID mismatch. If the signature is valid but access is denied, the NameID or attributes in the assertion often do not match the expected user mapping or authorization requirements at the SP.

Answer

Encryption algorithm mismatch

Answer

Expired metadata

Answer

Assertion Consumer Service (ACS) URL mismatch

Question 9

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Accepted Answer

To federate identity between on-premises and cloud environments.. An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Answer

To store user passwords in a central vault.

Answer

To enforce network firewall rules.

Answer

To perform real-time user activity monitoring.

Question 10

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 11

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

Accepted Answer

Using a cloud provider's Secret Management service.. Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.

Answer

Hardcoding them in a secure configuration file.

Answer

Storing them in Git using an encrypted file.

Answer

Passing them as command-line arguments at runtime.

Question 12

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Accidental public access.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Cloud provider outage.

Answer

Excessive bandwidth usage.

Question 13

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

Accepted Answer

To set security strategy and approve policy.. The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.

Answer

To write firewall rules.

Answer

To patch servers.

Answer

To conduct incident response drills.

Question 14

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 15

What is the primary risk of 'Standing Privileges'?

Accepted Answer

They increase the attack surface by allowing 24/7 access.. Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.

Answer

They are too difficult to configure.

Answer

They are not compatible with cloud IAM.

Answer

They prevent MFA from working correctly.

Question 16

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Accepted Answer

Private claims (custom app-specific claims).. Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

Answer

Hardware serial number claims.

Answer

Root password claims.

Question 17

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 18

What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?

Accepted Answer

To facilitate communication between technical teams and audit.. A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.

Answer

To update firewall configurations.

Answer

To perform penetration testing.

Answer

To manage the budget for security projects.

Question 19

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Accepted Answer

SCIM. SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 20

What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?

Accepted Answer

It restricts the level of access granted to the client application.. Scopes limit the permissions (actions and resources) associated with a specific token, ensuring that if a token is compromised, the attacker's capabilities are restricted.

Answer

It enables automatic token rotation.

Answer

It eliminates the need for MFA.

Answer

It reduces the size of the token.