ISC Practice Exam 3 — 20 Questions

Question 1

To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Artifact

Question 2

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Accepted Answer

To redirect the user to a specific resource after authentication.. RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

Answer

To provide the assertion signature.

Answer

To define the authentication method.

Answer

To encrypt the NameID.

Question 3

Which TWO factors are mandatory for a secure 'MFA' implementation?

Accepted Answer

Validation of multiple independent credentials.. MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).

Answer

Exclusion of any knowledge-based factors.

Answer

The use of a proprietary hardware token only.

Answer

The use of only biometric factors.

Question 4

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 5

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Accepted Answer

Device security posture. Zero Trust evaluates the context of the user, the device, and the resource being accessed to make a dynamic decision.

Answer

User's physical office desk number

Answer

The color of the device chassis

Question 6

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 7

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 8

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 9

Which TWO of the following are essential for protecting against SQL Injection?

Accepted Answer

Using parameterized queries (prepared statements).. Prepared statements and input validation are the primary defenses against SQLi.

Answer

Using dynamic SQL building in code.

Answer

Disabling error logging entirely.

Answer

Running the database as root.

Question 10

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 11

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Accepted Answer

The PAM Vault/Secret Manager.. The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.

Answer

The MFA provider.

Answer

The jump server.

Answer

The session recorder.

Question 12

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Accepted Answer

Granular Role-Based Access Control (RBAC). Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

Answer

Automatic network topology mapping

Answer

Public cloud storage for logs

Question 13

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 14

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 15

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.

Question 16

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 17

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Accepted Answer

Exchange the IdP's public signing certificate. For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

Answer

Configure the SP to use the NameID format

Answer

Exchange the SP's private key with the IdP

Answer

Enable encrypted assertions using the SP's public key

Question 18

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 19

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Accepted Answer

Implementing PKCE (Proof Key for Code Exchange).. HTTPS (transport security), PKCE (binding code to request), and short-lived tokens/codes are standard security measures.

Answer

Storing the code in a public client's local storage.

Answer

Sending the code in the URL fragment of a redirect.

Question 20

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion