ISC Practice Exam 4 — 20 Questions

Question 1

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

Accepted Answer

Use the Azure Policy add-on for Kubernetes to enforce an 'Allowed Container Images' policy.. Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.

Answer

Assign RBAC roles to all developers to prevent image pull actions.

Answer

Modify the Kubelet configuration files directly on the nodes.

Answer

Configure the Azure CLI to deny access to unauthorized ACR registries.

Question 2

Which THREE of the following are common network security architecture tools?

Accepted Answer

Intrusion Detection System (IDS).. Firewalls, IDS/IPS, and VPNs are foundational components of a secure network architecture.

Answer

Unencrypted Telnet.

Answer

Cleartext FTP server.

Question 3

An architect is designing an OAuth 2.0 implementation for a mobile application. To prevent authorization code injection attacks, which specific configuration must be enforced in the client registration?

Accepted Answer

Enable Proof Key for Code Exchange (PKCE) enforcement. PKCE (Proof Key for Code Exchange) is the standard defense against authorization code interception attacks in public clients, replacing the need for a client secret.

Answer

Set a short expiration time for the client_secret

Answer

Require signed JWTs for the request object

Answer

Implement Mutual TLS (mTLS) for the token endpoint

Question 4

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 5

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

Accepted Answer

Use a Hardware Security Module (HSM).. Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.

Answer

Encrypt the keys with a password and store them in the database.

Answer

Hardcode keys into the application environment variables.

Answer

Store keys in a configuration file on the database server.

Question 6

Which TWO concepts are central to 'Federated Identity'?

Accepted Answer

A centralized Identity Provider (IdP).. A central Identity Provider (IdP) and the establishment of 'Trust' between organizations are the core concepts of federation.

Answer

The requirement for the same OS on all servers.

Answer

The use of a shared local database on each server.

Answer

Public IP address matching.

Question 7

Which architectural principle is fundamental to implementing Zero Trust in a microservices environment?

Accepted Answer

Micro-segmentation with identity-based access control. Zero Trust assumes the network is compromised, requiring explicit verification for every request, typically via identity-based micro-segmentation.

Answer

VPN-based remote access

Answer

Implicit trust for internal traffic

Answer

Perimeter-based firewalling

Question 8

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

Accepted Answer

Use Row-Level Security (RLS) within the database engine.. Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.

Answer

Use separate VPCs for every tenant.

Answer

Implement application-level filtering in the code.

Answer

Create separate database instances for every single tenant.

Question 9

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

Accepted Answer

TLS-encrypted logging stream.. Syslog-ng or TLS-based transport ensures that logs are encrypted in transit and can be digitally signed to prevent tampering by an attacker.

Answer

Cleartext HTTP.

Answer

UDP Syslog.

Answer

SNMP v1.

Question 10

Which TWO components are critical for an identity-centric Zero Trust architecture?

Accepted Answer

Policy Decision Point (PDP).. A central Identity Provider (IdP) and a Policy Decision Point (PDP) are the structural heart of a ZT identity architecture.

Answer

A standard network firewall.

Answer

Public IP address allow-listing.

Answer

A localized directory service without replication.

Question 11

A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?

Accepted Answer

Deploy a PSM component in the target network segment. The PSM (Privileged Session Manager) acts as a proxy, allowing session recording and isolation without exposing the vault directly to the endpoint.

Answer

Install the CPM on the target workstations

Answer

Configure the Vault to use an external LDAP proxy

Answer

Deploy the PVWA directly in the DMZ

Question 12

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 13

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

Accepted Answer

Implement CI/CD pipeline security and IaC scanning.. Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.

Answer

Monitor CloudWatch logs for abnormal function execution.

Answer

Enable runtime application self-protection (RASP).

Answer

Regularly rotate the function's execution role.

Question 14

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 15

When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?

Accepted Answer

Use an Identity-Aware Proxy (IAP).. An Identity-Aware Proxy (IAP) can act as a modern authentication frontend for legacy apps, handling the modern auth flow and passing the identity to the backend via headers or Kerberos.

Answer

Only allow access via VPN.

Answer

Rewrite the application source code.

Answer

Disable authentication for these apps.

Question 16

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 17

When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?

Accepted Answer

Verifying the audience (aud) claim. Validating the token signature and checking the audience claim are the two most critical steps to prevent token spoofing or replay attacks.

Answer

Configuring the IdP to use weak hashing algorithms

Answer

Allowing all claims to be processed without filtering

Answer

Ignoring timestamp validation to avoid clock skew

Question 18

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 19

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 20

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)

Accepted Answer

Decision Status. ADRs need to document the decision, the context, and the consequences of the decision.

Answer

Personal performance review

Answer

Budget approval code