ISC Practice Test 2 — 25 Questions

Question 1

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 2

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

Accepted Answer

Organizational maturity. Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.

Answer

Hardware vendor preference

Answer

Office location

Question 3

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 4

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 5

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 6

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 7

Which THREE of the following are indicators of a potential system compromise?

Accepted Answer

Unexpected outbound network traffic.. Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).

Answer

Normal user logons.

Answer

Scheduled system backups.

Question 8

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Accepted Answer

Verify explicitly. Zero Trust relies on explicit verification, least privilege, and assuming breach.

Answer

Trust but verify

Answer

Maximize perimeter defense

Question 9

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 10

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 11

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

Accepted Answer

To document differences between current state and requirements.. A gap analysis identifies where the current architecture deviates from the target compliance framework.

Answer

To reduce cloud costs.

Answer

To increase the migration speed.

Answer

To select the best cloud provider.

Question 12

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 13

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 14

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 15

When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?

Accepted Answer

AWS Config. AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.

Answer

AWS CloudFormation

Answer

AWS IAM

Answer

AWS Organizations

Question 16

What is the function of 'Token Introspection' in OAuth 2.0?

Accepted Answer

To allow a resource server to validate a token's status.. Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

Answer

To generate a new token for the client.

Answer

To map the user to a new role.

Answer

To refresh an expired token.

Question 17

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

Accepted Answer

To set security strategy and approve policy.. The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.

Answer

To write firewall rules.

Answer

To patch servers.

Answer

To conduct incident response drills.

Question 18

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 19

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 20

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).