ISC Practice Test 3 — 25 Questions

Question 1

Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?

Accepted Answer

Validation of JWT/Auth tokens at the gateway.. Rate limiting (DDoS protection), authentication validation (at the edge), and logging (audit) are standard API Gateway security controls.

Answer

Disabling all logging for performance.

Answer

Allowing all traffic from any source IP.

Question 2

Which component of an architecture document defines the communication standards between services?

Accepted Answer

Interface specification. The Interface Specification or API design document defines how services communicate.

Answer

System overview

Answer

Data dictionary

Answer

Security policy

Question 3

Which of the following is the most effective way to secure a remote access connection for employees?

Accepted Answer

VPN with Multi-Factor Authentication (MFA).. A VPN using MFA provides both encryption for the transit path and strong verification of user identity.

Answer

Using a simple password.

Answer

Allowing SSH access directly from the internet.

Answer

Opening RDP port 3389 to the world.

Question 4

Which THREE elements are essential to define a trust boundary? (Select THREE)

Accepted Answer

Different access privileges. A trust boundary is defined by the transition between levels of access, authentication, or network zones.

Answer

Operating system type

Answer

Hardware vendor

Question 5

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Accepted Answer

It verifies the integrity and origin of DNS responses.. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.

Answer

It hides DNS queries from ISP monitoring.

Answer

It prevents DDoS attacks against DNS servers.

Answer

It increases the speed of DNS resolution.

Question 6

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

Accepted Answer

Implementing Multi-Factor Authentication (MFA).. Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.

Answer

Limiting the password character set.

Answer

Increasing the session timeout.

Answer

Implementing a strong password policy.

Question 7

What is the primary function of a Security Reference Architecture (SRA)?

Accepted Answer

To provide a blueprint for security design. SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.

Answer

To manage incidents

Answer

To configure firewalls

Answer

To identify vulnerabilities

Question 8

Which TWO of the following are fundamental pillars of information security (CIA triad)?

Accepted Answer

Confidentiality.. The CIA triad consists of Confidentiality, Integrity, and Availability.

Answer

User Friendliness.

Answer

Cost effectiveness.

Answer

Performance.

Question 9

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

Accepted Answer

Automated Policy-as-Code scanning in the CI/CD pipeline.. Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.

Answer

Only allow senior architects to deploy resources.

Answer

Relying on developers to perform self-audits.

Answer

Manual code review of all commits.

Question 10

In the context of the 'Zachman Framework', which cell represents the 'Why' of the security architecture?

Accepted Answer

Motivation. The 'Why' column in the Zachman Framework is the 'Motivation' column, which focuses on business goals and security drivers.

Answer

Data

Answer

Function

Answer

Time

Question 11

Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)

Accepted Answer

Detailed design diagrams. Auditors require the design itself (diagrams) and the security controls implemented to protect the assets.

Answer

Developer social security numbers

Answer

Vendor marketing brochures

Answer

Employee cafeteria menu

Question 12

Which TWO of the following are best practices for securing API endpoints?

Accepted Answer

Using OAuth/OIDC for authentication.. Rate limiting and strong authentication are foundational API security practices.

Answer

Publicly exposing all internal endpoints.

Answer

Ignoring input validation.

Answer

Requiring no authentication for GET requests.

Question 13

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

Accepted Answer

Stateful Failover (Failover Link). Cisco ASA high availability uses a dedicated failover link to exchange state information between the active and standby units, a feature called Stateful Failover. This link synchronizes connection tables, translation tables, and other stateful data so the standby can take over without dropping established sessions. This is why A is correct.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 14

An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?

Accepted Answer

Azure Storage Firewalls and Virtual Networks. Azure Storage Firewalls and Virtual Networks is the native feature that restricts access to a storage account based on network rules — allowing only specified virtual networks, subnets, or public IP ranges. By configuring the storage account's network rules to allow only the corporate network (via VNet service endpoints or private endpoints), the architect directly prevents data exfiltration from unauthorized networks. This is the precise control the question describes.

Answer

Azure AD Conditional Access

Answer

Azure Policy

Answer

Azure Bastion

Question 15

What is the primary purpose of a TPM chip in a laptop?

Accepted Answer

To store cryptographic keys and ensure platform integrity.. The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.

Answer

To increase CPU performance.

Answer

To accelerate disk encryption.

Answer

To provide biometric authentication.

Question 16

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra ID (formerly Azure AD) Conditional Access policies are used to evaluate device compliance status before granting access to M365 resources.

Answer

SharePoint Online Admin Center

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 17

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

Accepted Answer

Architecture Vision. TOGAF ADM Phase A (Architecture Vision) is where the scope of the architecture engagement is defined, stakeholders are identified, and the Architecture Vision is produced. The Phase A inputs and steps explicitly include defining scope, identifying stakeholders, and creating the Statement of Architecture Work. This makes A the correct answer.

Answer

Business Architecture

Answer

Transition Planning

Answer

Architecture Requirements Repository

Question 18

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Multi-party approval is the most critical control for preventing unauthorized deployment because it requires multiple authorized individuals to approve a deployment before it proceeds. This separation of duties ensures that no single compromised account or malicious insider can push code to production. It directly addresses the risk of unauthorized deployment by adding a human gate.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest

Question 19

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 20

What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?

Accepted Answer

To facilitate communication between technical teams and audit.. A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.

Answer

To update firewall configurations.

Answer

To perform penetration testing.

Answer

To manage the budget for security projects.