ISC Practice Test 3 — 25 Questions

Question 1

Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?

Accepted Answer

The PAM Vault/Secret Manager.. The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.

Answer

The MFA provider.

Answer

The jump server.

Answer

The session recorder.

Question 2

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Accepted Answer

Granular Role-Based Access Control (RBAC). Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

Answer

Automatic network topology mapping

Answer

Public cloud storage for logs

Question 3

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 4

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 5

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.

Question 6

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 7

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Accepted Answer

Exchange the IdP's public signing certificate. For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

Answer

Configure the SP to use the NameID format

Answer

Exchange the SP's private key with the IdP

Answer

Enable encrypted assertions using the SP's public key

Question 8

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 9

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Accepted Answer

Implementing PKCE (Proof Key for Code Exchange).. HTTPS (transport security), PKCE (binding code to request), and short-lived tokens/codes are standard security measures.

Answer

Storing the code in a public client's local storage.

Answer

Sending the code in the URL fragment of a redirect.

Question 10

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 11

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

Accepted Answer

Use the Azure Policy add-on for Kubernetes to enforce an 'Allowed Container Images' policy.. Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.

Answer

Assign RBAC roles to all developers to prevent image pull actions.

Answer

Modify the Kubelet configuration files directly on the nodes.

Answer

Configure the Azure CLI to deny access to unauthorized ACR registries.

Question 12

Which THREE of the following are common network security architecture tools?

Accepted Answer

Intrusion Detection System (IDS).. Firewalls, IDS/IPS, and VPNs are foundational components of a secure network architecture.

Answer

Unencrypted Telnet.

Answer

Cleartext FTP server.

Question 13

An architect is designing an OAuth 2.0 implementation for a mobile application. To prevent authorization code injection attacks, which specific configuration must be enforced in the client registration?

Accepted Answer

Enable Proof Key for Code Exchange (PKCE) enforcement. PKCE (Proof Key for Code Exchange) is the standard defense against authorization code interception attacks in public clients, replacing the need for a client secret.

Answer

Set a short expiration time for the client_secret

Answer

Require signed JWTs for the request object

Answer

Implement Mutual TLS (mTLS) for the token endpoint

Question 14

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 15

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

Accepted Answer

Use a Hardware Security Module (HSM).. Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.

Answer

Encrypt the keys with a password and store them in the database.

Answer

Hardcode keys into the application environment variables.

Answer

Store keys in a configuration file on the database server.

Question 16

Which TWO concepts are central to 'Federated Identity'?

Accepted Answer

A centralized Identity Provider (IdP).. A central Identity Provider (IdP) and the establishment of 'Trust' between organizations are the core concepts of federation.

Answer

The requirement for the same OS on all servers.

Answer

The use of a shared local database on each server.

Answer

Public IP address matching.

Question 17

Which architectural principle is fundamental to implementing Zero Trust in a microservices environment?

Accepted Answer

Micro-segmentation with identity-based access control. Zero Trust assumes the network is compromised, requiring explicit verification for every request, typically via identity-based micro-segmentation.

Answer

VPN-based remote access

Answer

Implicit trust for internal traffic

Answer

Perimeter-based firewalling

Question 18

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

Accepted Answer

Use Row-Level Security (RLS) within the database engine.. Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.

Answer

Use separate VPCs for every tenant.

Answer

Implement application-level filtering in the code.

Answer

Create separate database instances for every single tenant.

Question 19

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

Accepted Answer

TLS-encrypted logging stream.. Syslog-ng or TLS-based transport ensures that logs are encrypted in transit and can be digitally signed to prevent tampering by an attacker.

Answer

Cleartext HTTP.

Answer

UDP Syslog.

Answer

SNMP v1.

Question 20

Which TWO components are critical for an identity-centric Zero Trust architecture?

Accepted Answer

Policy Decision Point (PDP).. A central Identity Provider (IdP) and a Policy Decision Point (PDP) are the structural heart of a ZT identity architecture.

Answer

A standard network firewall.

Answer

Public IP address allow-listing.

Answer

A localized directory service without replication.