ISC Practice Test 4 — 25 Questions

Question 1

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 2

When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?

Accepted Answer

Verifying the audience (aud) claim. Validating the token signature and checking the audience claim are the two most critical steps to prevent token spoofing or replay attacks.

Answer

Configuring the IdP to use weak hashing algorithms

Answer

Allowing all claims to be processed without filtering

Answer

Ignoring timestamp validation to avoid clock skew

Question 3

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 4

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 5

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)

Accepted Answer

Decision Status. ADRs need to document the decision, the context, and the consequences of the decision.

Answer

Personal performance review

Answer

Budget approval code

Question 6

Which TWO actions should be taken when designing a highly available IAM architecture?

Accepted Answer

Deploy identity services across multiple geographic regions.. Redundancy of the IdP (multi-region/multi-cloud) and geo-replication of the directory service are critical for high availability in IAM.

Answer

Use a single, high-performance master node.

Answer

Store all session data in a local file system.

Answer

Disable MFA to ensure faster login times.

Question 7

Which TWO types of certificates are used in a standard mTLS implementation?

Accepted Answer

Server Certificate.. mTLS requires both a Server Certificate (to verify the server identity) and a Client Certificate (to verify the client identity).

Answer

Root CA Certificate only.

Answer

Public SSH Key.

Answer

Self-signed user password.

Question 8

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

Accepted Answer

Apply a bucket policy with an explicit Deny for s3:PutObject for unauthenticated users. Block Public Access settings at the account level, using Bucket Policies with Deny statements, and enforcing S3 Block Public Access at the bucket level are the primary defense-in-depth measures.

Answer

Enable Server-Side Encryption with KMS

Answer

Use IAM users for all S3 interactions

Question 9

When designing a secure API, which protocol is recommended for authorization?

Accepted Answer

OAuth 2.0.. OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.

Answer

RADIUS.

Answer

SAML 2.0.

Answer

LDAP.

Question 10

Which TWO of the following are best practices for securing API endpoints?

Accepted Answer

Using OAuth/OIDC for authentication.. Rate limiting and strong authentication are foundational API security practices.

Answer

Publicly exposing all internal endpoints.

Answer

Ignoring input validation.

Answer

Requiring no authentication for GET requests.

Question 11

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

Accepted Answer

Tenants. In Cisco ACI, the EPG, Contract, and Tenant are the fundamental building blocks for security policy definition and isolation.

Answer

Physical Port Security

Answer

VLAN Tagging

Question 12

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

Accepted Answer

Organizational silos. Managing organizational silos and maintaining alignment with changing business needs are top challenges.

Answer

Cable length limitations

Answer

OS license costs

Answer

Lack of hardware vendors

Question 13

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Accepted Answer

Device Posture/Health.. Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Answer

The color scheme of the application.

Answer

The user's favorite browser.

Question 14

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

Accepted Answer

AES-GCM.. AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.

Answer

3DES

Answer

Blowfish

Answer

DES

Question 15

Which security measure is most effective at preventing unauthorized access to a physical data center?

Accepted Answer

Layered physical access controls.. Layered physical security (e.g., mantraps, badge access, surveillance) provides the most comprehensive defense for physical infrastructure.

Answer

Complex password requirements.

Answer

A robust firewall configuration.

Answer

Implementing an EDR solution.

Question 16

Which THREE features are essential for a modern IAM Lifecycle Management (LCM) system?

Accepted Answer

Automated de-provisioning upon employment termination.. Automated provisioning, role-based access assignment, and automated de-provisioning are pillars of IAM LCM.

Answer

Static account creation without audits.

Answer

Manual password resets via email.

Question 17

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

Accepted Answer

Security Groups. Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.

Answer

MAC Sets

Answer

Logical Ports

Answer

IP Sets

Question 18

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

Accepted Answer

Mutual TLS (mTLS) with client certificates.. Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.

Answer

OAuth 2.0 Client Credentials flow.

Answer

HTTP Basic Authentication over HTTPS.

Answer

IP address filtering on the load balancer.

Question 19

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Accepted Answer

Client SSL Profile. A Client SSL profile is required on the Virtual Server to handle the decryption of traffic from the client.

Answer

Server SSL Profile

Answer

SNAT Pool

Answer

iRule

Question 20

Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?

Accepted Answer

Specific application activities (e.g., file downloads).. CASBs monitor user location, device state, and the specific application activity (actions taken).

Answer

The user's home internet service provider.

Answer

The user's favorite website bookmarks.