ISC Practice Test 5 — 25 Questions

Question 1

In the context of the NIST Cybersecurity Framework (CSF) 2.0, which newly introduced function focuses on managing the supply chain and third-party risk?

Accepted Answer

Govern. NIST CSF 2.0 (released February 2024) introduced the new 'Govern' function as its sixth core function, elevating governance from a category within Identify to a standalone function. Govern explicitly addresses organizational context, risk management strategy, roles and responsibilities, and — critically — supply chain risk management (GV.SC category). This reflects the recognition that third-party and supply chain risk must be governed at the leadership level rather than treated as a sub-activity of Identify.

Answer

Identify

Answer

Respond

Answer

Protect

Question 2

Which TWO types of certificates are used in a standard mTLS implementation?

Accepted Answer

Server Certificate.. mTLS requires both a Server Certificate (to verify the server identity) and a Client Certificate (to verify the client identity).

Answer

Root CA Certificate only.

Answer

Public SSH Key.

Answer

Self-signed user password.

Question 3

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Accepted Answer

Deploy to a pilot group in 'Audit Mode' first.. Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.

Answer

Push a mass deployment with blocking enabled immediately.

Answer

Manually install the agent on every endpoint.

Answer

Exempt all legacy applications from EDR monitoring.

Question 4

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 5

Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?

Accepted Answer

Data Flow Diagram. Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.

Answer

Network diagram

Answer

Gantt chart

Answer

Entity Relationship Diagram

Question 6

When evaluating a software-defined perimeter (SDP), which architecture principle is being primarily enforced?

Accepted Answer

Zero Trust. SDP enforces 'Zero Trust' by requiring authentication and authorization before the network connection is made.

Answer

Defense in depth

Answer

Perimeter security

Answer

Fail-safe defaults

Question 7

In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?

Accepted Answer

Permissions should be granted based on the user's job role and the specific resources needed.. PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.

Answer

All users should have read access to the root directory.

Answer

Administrators should have full control over all cloud resources.

Answer

Roles should be static and never changed to ensure stability.

Question 8

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 9

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Accepted Answer

To redirect the user to a specific resource after authentication.. RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

Answer

To provide the assertion signature.

Answer

To define the authentication method.

Answer

To encrypt the NameID.

Question 10

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 11

What is the primary function of an 'Identity Bridge' in a hybrid architecture?

Accepted Answer

To federate identity between on-premises and cloud environments.. An identity bridge connects disparate identity systems (e.g., on-premises AD and cloud-based IdP) to provide a unified authentication experience.

Answer

To store user passwords in a central vault.

Answer

To enforce network firewall rules.

Answer

To perform real-time user activity monitoring.

Question 12

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Accepted Answer

Granular Role-Based Access Control (RBAC). Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

Answer

Automatic network topology mapping

Answer

Public cloud storage for logs

Question 13

Which THREE of the following are best practices for securing a remote worker's endpoint?

Accepted Answer

EDR solution for threat monitoring.. Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.

Answer

Disabling the lock screen.

Answer

Using a shared local account.

Question 14

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Accepted Answer

Implementing Network Policies to restrict pod communication.. Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.

Answer

Exposing the Kube API to the public internet.

Answer

Running all pods with root privileges.

Answer

Disabling RBAC.

Question 15

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 16

What is the primary risk of 'Standing Privileges'?

Accepted Answer

They increase the attack surface by allowing 24/7 access.. Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.

Answer

They are too difficult to configure.

Answer

They are not compatible with cloud IAM.

Answer

They prevent MFA from working correctly.

Question 17

You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?

Accepted Answer

Client SSL Profile. A Client SSL profile is required on the Virtual Server to handle the decryption of traffic from the client.

Answer

Server SSL Profile

Answer

SNAT Pool

Answer

iRule

Question 18

An ISSAP architect is designing a system that must be compliant with the General Data Protection Regulation (GDPR). Which THREE technical safeguards should be implemented to ensure data confidentiality?

Accepted Answer

Enforced TLS 1.2+ for data in transit.. Option A is correct because enforcing TLS 1.2 or higher protects personal data in transit from eavesdropping and man-in-the-middle attacks, directly supporting GDPR confidentiality obligations for data moving across networks. Option C is correct because AES-256 encryption at rest renders stored personal data unreadable without the key, which is a recognized technical safeguard for confidentiality under GDPR and aligns with Article 32's reference to encryption. Option D is correct because Role-Based Access Control limits access to personal data to authorized roles on a least-privilege basis, reducing the risk of unauthorized disclosure and supporting GDPR's access-control expectations. Option B is not appropriate because automated document printing services increase the risk of uncontrolled copies and do not provide a confidentiality safeguard. Option E is not appropriate because daily physical site tours are an administrative/physical measure and do not technically protect data confidentiality.

Answer

Automated document printing services.

Answer

Daily physical site tours.

Question 19

When designing a secure cloud architecture, which TWO security services are essential for identity and access management? (Select TWO)

Accepted Answer

Role-Based Access Control. Role-Based Access Control (C) is essential because it enforces least-privilege authorization by binding permissions to roles rather than individuals, which is a core IAM control for managing who can access which cloud resources. Federated Identity (E) is essential because it lets users authenticate through a trusted external identity provider (via standards such as SAML 2.0 or OIDC) and receive tokens for access, enabling centralized identity management and single sign-on across cloud services. Together, C and E directly address the authentication and authorization pillars of identity and access management. Physical security (A) protects data center facilities but is not an IAM service, packet inspection (B) is a network monitoring/filtering function, and data backup (D) is a data availability and recovery control, none of which manage identities or access permissions.

Answer

Physical security

Answer

Packet inspection

Answer

Data backup

Question 20

When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?

Accepted Answer

Verifying the audience (aud) claim. Option B is correct because the Relying Party (SP) must verify the audience (aud) claim in the ID token or SAML assertion to ensure the token was issued specifically for it, preventing token replay or substitution attacks where a token minted for another SP is presented. Option D is correct because the SP must validate the cryptographic signature of the assertion/token using the IdP's published keys (e.g., JWKS for OIDC or the IdP signing certificate for SAML) to confirm authenticity and integrity, rejecting any tampered or forged tokens. Options A, C, and E are not appropriate: weak hashing algorithms undermine token integrity, processing all claims without filtering can enable injection or privilege escalation, and ignoring timestamp validation (exp, iat, nbf, or SAML NotOnOrAfter) permits expired or replayed assertions, so clock skew should be handled with a small tolerance rather than by disabling validation.

Answer

Configuring the IdP to use weak hashing algorithms

Answer

Allowing all claims to be processed without filtering

Answer

Ignoring timestamp validation to avoid clock skew