ISC Practice Test 5 — 25 Questions

Question 1

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Accepted Answer

Implementing Network Policies to restrict pod communication.. Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.

Answer

Exposing the Kube API to the public internet.

Answer

Running all pods with root privileges.

Answer

Disabling RBAC.

Question 2

Which THREE of the following are indicators of a potential system compromise?

Accepted Answer

Unexpected outbound network traffic.. Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).

Answer

Normal user logons.

Answer

Scheduled system backups.

Question 3

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

Accepted Answer

Organizational maturity. Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.

Answer

Hardware vendor preference

Answer

Office location

Question 4

Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?

Accepted Answer

Validation of JWT/Auth tokens at the gateway.. Rate limiting (DDoS protection), authentication validation (at the edge), and logging (audit) are standard API Gateway security controls.

Answer

Disabling all logging for performance.

Answer

Allowing all traffic from any source IP.

Question 5

What is the primary purpose of a TPM chip in a laptop?

Accepted Answer

To store cryptographic keys and ensure platform integrity.. The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.

Answer

To increase CPU performance.

Answer

To accelerate disk encryption.

Answer

To provide biometric authentication.

Question 6

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 7

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 8

In the context of the SABSA framework, what is the relationship between the 'Security Services' and 'Business Attributes'?

Accepted Answer

Attributes drive services. The business attributes (what the business needs) drive the requirement for specific security services.

Answer

Attributes describe technical vulnerabilities

Answer

Services drive attributes

Answer

They are independent

Question 9

When documenting a cloud-based architecture, which aspect is most critical to document for compliance?

Accepted Answer

Shared Responsibility Model. Shared Responsibility Model documentation is essential to define which security controls the provider manages vs. the customer.

Answer

Cloud vendor pricing

Answer

Employee names

Answer

OS versions

Question 10

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Accepted Answer

Verify explicitly. Zero Trust relies on explicit verification, least privilege, and assuming breach.

Answer

Trust but verify

Answer

Maximize perimeter defense

Question 11

An ISSAP architect is configuring Azure AD (Entra ID) Conditional Access policies to enforce Zero Trust. The requirement is to ensure that users accessing sensitive applications are verified as compliant with Intune device status. Which assignment condition is required?

Accepted Answer

Require device to be marked as compliant. The 'Require device to be marked as compliant' grant control is the specific mechanism in Entra ID to bridge device compliance state from Intune to access decisions.

Answer

Require Azure AD Joined device

Answer

Require multi-factor authentication

Answer

Require Hybrid Azure AD joined device

Question 12

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

Accepted Answer

Apply a Service Control Policy (SCP) to the Organizational Unit (OU).. Service Control Policies (SCPs) applied at the OU level can explicitly deny the 's3:PutBucketPolicy' action if the bucket is public, overriding any IAM user permissions.

Answer

Set up an AWS Config rule to delete buckets after creation.

Answer

Configure individual IAM policies for every user.

Answer

Enable S3 Block Public Access at the account level.

Question 13

You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?

Accepted Answer

Shamir's Secret Sharing. Vault utilizes Shamir's Secret Sharing to split the unseal key into multiple shares, requiring a quorum to unseal the vault.

Answer

Transit Secret Engine

Answer

Token Authentication

Answer

Auto-Unseal via AWS KMS

Question 14

Which component of an architecture document defines the communication standards between services?

Accepted Answer

Interface specification. The Interface Specification or API design document defines how services communicate.

Answer

System overview

Answer

Data dictionary

Answer

Security policy

Question 15

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Accepted Answer

Identify design-level security flaws. Threat modeling identifies design flaws and helps prioritize security investments.

Answer

Automate patch management

Answer

Perform penetration testing

Answer

Manage hardware inventory

Question 16

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 17

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

Accepted Answer

Setting the 'Secure' and 'HttpOnly' flags.. The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.

Answer

Enabling HTTP/2.

Answer

Increasing cookie expiration time.

Answer

Disabling session persistence.

Question 18

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Accepted Answer

Always verify explicitly.. Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.

Answer

Trust all internal network traffic.

Answer

Use static, long-lived access tokens.

Question 19

Which THREE of the following are best practices for securing a remote worker's endpoint?

Accepted Answer

EDR solution for threat monitoring.. Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.

Answer

Disabling the lock screen.

Answer

Using a shared local account.

Question 20

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Accepted Answer

Implement an SSH Certificate Authority (CA) system.. Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.

Answer

Restrict SSH to a hardened bastion host.

Answer

Use a central password manager to rotate keys.

Answer

Require MFA for every single SSH connection.