ISC Practice Test 3 — 10 Questions

Question 1

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Accepted Answer

Setting allowPrivilegeEscalation to false in the SecurityContext. Option C is correct because setting allowPrivilegeEscalation to false in a container's SecurityContext prevents processes from gaining more privileges than their parent process, specifically blocking the setuid/setgid and file capability mechanisms that enable privilege escalation. Option D is correct because running containers as a non-root user (via runAsUser/runAsNonRoot in the SecurityContext) removes the default root privileges inside the container, so even if an attacker compromises the application, they lack the UID 0 capabilities needed to escalate. Option A is not a best practice for privilege escalation prevention; using a default Namespace for all workloads weakens isolation and RBAC scoping rather than restricting container privileges. Option B is unrelated, as increasing a pod's memory limit only affects resource allocation and has no bearing on privilege escalation. Option E is also unrelated, since enabling ClusterIP services merely exposes pods on an internal virtual IP for network access and does not affect container privilege levels.

Answer

Using a default Namespace for all workloads

Answer

Increasing the memory limit for pods

Answer

Enabling ClusterIP services

Question 2

Which risk management framework is most commonly used for aligning business objectives with IT capabilities in large enterprises?

Accepted Answer

COBIT. COBIT is specifically designed to bridge the gap between IT and business requirements in large-scale enterprises.

Answer

ITIL

Answer

NIST RMF

Answer

ISO/IEC 27005

Question 3

Which security principle is enforced when you restrict an application's ability to modify system files?

Accepted Answer

Least privilege. Least privilege means granting a subject only the minimum access rights necessary to perform its function — no more. Restricting an application from modifying system files enforces least privilege by removing write access the application does not need, thereby limiting the blast radius if the application is compromised. This is the canonical example of least privilege applied at the process/application level.

Answer

Defense in depth

Answer

Economy of mechanism

Answer

Complete mediation

Question 4

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 5

In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?

Accepted Answer

Because it must be kept confidential on the backend server.. The client_secret is a confidential credential that authenticates the client application to the authorization server. It must remain on the backend server and never be exposed to the browser, because the browser is an untrusted environment where the secret could be intercepted or extracted. This is why C is correct.

Answer

Because the client secret is only used for PKCE.

Answer

Because the browser does not support SSL.

Answer

Because browsers block outbound requests with secrets.

Question 6

When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?

Accepted Answer

On the user's local hardware authenticator.. In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.

Answer

In the Identity Provider's database.

Answer

In the browser's encrypted cache.

Answer

In the server-side hardware security module (HSM).

Question 7

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

Accepted Answer

Organizational maturity. Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.

Answer

Hardware vendor preference

Answer

Office location

Question 8

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 9

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 10

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.