ISC Practice Test 2 — 30 Questions

Question 1

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

Accepted Answer

Using a cloud provider's Secret Management service.. Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.

Answer

Hardcoding them in a secure configuration file.

Answer

Storing them in Git using an encrypted file.

Answer

Passing them as command-line arguments at runtime.

Question 2

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Accidental public access.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Cloud provider outage.

Answer

Excessive bandwidth usage.

Question 3

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

Accepted Answer

To set security strategy and approve policy.. The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.

Answer

To write firewall rules.

Answer

To patch servers.

Answer

To conduct incident response drills.

Question 4

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 5

What is the primary risk of 'Standing Privileges'?

Accepted Answer

They increase the attack surface by allowing 24/7 access.. Standing privileges are permissions that remain active indefinitely, providing a permanent window for an attacker to exploit if the account is compromised.

Answer

They are too difficult to configure.

Answer

They are not compatible with cloud IAM.

Answer

They prevent MFA from working correctly.

Question 6

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Accepted Answer

Private claims (custom app-specific claims).. Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

Answer

Hardware serial number claims.

Answer

Root password claims.

Question 7

When using Azure Policy to enforce governance, which effect type should be used if the architect wants to log non-compliance without blocking the deployment of resources?

Accepted Answer

Audit. The 'Audit' effect is specifically designed to log events without impacting the deployment action.

Answer

Deny

Answer

DeployIfNotExists

Answer

Append

Question 8

What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?

Accepted Answer

To facilitate communication between technical teams and audit.. A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.

Answer

To update firewall configurations.

Answer

To perform penetration testing.

Answer

To manage the budget for security projects.

Question 9

Which protocol is the industry standard for automating the exchange of user identity information between an Identity Provider and a Service Provider?

Accepted Answer

SCIM. SCIM (System for Cross-domain Identity Management) is the standard designed to facilitate the exchange of user identity information between systems.

Answer

RADIUS

Answer

SAML

Answer

LDAP

Question 10

What is the benefit of using 'Scoped Access Tokens' in an OAuth architecture?

Accepted Answer

It restricts the level of access granted to the client application.. Scopes limit the permissions (actions and resources) associated with a specific token, ensuring that if a token is compromised, the attacker's capabilities are restricted.

Answer

It enables automatic token rotation.

Answer

It eliminates the need for MFA.

Answer

It reduces the size of the token.

Question 11

To ensure compliance with the Payment Card Industry Data Security Standard (PCI DSS) requirement for secure system component configuration, which AWS native service provides a dashboard to continuously monitor and remediate misconfigurations?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates compliance findings and provides a PCI DSS standard view with automated remediation workflows.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS Artifact

Question 12

In a SAML-based federation, what is the purpose of the 'RelayState' parameter?

Accepted Answer

To redirect the user to a specific resource after authentication.. RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.

Answer

To provide the assertion signature.

Answer

To define the authentication method.

Answer

To encrypt the NameID.

Question 13

Which TWO factors are mandatory for a secure 'MFA' implementation?

Accepted Answer

Validation of multiple independent credentials.. MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).

Answer

Exclusion of any knowledge-based factors.

Answer

The use of a proprietary hardware token only.

Answer

The use of only biometric factors.

Question 14

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 15

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Accepted Answer

Device security posture. Zero Trust evaluates the context of the user, the device, and the resource being accessed to make a dynamic decision.

Answer

User's physical office desk number

Answer

The color of the device chassis

Question 16

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 17

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 18

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 19

Which TWO of the following are essential for protecting against SQL Injection?

Accepted Answer

Using parameterized queries (prepared statements).. Prepared statements and input validation are the primary defenses against SQLi.

Answer

Using dynamic SQL building in code.

Answer

Disabling error logging entirely.

Answer

Running the database as root.

Question 20

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager