ISC Practice Test 2 — 30 Questions

Question 1

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 2

Which THREE of the following are indicators of a potential system compromise?

Accepted Answer

Unexpected outbound network traffic.. Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).

Answer

Normal user logons.

Answer

Scheduled system backups.

Question 3

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Accepted Answer

Verify explicitly. Zero Trust relies on explicit verification, least privilege, and assuming breach.

Answer

Trust but verify

Answer

Maximize perimeter defense

Question 4

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 5

To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?

Accepted Answer

Kubernetes Admission Controllers. Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.

Answer

Network Policies

Answer

Kubernetes Secrets

Answer

Role-Based Access Control (RBAC)

Question 6

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

Accepted Answer

To document differences between current state and requirements.. A gap analysis identifies where the current architecture deviates from the target compliance framework.

Answer

To reduce cloud costs.

Answer

To increase the migration speed.

Answer

To select the best cloud provider.

Question 7

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 8

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 9

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 10

When designing an architecture to meet NIST 800-53 controls, which AWS service should be used to enforce resource tagging for all assets to ensure proper cost and compliance tracking?

Accepted Answer

AWS Config. AWS Config is the primary tool that can enforce tagging policies and alert on or remediate non-compliant resources.

Answer

AWS CloudFormation

Answer

AWS IAM

Answer

AWS Organizations

Question 11

What is the function of 'Token Introspection' in OAuth 2.0?

Accepted Answer

To allow a resource server to validate a token's status.. Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

Answer

To generate a new token for the client.

Answer

To map the user to a new role.

Answer

To refresh an expired token.

Question 12

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

Accepted Answer

To set security strategy and approve policy.. The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.

Answer

To write firewall rules.

Answer

To patch servers.

Answer

To conduct incident response drills.

Question 13

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 14

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 15

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 16

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 17

When designing a secure API, which protocol is recommended for authorization?

Accepted Answer

OAuth 2.0.. OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.

Answer

RADIUS.

Answer

SAML 2.0.

Answer

LDAP.

Question 18

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

Accepted Answer

AES-GCM.. AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.

Answer

3DES

Answer

Blowfish

Answer

DES

Question 19

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Accepted Answer

Device Posture/Health.. Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Answer

The color scheme of the application.

Answer

The user's favorite browser.

Question 20

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.