ISC Practice Test 3 — 30 Questions

Question 1

Which TWO elements are required to effectively document a security architecture for audit purposes? (Select TWO)

Accepted Answer

Detailed design diagrams. Auditors require the design itself (diagrams) and the security controls implemented to protect the assets.

Answer

Developer social security numbers

Answer

Vendor marketing brochures

Answer

Employee cafeteria menu

Question 2

Which TWO of the following are best practices for securing API endpoints?

Accepted Answer

Using OAuth/OIDC for authentication.. Rate limiting and strong authentication are foundational API security practices.

Answer

Publicly exposing all internal endpoints.

Answer

Ignoring input validation.

Answer

Requiring no authentication for GET requests.

Question 3

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

Accepted Answer

Stateful Failover (Failover Link). Cisco ASA high availability uses a dedicated failover link to exchange state information between the active and standby units, a feature called Stateful Failover. This link synchronizes connection tables, translation tables, and other stateful data so the standby can take over without dropping established sessions. This is why A is correct.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 4

An organization is using Azure to host sensitive data. To prevent data exfiltration, the architect needs to restrict storage account access to only the corporate network. Which feature should be used?

Accepted Answer

Azure Storage Firewalls and Virtual Networks. Azure Storage Firewalls and Virtual Networks is the native feature that restricts access to a storage account based on network rules — allowing only specified virtual networks, subnets, or public IP ranges. By configuring the storage account's network rules to allow only the corporate network (via VNet service endpoints or private endpoints), the architect directly prevents data exfiltration from unauthorized networks. This is the precise control the question describes.

Answer

Azure AD Conditional Access

Answer

Azure Policy

Answer

Azure Bastion

Question 5

What is the primary purpose of a TPM chip in a laptop?

Accepted Answer

To store cryptographic keys and ensure platform integrity.. The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.

Answer

To increase CPU performance.

Answer

To accelerate disk encryption.

Answer

To provide biometric authentication.

Question 6

A company is migrating to Microsoft 365. You need to ensure that users are only able to access SharePoint sites from managed devices that are compliant with corporate security policies. Which service provides this conditional access control?

Accepted Answer

Microsoft Entra Conditional Access. Microsoft Entra ID (formerly Azure AD) Conditional Access policies are used to evaluate device compliance status before granting access to M365 resources.

Answer

SharePoint Online Admin Center

Answer

Microsoft Purview

Answer

Microsoft Intune

Question 7

You are utilizing TOGAF 10 to develop an Architecture Content Framework. Which component of the Architecture Development Method (ADM) phase A is specifically required to define the scope and identify stakeholders?

Accepted Answer

Architecture Vision. TOGAF ADM Phase A (Architecture Vision) is where the scope of the architecture engagement is defined, stakeholders are identified, and the Architecture Vision is produced. The Phase A inputs and steps explicitly include defining scope, identifying stakeholders, and creating the Statement of Architecture Work. This makes A the correct answer.

Answer

Business Architecture

Answer

Transition Planning

Answer

Architecture Requirements Repository

Question 8

When performing an architectural review of a CI/CD pipeline, which security control is most critical for preventing unauthorized deployment of code?

Accepted Answer

Multi-party approval. Multi-party approval is the most critical control for preventing unauthorized deployment because it requires multiple authorized individuals to approve a deployment before it proceeds. This separation of duties ensures that no single compromised account or malicious insider can push code to production. It directly addresses the risk of unauthorized deployment by adding a human gate.

Answer

Hardened build server

Answer

Automated scanning

Answer

Encryption at rest

Question 9

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 10

What is the primary role of a 'Compliance Liaison' in an enterprise architecture team?

Accepted Answer

To facilitate communication between technical teams and audit.. A liaison bridges the gap between technical teams and audit requirements, ensuring that compliance is understood and implemented.

Answer

To update firewall configurations.

Answer

To perform penetration testing.

Answer

To manage the budget for security projects.

Question 11

Which THREE of the following are considered 'Assets' in security architecture? (Select THREE)

Accepted Answer

Customer database. Assets include data, hardware, software, and intellectual property.

Answer

Janitorial services

Answer

Office light bulbs

Question 12

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

Accepted Answer

Use a Hardware Security Module (HSM).. Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.

Answer

Encrypt the keys with a password and store them in the database.

Answer

Hardcode keys into the application environment variables.

Answer

Store keys in a configuration file on the database server.

Question 13

Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?

Accepted Answer

Synchronized time sources (NTP).. Option A (Synchronized time sources via NTP) is correct because non-repudiation requires a trustworthy, consistent timeline across all systems; RFC 5905 NTP keeps clocks within tight tolerances so events can be correlated and their sequence proven in legal proceedings. Option B (Digitally signed logs) is correct because cryptographic signatures using asymmetric keys bind each log entry to its origin, providing integrity and authentication so a party cannot later deny having generated the record. Option C (Immutable storage such as WORM) is correct because write-once-read-many media prevents alteration or deletion of audit records after the fact, preserving evidentiary integrity required by regulations like SEC 17a-4 and HIPAA. Option D (Regular log rotation cycles) is not essential for non-repudiation; rotation is an operational housekeeping practice that manages file size and retention but does not by itself prove authenticity or prevent tampering. Option E (Local write-only hard drives) is not appropriate because local storage is not tamper-evident or independently verifiable, and 'write-only' drives do not provide the cryptographic integrity, trusted timestamping, or centralized protection that non-repudiation demands.

Answer

Regular log rotation cycles.

Answer

Local write-only hard drives.

Question 14

You are designing an IAM architecture for a global enterprise. You must ensure that PII is not transmitted in cleartext within identity tokens. What is the standard security requirement?

Accepted Answer

Implement JSON Web Encryption (JWE).. PII should be encrypted within tokens (e.g., using JWE - JSON Web Encryption) or minimized in the token payload to meet privacy regulations.

Answer

Use JWT exclusively.

Answer

Use symmetric keys for all token signing.

Answer

Disable all claims in the token.

Question 15

In the context of TOGAF, what is the 'Architecture Repository' used for?

Accepted Answer

Managing architectural artifacts. In TOGAF, the Architecture Repository is the central holding area for all architectural assets produced and consumed by the Architecture Development Method (ADM), including the Architecture Metamodel, Architecture Capability, Architecture Landscape, Standards Information Base, Reference Library, and Governance Log. It is used to manage architectural artifacts so they can be reused, governed, and traced across architecture iterations.

Answer

Storing source code

Answer

Logging security events

Answer

Defining business requirements

Question 16

When designing for 'Availability' in a distributed architecture, which pattern is used to handle service failure gracefully?

Accepted Answer

Circuit Breaker. The Circuit Breaker pattern wraps calls to a remote service and, after a threshold of failures, 'trips' to fail fast and stop hammering the failing dependency, allowing it time to recover. This preserves availability by preventing cascading failures and resource exhaustion in a distributed system.

Answer

Sharding

Answer

Load Balancing

Answer

Encryption

Question 17

You are implementing an IdP-initiated SSO flow. What is the primary architectural requirement for the SP?

Accepted Answer

The SP must have a pre-configured trust relationship with the IdP's metadata.. In an IdP-initiated SSO flow, the identity provider generates and sends a SAML assertion directly to the service provider without the user first visiting the SP. For the SP to accept and validate this unsolicited assertion, it must have a pre-configured trust relationship with the IdP, established through exchanged metadata containing the IdP's signing certificate, entity ID, and SSO endpoint. Without this trust anchor, the SP cannot verify the assertion's authenticity.

Answer

The SP must utilize LDAP over SSL for the assertion.

Answer

The SP must redirect the user to the IdP login page.

Answer

The SP must poll the IdP for a login event.

Question 18

An organization is migrating to SCIM (System for Cross-domain Identity Management) for automated provisioning. Which entity is responsible for receiving the provisioning request from the Identity Provider?

Accepted Answer

The SCIM Server. In SCIM, the SCIM Server is the entity that exposes the SCIM REST API endpoints and receives provisioning requests (create, update, delete user/group) from the Identity Provider acting as the SCIM Client. The server is typically the service provider or target application that stores and manages the identity data. This is why B is correct.

Answer

The SCIM Client

Answer

The Authorization Server

Answer

The User Agent

Question 19

Which TWO security properties are provided by modern 'Passwordless' architectures?

Accepted Answer

Elimination of shared secrets.. FIDO2/WebAuthn eliminates shared secrets (passwords) and provides phishing resistance via origin binding.

Answer

Automatic network-level encryption.

Answer

Guaranteed anonymity for users.

Answer

Universal support for all legacy applications.

Question 20

Which threat modeling tool is known for generating DFDs and identifying threats via a rule engine?

Accepted Answer

Microsoft Threat Modeling Tool. Microsoft Threat Modeling Tool is the standard software tool for DFD-based threat analysis.

Answer

Wireshark

Answer

Metasploit

Answer

Nmap