ISC Practice Test 5 — 10 Questions

Question 1

What is the function of 'Token Introspection' in OAuth 2.0?

Accepted Answer

To allow a resource server to validate a token's status.. Token Introspection (RFC 7662) allows a resource server to verify the validity and state (active/inactive) of an access token with the Authorization Server.

Answer

To generate a new token for the client.

Answer

To map the user to a new role.

Answer

To refresh an expired token.

Question 2

What is the primary function of an Information Security Steering Committee (ISSC) in the context of enterprise security governance?

Accepted Answer

To set security strategy and approve policy.. The ISSC provides high-level direction, prioritizes security initiatives, and ensures alignment with business goals.

Answer

To write firewall rules.

Answer

To patch servers.

Answer

To conduct incident response drills.

Question 3

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 4

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 5

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 6

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 7

When designing a secure API, which protocol is recommended for authorization?

Accepted Answer

OAuth 2.0.. OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.

Answer

RADIUS.

Answer

SAML 2.0.

Answer

LDAP.

Question 8

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

Accepted Answer

AES-GCM.. AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.

Answer

3DES

Answer

Blowfish

Answer

DES

Question 9

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Accepted Answer

Device Posture/Health.. Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Answer

The color scheme of the application.

Answer

The user's favorite browser.

Question 10

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.