ISC Practice Test 8 — 10 Questions

Question 1

A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a PSM component in the target network segment. The PSM (Privileged Session Manager) acts as a proxy, allowing session recording and isolation without exposing the vault directly to the endpoint.

Answer

Install the CPM on the target workstations

Answer

Configure the Vault to use an external LDAP proxy

Answer

Deploy the PVWA directly in the DMZ

Question 2

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 3

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

Accepted Answer

Implement CI/CD pipeline security and IaC scanning.. Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.

Answer

Monitor CloudWatch logs for abnormal function execution.

Answer

Enable runtime application self-protection (RASP).

Answer

Regularly rotate the function's execution role.

Question 4

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 5

When migrating to a Zero Trust architecture, what is the recommended approach for legacy applications that do not support modern authentication protocols (SAML/OIDC)?

Accepted Answer

Use an Identity-Aware Proxy (IAP).. An Identity-Aware Proxy (IAP) can act as a modern authentication frontend for legacy apps, handling the modern auth flow and passing the identity to the backend via headers or Kerberos.

Answer

Only allow access via VPN.

Answer

Rewrite the application source code.

Answer

Disable authentication for these apps.

Question 6

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 7

When designing a Federated Identity architecture using OIDC/SAML, which TWO security considerations are critical for the Relying Party (SP)?

Accepted Answer

Verifying the audience (aud) claim. Validating the token signature and checking the audience claim are the two most critical steps to prevent token spoofing or replay attacks.

Answer

Configuring the IdP to use weak hashing algorithms

Answer

Allowing all claims to be processed without filtering

Answer

Ignoring timestamp validation to avoid clock skew

Question 8

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 9

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 10

Which THREE items should be included in a thorough Architecture Decision Record (ADR)? (Select THREE)

Accepted Answer

Decision Status. ADRs need to document the decision, the context, and the consequences of the decision.

Answer

Personal performance review

Answer

Budget approval code