ISC Practice Test 9 — 10 Questions

Question 1

An architect is deploying a global application and needs to ensure that all HTTP traffic is redirected to HTTPS. Which service in AWS should be used to enforce this compliance globally?

Accepted Answer

Amazon CloudFront Viewer Protocol Policy. Amazon CloudFront Viewer Protocol Policy is the correct service because it allows you to enforce HTTPS by redirecting HTTP to HTTPS or blocking HTTP entirely at the edge, globally. This setting is applied to the distribution and affects all viewers regardless of location. It ensures compliance with security policies requiring encrypted transport.

Answer

Route 53

Answer

AWS Certificate Manager

Answer

AWS Shield

Question 2

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Accepted Answer

Private claims (custom app-specific claims).. Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

Answer

Hardware serial number claims.

Answer

Root password claims.

Question 3

When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?

Accepted Answer

Elevation of Privilege. STRIDE's Elevation of Privilege category covers scenarios where an attacker gains access to resources or accounts beyond their authorization level, such as obtaining administrative access. Gaining unauthorized access to an admin account is the textbook example of Elevation of Privilege. This makes B correct.

Answer

Information Disclosure

Answer

Spoofing

Answer

Denial of Service

Question 4

What is the purpose of 'JWT Validation' on a resource server?

Accepted Answer

To ensure the token is authentic and valid.. JWT validation on a resource server ensures that the token presented by a client is authentic (signed by a trusted issuer) and valid (not expired, correct audience, etc.). This prevents unauthorized access by verifying the token's integrity and claims before granting access to protected resources.

Answer

To encrypt the token payload.

Answer

To store the user's session data.

Answer

To generate a new token.

Question 5

What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?

Accepted Answer

ABAC provides more granular control using environmental and resource attributes.. ABAC grants or denies access based on a combination of attributes—user attributes (e.g., department, clearance), resource attributes (e.g., classification, owner), action attributes (e.g., read, write), and environmental attributes (e.g., time of day, location, device posture). This multidimensional evaluation enables fine-grained, context-aware policies that RBAC cannot express, since RBAC only maps static roles to permissions. Thus, ABAC's primary advantage is its granularity and dynamic adaptability, not speed of implementation or elimination of identity infrastructure.

Answer

ABAC eliminates the need for an Identity Provider.

Answer

ABAC relies exclusively on user hierarchy.

Answer

ABAC is faster to implement.

Question 6

What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?

Accepted Answer

Automated security assessment. SCAP (Security Content Automation Protocol) is a suite of specifications — including CVE, CCE, CPE, CVSS, OVAL, XCCDF, and SWID — that enables automated security assessment, vulnerability management, and compliance checking. It standardizes how vulnerabilities, configurations, and compliance content are expressed so tools can automatically scan and report. Its primary function in architecture is automated security assessment and configuration compliance.

Answer

Firewall management

Answer

Access control

Answer

Encryption

Question 7

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

Accepted Answer

Exposure of the function's endpoint to the public internet.. When a serverless function is configured with 'Public' network access, its invocation endpoint (e.g., an AWS Lambda Function URL or API Gateway route with no authorizer) is reachable from any internet host without authentication or network-layer restriction. This directly expands the attack surface, allowing unauthenticated actors to invoke the function, probe for input-validation flaws, or abuse downstream permissions granted to the function's execution role. The core risk is therefore endpoint exposure, not performance or configuration limitations.

Answer

Higher cost of execution.

Answer

Inability to use environment variables.

Answer

Increased latency.

Question 8

In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?

Accepted Answer

To evaluate access requests against defined security policies.. The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).

Answer

To manage user identities in the directory.

Answer

To log all access attempts for compliance.

Answer

To intercept and inspect network packets.

Question 9

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 10

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

Accepted Answer

Use the Azure Policy add-on for Kubernetes to enforce an 'Allowed Container Images' policy.. Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.

Answer

Assign RBAC roles to all developers to prevent image pull actions.

Answer

Modify the Kubelet configuration files directly on the nodes.

Answer

Configure the Azure CLI to deny access to unauthorized ACR registries.