ISC Exam Simulation — 125 Questions

Question 1

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 2

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Accepted Answer

Identify design-level security flaws. Threat modeling identifies design flaws and helps prioritize security investments.

Answer

Automate patch management

Answer

Perform penetration testing

Answer

Manage hardware inventory

Question 3

Which threat modeling technique is best described as focusing on the attacker's perspective and their motivation?

Accepted Answer

Attacker-centric. Attacker-centric threat modeling starts with the adversary and their specific objectives.

Answer

System-centric

Answer

Capability-centric

Answer

Data-centric

Question 4

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

Accepted Answer

Organizational silos. Managing organizational silos and maintaining alignment with changing business needs are top challenges.

Answer

Cable length limitations

Answer

OS license costs

Answer

Lack of hardware vendors

Question 5

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Accepted Answer

Exchange the IdP's public signing certificate. For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

Answer

Configure the SP to use the NameID format

Answer

Exchange the SP's private key with the IdP

Answer

Enable encrypted assertions using the SP's public key

Question 6

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 7

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 8

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Accepted Answer

Implement an SSH Certificate Authority (CA) system.. Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.

Answer

Restrict SSH to a hardened bastion host.

Answer

Use a central password manager to rotate keys.

Answer

Require MFA for every single SSH connection.

Question 9

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 10

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.

Question 11

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 12

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

Accepted Answer

Tenants. In Cisco ACI, security segmentation is enforced through the policy model built on Tenants (B), Contracts (C), and Endpoint Groups (D). Tenants (B) provide the logical container that isolates policy, routing, and security domains for different applications or business units within the fabric. Endpoint Groups (D) classify endpoints that share the same security and policy requirements, acting as the source/destination objects in the policy model. Contracts (C) define the permitted communication relationships between EPGs, specifying which protocols and ports are allowed, thereby enforcing segmentation between groups. Physical Port Security (A) is a Layer 2 switchport feature, not an ACI fabric segmentation construct, and VLAN Tagging (E) is a traditional network isolation mechanism that ACI abstracts away rather than using as a primary segmentation component.

Answer

Physical Port Security

Answer

VLAN Tagging

Question 13

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

Accepted Answer

Security Groups. Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.

Answer

AWS PrivateLink

Answer

AWS Transit Gateway Route Tables

Answer

Network Access Control Lists (NACLs)

Question 14

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Accepted Answer

Business attribute profiles. SABSA requires business requirements documentation and security service specifications.

Answer

Daily status reports

Answer

Employee payroll records

Answer

Project budget sheets

Question 15

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 16

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 17

What is the purpose of 'Claims Transformation' in an Identity Provider?

Accepted Answer

To convert user attributes from one format to another.. Claims transformation allows the IdP to map or modify attributes from a source directory (like AD) into a format expected by the target application (SAML/OIDC).

Answer

To encrypt the entire user session.

Answer

To authenticate users against multiple directories simultaneously.

Answer

To store authentication logs in a central repository.

Question 18

What is the primary architectural purpose of implementing Just-in-Time (JIT) access?

Accepted Answer

To minimize the window of opportunity for attackers to exploit standing privileges.. JIT access reduces the attack surface by ensuring that high-privilege access is only active when needed, rather than remaining persistent.

Answer

To eliminate the need for an identity provider.

Answer

To increase user productivity by removing MFA requirements.

Answer

To automate user provisioning and deprovisioning.

Question 19

Which component is the most critical to protect in a web-based architecture?

Accepted Answer

Database. The database is typically the primary target for attackers as it contains the sensitive data.

Answer

Web server

Answer

Load balancer

Answer

CSS files

Question 20

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.