ISC Hard Questions — 25 Difficult Questions

Question 1

In a SAML 2.0 federation, an Identity Provider (IdP) is failing to authenticate users because the Service Provider (SP) cannot verify the assertion integrity. The SP requires the IdP to sign the assertion. What must be exchanged to solve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Exchange the IdP's public signing certificate. For the SP to verify the IdP's signature on an assertion, the SP must possess the IdP's public certificate.

Answer

Configure the SP to use the NameID format

Answer

Exchange the SP's private key with the IdP

Answer

Enable encrypted assertions using the SP's public key

Question 2

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 3

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.

Question 4

What is the primary purpose of an 'Architecture Trade-off Analysis Method' (ATAM)?

Accepted Answer

To evaluate architectural quality tradeoffs. ATAM is used to evaluate architectural decisions and their impact on quality attributes like security, performance, and availability.

Answer

To document API endpoints

Answer

To reduce development cost

Answer

To automate code testing

Question 5

You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?

Accepted Answer

Security Groups. Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.

Answer

AWS PrivateLink

Answer

AWS Transit Gateway Route Tables

Answer

Network Access Control Lists (NACLs)

Question 6

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Accepted Answer

Business attribute profiles. SABSA requires business requirements documentation and security service specifications.

Answer

Daily status reports

Answer

Employee payroll records

Answer

Project budget sheets

Question 7

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 8

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 9

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 10

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Accepted Answer

Setting allowPrivilegeEscalation to false in the SecurityContext. Option C is correct because setting allowPrivilegeEscalation to false in a container's SecurityContext prevents processes from gaining more privileges than their parent process, specifically blocking the setuid/setgid and file capability mechanisms that enable privilege escalation. Option D is correct because running containers as a non-root user (via runAsUser/runAsNonRoot in the SecurityContext) removes the default root privileges inside the container, so even if an attacker compromises the application, they lack the UID 0 capabilities needed to escalate. Option A is not a best practice for privilege escalation prevention; using a default Namespace for all workloads weakens isolation and RBAC scoping rather than restricting container privileges. Option B is unrelated, as increasing a pod's memory limit only affects resource allocation and has no bearing on privilege escalation. Option E is also unrelated, since enabling ClusterIP services merely exposes pods on an internal virtual IP for network access and does not affect container privilege levels.

Answer

Using a default Namespace for all workloads

Answer

Increasing the memory limit for pods

Answer

Enabling ClusterIP services

Question 11

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 12

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.

Question 13

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 14

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 15

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 16

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 17

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Accepted Answer

Terraform Cloud Sentinel. Checkov is an industry-standard static analysis tool that scans Terraform files for compliance and security misconfigurations.

Answer

Azure Policy for Kubernetes

Answer

AWS CloudFormation Guard

Answer

SonarQube

Question 18

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 19

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Accepted Answer

Exposure of static, long-lived credentials.. Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

Answer

Incompatible authentication protocols.

Answer

Network latency during authentication.

Answer

Lack of granular auditing of privileged actions.

Question 20

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Cloud provider outage.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Lack of encryption at rest.

Answer

Missing object versioning.