ISC Hard Questions — 25 Difficult Questions

Question 1

A firm is using Terraform for Infrastructure as Code (IaC) governance. The architect wants to prevent the deployment of insecure security groups. Which tool should be integrated into the CI/CD pipeline to perform static analysis against defined security policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Terraform Cloud Sentinel. Checkov is an industry-standard static analysis tool that scans Terraform files for compliance and security misconfigurations.

Answer

Azure Policy for Kubernetes

Answer

AWS CloudFormation Guard

Answer

SonarQube

Question 2

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 3

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 4

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Accepted Answer

Use of a 'nonce' in the OIDC request.. DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

Answer

Storing tokens in client-side cookies.

Answer

Disabling all token refresh capabilities.

Answer

Using long-lived access tokens.

Question 5

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 6

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 7

When using an API Gateway as a Policy Enforcement Point (PEP), where should the authorization decision logic be offloaded to ensure central governance?

Accepted Answer

To a centralized Policy Decision Point (PDP).. The gateway should delegate authorization decisions to a Policy Decision Point (PDP), such as an Open Policy Agent (OPA) server, to maintain consistent policy across services.

Answer

Hardcoded within the API Gateway configuration.

Answer

Within the backend microservice code.

Answer

Inside the client's browser.

Question 8

A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?

Accepted Answer

EC2 Image Builder. EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.

Answer

AWS Systems Manager

Answer

AWS Service Catalog

Answer

AWS Lambda

Question 9

An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?

Accepted Answer

Infrastructure tags and cloud policy enforcement. Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.

Answer

Database schema constraints

Answer

Container image manifests

Answer

Application service mesh proxy tags

Question 10

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 11

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Accepted Answer

Exposure of static, long-lived credentials.. Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

Answer

Incompatible authentication protocols.

Answer

Network latency during authentication.

Answer

Lack of granular auditing of privileged actions.

Question 12

What is the primary architectural purpose of a 'Security Token Service' (STS) in a federated environment?

Accepted Answer

To mediate trust between different security domains.. An STS acts as the central issuing authority that validates incoming requests and issues security tokens (SAML, JWT) for access to downstream services.

Answer

To replace the directory service.

Answer

To store all user passwords.

Answer

To manage network traffic routing.

Question 13

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Accidental public access.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Cloud provider outage.

Answer

Excessive bandwidth usage.

Question 14

You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?

Accepted Answer

Internal Certificate Authority (CA). A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.

Answer

The API Gateway

Answer

The Load Balancer

Answer

The Identity Provider (IdP)

Question 15

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 16

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 17

An organization requires that all cloud storage assets are encrypted using customer-managed keys. Which service should the architect configure to track the key usage and verify compliance?

Accepted Answer

AWS CloudTrail. CloudTrail is the service that logs all API calls to KMS, providing the audit trail needed to prove key usage and compliance.

Answer

AWS Inspector

Answer

AWS Trusted Advisor

Answer

AWS Systems Manager

Question 18

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 19

You are architecting a solution to mitigate 'Token Theft' in a Zero Trust environment. Which mechanism binds a token to a specific client instance?

Accepted Answer

DPoP (Demonstrating Proof-of-Possession). DPoP (Demonstrating Proof-of-Possession) binds tokens to a private key held by the client, ensuring that even if a token is stolen, it cannot be used without the accompanying private key.

Answer

PKCE (Proof Key for Code Exchange)

Answer

Refresh Token Rotation

Answer

MFA step-up

Question 20

When deploying HashiCorp Vault for secrets management, you need to implement a 'Dynamic Secrets' architecture for database access. Which workflow is correct?

Accepted Answer

Vault requests a new user creation from the DB via a configured engine and returns those credentials to the client.. The dynamic secret workflow involves Vault generating unique, short-lived database credentials on-the-fly for every request, which are automatically revoked upon expiry.

Answer

Clients authenticate to the DB via Vault using LDAP delegation.

Answer

Vault retrieves static credentials from a PKI backend and rotates them.

Answer

Vault hashes existing database passwords and stores them in transit.