ISC Infrastructure And System Security — 10 Questions

Question 1

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 2

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

Accepted Answer

Security Groups. Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.

Answer

MAC Sets

Answer

Logical Ports

Answer

IP Sets

Question 3

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 4

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.

Question 5

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 6

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

Accepted Answer

AWS App Mesh with Envoy sidecars. AWS App Mesh provides application-level networking, allowing for service-to-service communication control using mutual TLS (mTLS) and fine-grained traffic routing independent of IP addresses.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security Groups for Pods

Question 7

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

Accepted Answer

Apply a bucket policy with an explicit Deny for s3:PutObject for unauthenticated users. Block Public Access settings at the account level, using Bucket Policies with Deny statements, and enforcing S3 Block Public Access at the bucket level are the primary defense-in-depth measures.

Answer

Enable Server-Side Encryption with KMS

Answer

Use IAM users for all S3 interactions

Question 8

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 9

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 10

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

Accepted Answer

Use Row-Level Security (RLS) within the database engine.. Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.

Answer

Use separate VPCs for every tenant.

Answer

Implement application-level filtering in the code.

Answer

Create separate database instances for every single tenant.