ISC Infrastructure And System Security — 25 Questions

Question 1

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 2

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

Accepted Answer

Security Groups. Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.

Answer

MAC Sets

Answer

Logical Ports

Answer

IP Sets

Question 3

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 4

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.

Question 5

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 6

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

Accepted Answer

AWS App Mesh with Envoy sidecars. AWS App Mesh provides application-level networking, allowing for service-to-service communication control using mutual TLS (mTLS) and fine-grained traffic routing independent of IP addresses.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

Security Groups for Pods

Question 7

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

Accepted Answer

Apply a bucket policy with an explicit Deny for s3:PutObject for unauthenticated users. Block Public Access settings at the account level, using Bucket Policies with Deny statements, and enforcing S3 Block Public Access at the bucket level are the primary defense-in-depth measures.

Answer

Enable Server-Side Encryption with KMS

Answer

Use IAM users for all S3 interactions

Question 8

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 9

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 10

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

Accepted Answer

Use Row-Level Security (RLS) within the database engine.. Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.

Answer

Use separate VPCs for every tenant.

Answer

Implement application-level filtering in the code.

Answer

Create separate database instances for every single tenant.

Question 11

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

Accepted Answer

Stateful Failover (Failover Link). The Cisco Failover Link is used to synchronize the state table, session information, and configuration between the active and standby units.

Answer

HSRP

Answer

OSPF

Answer

VRRP

Question 12

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

Accepted Answer

The default service account has excessive permissions and is shared across services.. The default service account often has 'Editor' permissions on the project, violating the principle of least privilege. It should be replaced with a dedicated, fine-grained identity.

Answer

Cloud Functions do not support custom service accounts.

Answer

The storage bucket requires a specific bucket-level IAM policy.

Answer

The default service account lacks the 'Owner' role.

Question 13

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

Accepted Answer

Use the Azure Policy add-on for Kubernetes to enforce an 'Allowed Container Images' policy.. Azure Policy for Kubernetes provides built-in policies to restrict container image registries and enforce image tagging, ensuring only trusted images are deployed.

Answer

Assign RBAC roles to all developers to prevent image pull actions.

Answer

Modify the Kubelet configuration files directly on the nodes.

Answer

Configure the Azure CLI to deny access to unauthorized ACR registries.

Question 14

To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?

Accepted Answer

Hardware-enforced isolation and constant-time execution paths.. Constant Time (CT) instructions and hardware-based mitigations like Intel SGX or isolation features prevent information leakage through timing side-channels.

Answer

Unified Extensible Firmware Interface (UEFI) Secure Boot.

Answer

PCIe bus encryption.

Answer

Trusted Platform Module (TPM) 2.0

Question 15

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

Accepted Answer

Mutual TLS (mTLS) with client certificates.. Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.

Answer

OAuth 2.0 Client Credentials flow.

Answer

HTTP Basic Authentication over HTTPS.

Answer

IP address filtering on the load balancer.

Question 16

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

Accepted Answer

API Schema Validation (OpenAPI/Swagger).. BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.

Answer

SQL injection filtering.

Answer

DDoS rate limiting.

Answer

Geo-blocking.

Question 17

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 18

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 19

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

Accepted Answer

Apply a Service Control Policy (SCP) to the Organizational Unit (OU).. Service Control Policies (SCPs) applied at the OU level can explicitly deny the 's3:PutBucketPolicy' action if the bucket is public, overriding any IAM user permissions.

Answer

Set up an AWS Config rule to delete buckets after creation.

Answer

Configure individual IAM policies for every user.

Answer

Enable S3 Block Public Access at the account level.

Question 20

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Accepted Answer

Deploy to a pilot group in 'Audit Mode' first.. Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.

Answer

Push a mass deployment with blocking enabled immediately.

Answer

Manually install the agent on every endpoint.

Answer

Exempt all legacy applications from EDR monitoring.