ISC Infrastructure And System Security — 25 Questions

Question 1

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security Groups. In NSX-T, the object used for grouping based on tags or attributes is called a 'Group' (or 'NSGroup' in API terms). 'Security Groups' is a term primarily associated with AWS or older NSX-V terminology. While the concept is correct, the terminology is technically inaccurate for NSX-T.

Answer

MAC Sets

Answer

Logical Ports

Answer

IP Sets

Question 2

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

Accepted Answer

Security Groups for Pods. Security Groups for Pods allows you to apply dedicated security groups directly to individual Kubernetes pods, enabling granular access control between microservices in Amazon EKS without relying strictly on traditional node-level IP security groups.

Answer

VPC Flow Logs

Answer

AWS WAF

Answer

AWS App Mesh with Envoy sidecars

Question 3

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

Accepted Answer

Apply a bucket policy with an explicit Deny for s3:PutObject for unauthenticated users. Option A is correct because an explicit Deny in a bucket policy for s3:PutObject to unauthenticated principals (for example, Principal "*" with a condition on aws:PrincipalType or unauthenticated requests) overrides any Allow and blocks anonymous uploads, which is a key defense against unauthorized public write access. Option B is correct because enabling S3 Block Public Access at the bucket level applies the four settings (BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets) that reject public ACLs and public bucket policies for that bucket. Option D is correct because enabling S3 Block Public Access at the account level applies those same protections to every bucket in the account, ensuring new or existing buckets cannot be made public even if a bucket-level setting is misconfigured. Option C is not among the correct answers because SSE-KMS provides encryption at rest and does not by itself prevent public access or anonymous requests. Option E is not among the correct answers because using IAM users is a general access-management approach and does not specifically enforce the public-access blocking controls required to prevent unauthorized public access.

Answer

Enable Server-Side Encryption with KMS

Answer

Use IAM users for all S3 interactions

Question 4

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

Accepted Answer

Implement application-level filtering in the code.. Implementing application-level filtering combined with tenant context passed with every query or ORM filter ensures data isolation specifically at the application layer. Alternatively, if RLS is used, it is a database-layer control. To strictly answer 'at the application layer', application-level filtering or context-aware query generation is the correct strategy.

Answer

Use Row-Level Security (RLS) within the database engine.

Answer

Use separate VPCs for every tenant.

Answer

Create separate database instances for every single tenant.

Question 5

To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?

Accepted Answer

Hardware-enforced isolation and constant-time execution paths.. Constant Time (CT) instructions and hardware-based mitigations like Intel SGX or isolation features prevent information leakage through timing side-channels.

Answer

Unified Extensible Firmware Interface (UEFI) Secure Boot.

Answer

PCIe bus encryption.

Answer

Trusted Platform Module (TPM) 2.0

Question 6

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

Accepted Answer

API Schema Validation (OpenAPI/Swagger).. BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.

Answer

SQL injection filtering.

Answer

DDoS rate limiting.

Answer

Geo-blocking.

Question 7

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

Accepted Answer

Apply a Service Control Policy (SCP) to the Organizational Unit (OU).. Service Control Policies (SCPs) applied at the Organizational Unit (OU) level can be used in AWS Control Tower as preventive guardrails to restrict actions across all accounts in that OU, overriding IAM permissions. While S3 Block Public Access is an important setting, SCPs are the native mechanism used by Control Tower to enforce guardrails centrally at scale.

Answer

Set up an AWS Config rule to delete buckets after creation.

Answer

Configure individual IAM policies for every user.

Answer

Enable S3 Block Public Access at the account level.

Question 8

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Cloud provider outage.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Lack of encryption at rest.

Answer

Missing object versioning.

Question 9

Which THREE of the following are components of a defense-in-depth strategy?

Accepted Answer

Network-based IDS/IPS.. Defense-in-depth uses layers of security including host, network, and application controls.

Answer

Allowing all traffic on all ports.

Answer

Ignoring all logs.

Question 10

You are configuring a Palo Alto Networks NGFW to secure traffic between a database zone and an application zone. To ensure that only specific SQL queries are allowed while preventing SQL injection, which specific security feature must be configured within the Security Profile?

Accepted Answer

Vulnerability Protection Profile. Vulnerability protection profiles allow for specific signatures to be applied to block SQL injection attempts at the application layer.

Answer

Data Filtering Profile

Answer

URL Filtering Profile

Answer

App-ID based policy enforcement

Question 11

You are deploying a HashiCorp Vault cluster for secret management. To ensure that the root keys are never held by a single administrator, which mechanism must you enable during the initialization process?

Accepted Answer

Shamir's Secret Sharing. Vault utilizes Shamir's Secret Sharing to split the unseal key into multiple shares, requiring a quorum to unseal the vault.

Answer

Transit Secret Engine

Answer

Token Authentication

Answer

Auto-Unseal via AWS KMS

Question 12

A security administrator is hardening a Windows Server 2022 environment. They need to ensure that local administrative accounts cannot be used to remotely log into other servers in the domain. Which Active Directory Group Policy setting should be configured?

Accepted Answer

User Rights Assignment: Deny log on through Remote Desktop Services. Restricted Groups or the newer 'Group Policy Preferences > Local Users and Groups' can be used, but specifically, to mitigate lateral movement, 'Deny log on through Remote Desktop Services' is the standard hardening control for local admins.

Answer

Minimum Password Length

Answer

Audit Logon Events

Answer

Account Lockout Threshold

Question 13

Which THREE of the following items should be addressed when designing a secure remote access architecture for a hybrid cloud environment using a VPN gateway?

Accepted Answer

AES-256 encryption for the IKE/IPsec tunnel. A secure design requires robust authentication (MFA), transport security (encryption), and granular authorization (least privilege).

Answer

Public IP address assignment for all internal nodes

Answer

Disabling logging to reduce overhead

Question 14

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Accepted Answer

Microsoft Defender for Servers. Microsoft Defender for Servers (part of Microsoft Defender for Cloud) provides the integrated FIM and endpoint protection features required for hybrid cloud/on-premises machines.

Answer

Azure Monitor

Answer

Network Watcher

Answer

Azure Bastion

Question 15

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 16

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

Accepted Answer

Deploy a Gateway Load Balancer (GWLB) and use VPC Ingress Routing to route traffic through the fleet.. Using AWS Gateway Load Balancer (GWLB) with VPC Ingress Routing ensures that traffic is transparently intercepted and inspected by the firewall before reaching the destination, providing higher scalability than static routing.

Answer

Configure static route tables on all subnets to point to the firewall's ENI.

Answer

Implement a transparent bridge on each EC2 instance in the destination subnet.

Answer

Utilize AWS Transit Gateway with route tables that hairpin traffic to a security VPC.

Question 17

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

Accepted Answer

Policy-Based Access Control (PBAC). Micro-segmentation, Identity-Aware Proxy (IAP), and Policy-Based Access Control (PBAC) are pillars of modern Zero Trust architecture.

Answer

Traditional VPN

Answer

Network Perimeter Firewall

Question 18

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

Accepted Answer

NAT Gateway. A NAT Gateway allows instances in a private subnet to connect to the internet (e.g., for software updates) while preventing the internet from initiating a connection with those instances.

Answer

Internet Gateway

Answer

VPC Endpoint

Answer

Egress-Only Internet Gateway

Question 19

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

Accepted Answer

Configure Istio with an mTLS PeerAuthentication policy.. A service mesh, such as Istio, provides mutual TLS (mTLS) for all service-to-service communication transparently through sidecar proxies, requiring no application changes.

Answer

Implement IPsec tunnels between all application servers.

Answer

Hardcode SSL libraries into each application binary.

Answer

Deploy a global VPN concentrator for all intra-datacenter traffic.

Question 20

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

Accepted Answer

Stateful Failover (Failover Link). Cisco ASA high availability uses a dedicated failover link to exchange state information between the active and standby units, a feature called Stateful Failover. This link synchronizes connection tables, translation tables, and other stateful data so the standby can take over without dropping established sessions. This is why A is correct.

Answer

HSRP

Answer

OSPF

Answer

VRRP