ISC Infrastructure And System Security Practice Test 2 — 15 Questions

Question 1

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

Accepted Answer

API Schema Validation (OpenAPI/Swagger).. BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.

Answer

SQL injection filtering.

Answer

DDoS rate limiting.

Answer

Geo-blocking.

Question 2

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

Accepted Answer

Remote Attestation.. Remote Attestation allows a third party to verify the measurement (hash) of the code and the state of the TEE before providing sensitive keys.

Answer

Encrypted Page Tables.

Answer

Hardware Root of Trust (RoT).

Answer

Signed firmware updates.

Question 3

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

Accepted Answer

DMZ (Demilitarized Zone).. The DMZ (Demilitarized Zone) acts as a buffer, isolating public services from the internal trusted network.

Answer

Management LAN.

Answer

User Access Subnet.

Answer

Back-end database subnet.

Question 4

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

Accepted Answer

Apply a Service Control Policy (SCP) to the Organizational Unit (OU).. Service Control Policies (SCPs) applied at the OU level can explicitly deny the 's3:PutBucketPolicy' action if the bucket is public, overriding any IAM user permissions.

Answer

Set up an AWS Config rule to delete buckets after creation.

Answer

Configure individual IAM policies for every user.

Answer

Enable S3 Block Public Access at the account level.

Question 5

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Accepted Answer

Deploy to a pilot group in 'Audit Mode' first.. Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.

Answer

Push a mass deployment with blocking enabled immediately.

Answer

Manually install the agent on every endpoint.

Answer

Exempt all legacy applications from EDR monitoring.

Question 6

Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?

Accepted Answer

TLS-encrypted logging stream.. Syslog-ng or TLS-based transport ensures that logs are encrypted in transit and can be digitally signed to prevent tampering by an attacker.

Answer

Cleartext HTTP.

Answer

UDP Syslog.

Answer

SNMP v1.

Question 7

A security engineer needs to secure SSH access to Linux servers in a cloud VPC. What is the most secure method to replace static SSH keys?

Accepted Answer

Implement an SSH Certificate Authority (CA) system.. Short-lived, ephemeral SSH certificates generated by an Identity Provider (IdP) eliminate the need for static, long-lived keys.

Answer

Restrict SSH to a hardened bastion host.

Answer

Use a central password manager to rotate keys.

Answer

Require MFA for every single SSH connection.

Question 8

A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?

Accepted Answer

Use a Hardware Security Module (HSM).. Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.

Answer

Encrypt the keys with a password and store them in the database.

Answer

Hardcode keys into the application environment variables.

Answer

Store keys in a configuration file on the database server.

Question 9

An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?

Accepted Answer

Implement CI/CD pipeline security and IaC scanning.. Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.

Answer

Monitor CloudWatch logs for abnormal function execution.

Answer

Enable runtime application self-protection (RASP).

Answer

Regularly rotate the function's execution role.

Question 10

What is the primary purpose of a TPM chip in a laptop?

Accepted Answer

To store cryptographic keys and ensure platform integrity.. The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.

Answer

To increase CPU performance.

Answer

To accelerate disk encryption.

Answer

To provide biometric authentication.

Question 11

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

Accepted Answer

AES-GCM.. AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.

Answer

3DES

Answer

Blowfish

Answer

DES

Question 12

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 13

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

Accepted Answer

Using a cloud provider's Secret Management service.. Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.

Answer

Hardcoding them in a secure configuration file.

Answer

Storing them in Git using an encrypted file.

Answer

Passing them as command-line arguments at runtime.

Question 14

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 15

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.