ISC Infrastructure And System Security Practice Test 3 — 15 Questions

Question 1

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Accepted Answer

It verifies the integrity and origin of DNS responses.. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.

Answer

It hides DNS queries from ISP monitoring.

Answer

It prevents DDoS attacks against DNS servers.

Answer

It increases the speed of DNS resolution.

Question 2

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

Accepted Answer

Implementing Multi-Factor Authentication (MFA).. Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.

Answer

Limiting the password character set.

Answer

Increasing the session timeout.

Answer

Implementing a strong password policy.

Question 3

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

Accepted Answer

Exposure of the function's endpoint to the public internet.. If a function is not in a private VPC, it cannot interact with internal resources securely and is exposed to potential internet-based discovery and interaction.

Answer

Higher cost of execution.

Answer

Inability to use environment variables.

Answer

Increased latency.

Question 4

When designing a secure API, which protocol is recommended for authorization?

Accepted Answer

OAuth 2.0.. OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.

Answer

RADIUS.

Answer

SAML 2.0.

Answer

LDAP.

Question 5

What is the primary security goal of an 'Air-Gapped' network segment?

Accepted Answer

To eliminate the possibility of remote network-based exploitation.. Total physical isolation ensures that no network traffic can enter or leave the segment, protecting critical systems from remote attacks.

Answer

To increase network bandwidth.

Answer

To simplify patch management.

Answer

To improve log collection.

Question 6

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

Accepted Answer

Setting the 'Secure' and 'HttpOnly' flags.. The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.

Answer

Enabling HTTP/2.

Answer

Increasing cookie expiration time.

Answer

Disabling session persistence.

Question 7

A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?

Accepted Answer

SELinux (Mandatory Access Control).. SELinux (or AppArmor) uses Mandatory Access Control (MAC) to restrict process capabilities based on security policies, regardless of user privileges.

Answer

Sudoers file.

Answer

Standard Linux Permissions (rwx).

Answer

Cgroups.

Question 8

Which security measure is most effective at preventing unauthorized access to a physical data center?

Accepted Answer

Layered physical access controls.. Layered physical security (e.g., mantraps, badge access, surveillance) provides the most comprehensive defense for physical infrastructure.

Answer

Complex password requirements.

Answer

A robust firewall configuration.

Answer

Implementing an EDR solution.

Question 9

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

Accepted Answer

Automated Policy-as-Code scanning in the CI/CD pipeline.. Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.

Answer

Only allow senior architects to deploy resources.

Answer

Relying on developers to perform self-audits.

Answer

Manual code review of all commits.

Question 10

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 11

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 12

Which of the following is the most effective way to secure a remote access connection for employees?

Accepted Answer

VPN with Multi-Factor Authentication (MFA).. A VPN using MFA provides both encryption for the transit path and strong verification of user identity.

Answer

Using a simple password.

Answer

Allowing SSH access directly from the internet.

Answer

Opening RDP port 3389 to the world.

Question 13

Which THREE of the following are common network security architecture tools?

Accepted Answer

Intrusion Detection System (IDS).. Firewalls, IDS/IPS, and VPNs are foundational components of a secure network architecture.

Answer

Unencrypted Telnet.

Answer

Cleartext FTP server.

Question 14

You need to protect a legacy web application that cannot be patched. What is the best strategy?

Accepted Answer

Deploy a WAF to provide virtual patching.. Placing a Web Application Firewall (WAF) or an RASP solution in front of the application can filter malicious traffic before it reaches the vulnerable application.

Answer

Disable all logging.

Answer

Migrate the app to a new language.

Answer

Isolate the server on an isolated VLAN.

Question 15

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.