ISC Infrastructure And System Security Practice Test 3 — 15 Questions

Question 1

What is the primary purpose of a TPM chip in a laptop?

Accepted Answer

To store cryptographic keys and ensure platform integrity.. The Trusted Platform Module (TPM) stores cryptographic keys, performs hardware-based platform integrity checks, and enables secure boot.

Answer

To increase CPU performance.

Answer

To accelerate disk encryption.

Answer

To provide biometric authentication.

Question 2

A security architect is configuring IPsec VPN tunnels between two data centers. Which encryption standard provides the best balance of security and modern performance?

Accepted Answer

AES-GCM.. AES-GCM is the preferred choice for modern IPsec tunnels because it provides both confidentiality and authentication (AEAD) with hardware acceleration.

Answer

3DES

Answer

Blowfish

Answer

DES

Question 3

A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?

Accepted Answer

Using short-lived tokens with nonces.. Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.

Answer

Using IP-based restriction.

Answer

Using long-lived API keys.

Answer

Enabling HTTPS for all traffic.

Question 4

A developer needs to store sensitive secrets for an application. Which approach is considered the industry standard for cloud environments?

Accepted Answer

Using a cloud provider's Secret Management service.. Using a dedicated secret management service (e.g., AWS Secrets Manager, Azure Key Vault) allows for secure storage, automatic rotation, and granular access control.

Answer

Hardcoding them in a secure configuration file.

Answer

Storing them in Git using an encrypted file.

Answer

Passing them as command-line arguments at runtime.

Question 5

What is the primary function of an EDR (Endpoint Detection and Response) tool compared to traditional Antivirus?

Accepted Answer

To provide visibility and response to suspicious behavioral activity.. EDR focuses on continuous monitoring and recording of endpoint activities to enable investigation, threat hunting, and automated response to sophisticated threats.

Answer

To encrypt the hard drive.

Answer

To act as a personal firewall.

Answer

To block known file-based malware signatures.

Question 6

A cloud architect is defining a network security architecture for a multi-tier application. How should they protect the application tier from direct internet access?

Accepted Answer

Place the app tier in a private subnet and restrict ingress to the ALB.. Place the application tier in a private subnet with no public IP, and allow traffic only from the Load Balancer (ELB) security group.

Answer

Use a NACL to block all incoming traffic.

Answer

Deploy a WAF on each application instance.

Answer

Attach a public IP to every instance in the app tier.

Question 7

You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?

Accepted Answer

It verifies the integrity and origin of DNS responses.. DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.

Answer

It hides DNS queries from ISP monitoring.

Answer

It prevents DDoS attacks against DNS servers.

Answer

It increases the speed of DNS resolution.

Question 8

Which feature is essential for protecting against 'Credential Stuffing' attacks on an enterprise authentication portal?

Accepted Answer

Implementing Multi-Factor Authentication (MFA).. Multi-Factor Authentication (MFA) is the most effective defense against credential stuffing because compromised passwords alone are insufficient to gain access.

Answer

Limiting the password character set.

Answer

Increasing the session timeout.

Answer

Implementing a strong password policy.

Question 9

You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?

Accepted Answer

Exposure of the function's endpoint to the public internet.. When a serverless function is configured with 'Public' network access, its invocation endpoint (e.g., an AWS Lambda Function URL or API Gateway route with no authorizer) is reachable from any internet host without authentication or network-layer restriction. This directly expands the attack surface, allowing unauthenticated actors to invoke the function, probe for input-validation flaws, or abuse downstream permissions granted to the function's execution role. The core risk is therefore endpoint exposure, not performance or configuration limitations.

Answer

Higher cost of execution.

Answer

Inability to use environment variables.

Answer

Increased latency.

Question 10

When designing a secure API, which protocol is recommended for authorization?

Accepted Answer

OAuth 2.0.. OAuth 2.0 is the industry-standard authorization framework for enabling third-party applications to obtain limited access to an HTTP service.

Answer

RADIUS.

Answer

SAML 2.0.

Answer

LDAP.

Question 11

What is the primary security goal of an 'Air-Gapped' network segment?

Accepted Answer

To eliminate the possibility of remote network-based exploitation.. Total physical isolation ensures that no network traffic can enter or leave the segment, protecting critical systems from remote attacks.

Answer

To increase network bandwidth.

Answer

To simplify patch management.

Answer

To improve log collection.

Question 12

You are configuring a load balancer for a secure web application. Which setting ensures that cookies are protected?

Accepted Answer

Setting the 'Secure' and 'HttpOnly' flags.. The 'Secure' and 'HttpOnly' flags prevent cookies from being sent over unencrypted connections and restrict access via client-side scripts, mitigating XSS.

Answer

Enabling HTTP/2.

Answer

Increasing cookie expiration time.

Answer

Disabling session persistence.

Question 13

A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?

Accepted Answer

SELinux (Mandatory Access Control).. SELinux implements Mandatory Access Control (MAC), where the kernel enforces a system-wide policy that confines processes (domains) to only the resources (types) they are explicitly allowed to access, even if the process runs as root. This means a compromised process cannot read or write unauthorized files because the kernel denies access based on policy, not on user identity. This is the kernel-level confinement feature designed for exactly this scenario.

Answer

Sudoers file.

Answer

Standard Linux Permissions (rwx).

Answer

Cgroups.

Question 14

Which security measure is most effective at preventing unauthorized access to a physical data center?

Accepted Answer

Layered physical access controls.. Layered physical security (e.g., mantraps, badge access, surveillance) provides the most comprehensive defense for physical infrastructure.

Answer

Complex password requirements.

Answer

A robust firewall configuration.

Answer

Implementing an EDR solution.

Question 15

An organization is using Infrastructure as Code (IaC) to deploy resources. How can they ensure that developers do not introduce insecure configurations?

Accepted Answer

Automated Policy-as-Code scanning in the CI/CD pipeline.. Integrating automated policy-as-code tools (e.g., Checkov, Open Policy Agent) into the CI/CD pipeline enables automatic detection of misconfigurations before deployment.

Answer

Only allow senior architects to deploy resources.

Answer

Relying on developers to perform self-audits.

Answer

Manual code review of all commits.