ISC Infrastructure And System Security Practice Test 4 — 15 Questions

Question 1

You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?

Accepted Answer

Use OIDC federation between cloud providers.. Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.

Answer

Email the credentials to the other team.

Answer

Use a shared S3 bucket to store keys.

Answer

Hardcode credentials in both environments.

Question 2

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 3

Which of the following is the most effective way to secure a remote access connection for employees?

Accepted Answer

VPN with Multi-Factor Authentication (MFA).. A VPN using MFA provides both encryption for the transit path and strong verification of user identity.

Answer

Using a simple password.

Answer

Allowing SSH access directly from the internet.

Answer

Opening RDP port 3389 to the world.

Question 4

Which THREE of the following are common network security architecture tools?

Accepted Answer

Intrusion Detection System (IDS).. Firewalls, IDS/IPS, and VPNs are foundational components of a secure network architecture.

Answer

Unencrypted Telnet.

Answer

Cleartext FTP server.

Question 5

You need to protect a legacy web application that cannot be patched. What is the best strategy?

Accepted Answer

Deploy a WAF to provide virtual patching.. Placing a Web Application Firewall (WAF) or an RASP solution in front of the application can filter malicious traffic before it reaches the vulnerable application.

Answer

Disable all logging.

Answer

Migrate the app to a new language.

Answer

Isolate the server on an isolated VLAN.

Question 6

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 7

Which TWO of the following are best practices for securing API endpoints?

Accepted Answer

Using OAuth/OIDC for authentication.. Rate limiting and strong authentication are foundational API security practices.

Answer

Publicly exposing all internal endpoints.

Answer

Ignoring input validation.

Answer

Requiring no authentication for GET requests.

Question 8

Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?

Accepted Answer

Always verify explicitly.. Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.

Answer

Trust all internal network traffic.

Answer

Use static, long-lived access tokens.

Question 9

Which TWO of the following are key requirements for securing a container orchestrator like Kubernetes?

Accepted Answer

Implementing Network Policies to restrict pod communication.. Securing Kubernetes requires protecting the control plane and enforcing isolation through policies.

Answer

Exposing the Kube API to the public internet.

Answer

Running all pods with root privileges.

Answer

Disabling RBAC.

Question 10

Which TWO of the following are essential for protecting against SQL Injection?

Accepted Answer

Using parameterized queries (prepared statements).. Prepared statements and input validation are the primary defenses against SQLi.

Answer

Using dynamic SQL building in code.

Answer

Disabling error logging entirely.

Answer

Running the database as root.

Question 11

Which THREE of the following are critical for a secure identity architecture?

Accepted Answer

Enforcing Multi-Factor Authentication (MFA).. Multi-factor authentication, least privilege, and robust auditing are required for identity security.

Answer

Sharing accounts between users.

Answer

Using passwords as the only factor.

Question 12

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 13

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.

Question 14

Which TWO of the following are fundamental pillars of information security (CIA triad)?

Accepted Answer

Confidentiality.. The CIA triad consists of Confidentiality, Integrity, and Availability.

Answer

User Friendliness.

Answer

Cost effectiveness.

Answer

Performance.

Question 15

Which THREE of the following are best practices for securing a remote worker's endpoint?

Accepted Answer

EDR solution for threat monitoring.. Endpoint protection, disk encryption, and VPN usage are critical for remote endpoints.

Answer

Disabling the lock screen.

Answer

Using a shared local account.