ISC Multiple Select — 10 Questions

Question 1

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 2

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 3

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Accepted Answer

Use of a 'nonce' in the OIDC request.. DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

Answer

Storing tokens in client-side cookies.

Answer

Disabling all token refresh capabilities.

Answer

Using long-lived access tokens.

Question 4

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 5

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 6

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

Accepted Answer

Vendor's SOC2 Type II report.. TPRM requires understanding the vendor's security posture before onboarding.

Answer

Vendor's physical office decor.

Answer

Vendor's marketing language.

Question 7

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 8

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 9

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Accepted Answer

Exposure of static, long-lived credentials.. Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

Answer

Incompatible authentication protocols.

Answer

Network latency during authentication.

Answer

Lack of granular auditing of privileged actions.

Question 10

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.