ISC Multiple Select — 40 Questions

Question 1

Which THREE of the following are valid security controls for a database?

Accepted Answer

Enabling audit logging.. Encryption, auditing, and access control are fundamental database security controls.

Answer

Allowing anonymous access for testing.

Answer

Storing database credentials in plain text.

Question 2

Which TWO of the following are primary goals of conducting threat modeling during the architecture phase? (Select TWO)

Accepted Answer

Identify design-level security flaws. Threat modeling identifies design flaws and helps prioritize security investments.

Answer

Automate patch management

Answer

Perform penetration testing

Answer

Manage hardware inventory

Question 3

Which TWO are common challenges in Enterprise Security Architecture? (Select TWO)

Accepted Answer

Organizational silos. Managing organizational silos and maintaining alignment with changing business needs are top challenges.

Answer

Cable length limitations

Answer

OS license costs

Answer

Lack of hardware vendors

Question 4

Which TWO of the following are key benefits of 'Immutable Infrastructure'?

Accepted Answer

Prevents configuration drift.. Immutability prevents configuration drift and allows for rapid recovery.

Answer

Increases administrative overhead.

Answer

Reduces disk space usage.

Answer

Allows manual patching on live servers.

Question 5

Which THREE of the following are primary components of a typical Cisco ACI (Application Centric Infrastructure) fabric design used to enforce security segmentation?

Accepted Answer

Tenants. In Cisco ACI, security segmentation is enforced through the policy model built on Tenants (B), Contracts (C), and Endpoint Groups (D). Tenants (B) provide the logical container that isolates policy, routing, and security domains for different applications or business units within the fabric. Endpoint Groups (D) classify endpoints that share the same security and policy requirements, acting as the source/destination objects in the policy model. Contracts (C) define the permitted communication relationships between EPGs, specifying which protocols and ports are allowed, thereby enforcing segmentation between groups. Physical Port Security (A) is a Layer 2 switchport feature, not an ACI fabric segmentation construct, and VLAN Tagging (E) is a traditional network isolation mechanism that ACI abstracts away rather than using as a primary segmentation component.

Answer

Physical Port Security

Answer

VLAN Tagging

Question 6

Which TWO types of documentation are standard in the SABSA methodology? (Select TWO)

Accepted Answer

Business attribute profiles. SABSA requires business requirements documentation and security service specifications.

Answer

Daily status reports

Answer

Employee payroll records

Answer

Project budget sheets

Question 7

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 8

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 9

You are reviewing the security architecture of a Kubernetes cluster. Which TWO of the following configurations are considered best practices for preventing unauthorized container privilege escalation?

Accepted Answer

Setting allowPrivilegeEscalation to false in the SecurityContext. Option C is correct because setting allowPrivilegeEscalation to false in a container's SecurityContext prevents processes from gaining more privileges than their parent process, specifically blocking the setuid/setgid and file capability mechanisms that enable privilege escalation. Option D is correct because running containers as a non-root user (via runAsUser/runAsNonRoot in the SecurityContext) removes the default root privileges inside the container, so even if an attacker compromises the application, they lack the UID 0 capabilities needed to escalate. Option A is not a best practice for privilege escalation prevention; using a default Namespace for all workloads weakens isolation and RBAC scoping rather than restricting container privileges. Option B is unrelated, as increasing a pod's memory limit only affects resource allocation and has no bearing on privilege escalation. Option E is also unrelated, since enabling ClusterIP services merely exposes pods on an internal virtual IP for network access and does not affect container privilege levels.

Answer

Using a default Namespace for all workloads

Answer

Increasing the memory limit for pods

Answer

Enabling ClusterIP services

Question 10

Which THREE factors influence the choice of a security architecture framework? (Select THREE)

Accepted Answer

Organizational maturity. Regulatory requirements, organizational size, and business goals are key drivers for selecting a framework.

Answer

Hardware vendor preference

Answer

Office location

Question 11

Which TWO of the following are essential for a secure Cloud CI/CD pipeline?

Accepted Answer

Implementing automated security scanning (SAST/DAST).. Securing the pipeline requires protecting the build environment and ensuring the integrity of the artifacts being deployed.

Answer

Manual approval for every single build.

Answer

Hardcoding credentials in scripts.

Answer

Disabling build logs.

Question 12

When modeling threats for a microservices architecture, which TWO threats are most relevant due to service distribution? (Select TWO)

Accepted Answer

Insecure inter-service communication. Distributed architectures face significant risks related to lateral movement and insecure inter-service communication.

Answer

Browser compatibility

Answer

Disk fragmentation

Answer

CPU overheating

Question 13

Which THREE of the following are indicators of a potential system compromise?

Accepted Answer

Unexpected outbound network traffic.. Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).

Answer

Normal user logons.

Answer

Scheduled system backups.

Question 14

Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)

Accepted Answer

Verify explicitly. Zero Trust relies on explicit verification, least privilege, and assuming breach.

Answer

Trust but verify

Answer

Maximize perimeter defense

Question 15

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 16

Which TWO of the following are common methods to protect data during transit?

Accepted Answer

IPsec.. TLS and IPsec are the primary protocols for protecting data in transit.

Answer

Cleartext telnet.

Answer

Storing data on a local drive.

Answer

HTTP/1.1 (plain).

Question 17

Which THREE components are critical to ensuring secure 'Just-In-Time' (JIT) access?

Accepted Answer

Automated request and approval workflow.. A central request workflow, time-bound approval (TTL), and automated revocation are the three pillars of a secure JIT architecture.

Answer

Manual password sharing between users.

Answer

Permanent administrative role assignment.

Question 18

Which THREE criteria are typically evaluated by a Policy Decision Point (PDP) in a Zero Trust environment?

Accepted Answer

Device Posture/Health.. Identity context, device posture, and network/location context are the 'Three Pillars' of ZT policy evaluation.

Answer

The color scheme of the application.

Answer

The user's favorite browser.

Question 19

Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?

Accepted Answer

Validation of JWT/Auth tokens at the gateway.. Rate limiting (DDoS protection), authentication validation (at the edge), and logging (audit) are standard API Gateway security controls.

Answer

Disabling all logging for performance.

Answer

Allowing all traffic from any source IP.

Question 20

Which THREE elements are essential to define a trust boundary? (Select THREE)

Accepted Answer

Different access privileges. A trust boundary is defined by the transition between levels of access, authentication, or network zones.

Answer

Operating system type

Answer

Hardware vendor