ISC Multiple Select — 50 Questions

Question 1

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 2

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 3

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Accepted Answer

Use of a 'nonce' in the OIDC request.. DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

Answer

Storing tokens in client-side cookies.

Answer

Disabling all token refresh capabilities.

Answer

Using long-lived access tokens.

Question 4

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 5

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 6

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

Accepted Answer

Vendor's SOC2 Type II report.. TPRM requires understanding the vendor's security posture before onboarding.

Answer

Vendor's physical office decor.

Answer

Vendor's marketing language.

Question 7

An architect is evaluating compliance for an enterprise multi-cloud environment. Which THREE capabilities must be included in a centralized GRC platform for it to be effective?

Accepted Answer

API-based integration with cloud providers.. Centralized GRC platforms must integrate with infrastructure to remain relevant and accurate.

Answer

Encrypted email notification system.

Answer

Manual spreadsheet uploading only.

Question 8

Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?

Accepted Answer

Regulatory and legal obligations.. Risk appetite must align with business goals and legal requirements to be effective.

Answer

Vendor support availability.

Answer

Technical debt of legacy systems.

Answer

The number of cloud accounts.

Question 9

Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?

Accepted Answer

Exposure of static, long-lived credentials.. Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.

Answer

Incompatible authentication protocols.

Answer

Network latency during authentication.

Answer

Lack of granular auditing of privileged actions.

Question 10

Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?

Accepted Answer

Conduct a formal risk assessment of the new service.. New cloud services require updated risk assessments and governance mapping.

Answer

Increase the organization's total headcount.

Answer

Immediately decommission the old service.

Answer

Rename the existing risk registers.

Question 11

Which THREE of the following are risks associated with using shared cloud storage buckets?

Accepted Answer

Accidental public access.. Public access, lack of encryption, and missing object versioning are common risks.

Answer

Cloud provider outage.

Answer

Excessive bandwidth usage.

Question 12

Which THREE types of claims are typically included in a JSON Web Token (JWT)?

Accepted Answer

Private claims (custom app-specific claims).. Registered claims (standardized), Private claims (custom), and Public claims (namespaced) are the types of claims in JWT.

Answer

Hardware serial number claims.

Answer

Root password claims.

Question 13

Which TWO factors are mandatory for a secure 'MFA' implementation?

Accepted Answer

Validation of multiple independent credentials.. MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).

Answer

Exclusion of any knowledge-based factors.

Answer

The use of a proprietary hardware token only.

Answer

The use of only biometric factors.

Question 14

When designing an architecture for GDPR compliance, which THREE technical controls should be prioritized to satisfy the 'Right to be Forgotten' requirement?

Accepted Answer

Data discovery and tagging tools.. Right to be forgotten requires finding and securely deleting data across potentially distributed systems.

Answer

Single Sign-On (SSO) integration.

Answer

Database audit logs.

Question 15

Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?

Accepted Answer

Device security posture. Zero Trust evaluates the context of the user, the device, and the resource being accessed to make a dynamic decision.

Answer

User's physical office desk number

Answer

The color of the device chassis

Question 16

Which TWO of the following are essential for protecting against SQL Injection?

Accepted Answer

Using parameterized queries (prepared statements).. Prepared statements and input validation are the primary defenses against SQLi.

Answer

Using dynamic SQL building in code.

Answer

Disabling error logging entirely.

Answer

Running the database as root.

Question 17

Which THREE features are essential for a robust Privileged Access Management (PAM) architecture that adheres to the principle of least privilege?

Accepted Answer

Granular Role-Based Access Control (RBAC). Credential vaulting, session recording, and granular access delegation are core pillars of PAM.

Answer

Automatic network topology mapping

Answer

Public cloud storage for logs

Question 18

Which THREE mechanisms are commonly used to secure the 'Authorization Code' in an OAuth 2.0 flow?

Accepted Answer

Implementing PKCE (Proof Key for Code Exchange).. HTTPS (transport security), PKCE (binding code to request), and short-lived tokens/codes are standard security measures.

Answer

Storing the code in a public client's local storage.

Answer

Sending the code in the URL fragment of a redirect.

Question 19

Which THREE of the following are common network security architecture tools?

Accepted Answer

Intrusion Detection System (IDS).. Firewalls, IDS/IPS, and VPNs are foundational components of a secure network architecture.

Answer

Unencrypted Telnet.

Answer

Cleartext FTP server.

Question 20

Which TWO concepts are central to 'Federated Identity'?

Accepted Answer

A centralized Identity Provider (IdP).. A central Identity Provider (IdP) and the establishment of 'Trust' between organizations are the core concepts of federation.

Answer

The requirement for the same OS on all servers.

Answer

The use of a shared local database on each server.

Answer

Public IP address matching.