ISC Timed Practice Test 1 — 10 Questions

Question 1

When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?

Accepted Answer

Access rights for cross-region data transfers.. Data residency requires physical and logical controls to ensure data stays where it should.

Answer

The primary domain registration provider.

Answer

Local marketing team access.

Question 2

What is the primary objective of a 'Compliance Gap Analysis' in a cloud migration project?

Accepted Answer

To document differences between current state and requirements.. A gap analysis identifies where the current architecture deviates from the target compliance framework.

Answer

To reduce cloud costs.

Answer

To increase the migration speed.

Answer

To select the best cloud provider.

Question 3

Which THREE criteria are most important when selecting a Cloud Service Provider (CSP) based on the Shared Responsibility Model for an ISSAP architect?

Accepted Answer

Capability to export logs and audit data.. Architects must ensure their CSP selection supports the organization's specific compliance and security needs.

Answer

The CSP's physical office location.

Answer

Market share size.

Question 4

You are deploying OIDC (OpenID Connect) for a web application. You need to prevent token replay attacks. Which claim should the application validate in the ID Token?

Accepted Answer

nonce. The 'nonce' claim is a cryptographically strong value that links the request to the response, allowing the client to verify that the ID Token was generated specifically for its request.

Answer

iss

Answer

iat

Answer

sub

Question 5

Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?

Accepted Answer

Use of a 'nonce' in the OIDC request.. DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.

Answer

Storing tokens in client-side cookies.

Answer

Disabling all token refresh capabilities.

Answer

Using long-lived access tokens.

Question 6

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

Accepted Answer

AppArmor. SELinux and AppArmor are the two industry-standard Linux kernel security modules that enforce mandatory access control (MAC).

Answer

iptables

Answer

Auditd

Answer

PAM

Question 7

An ISSAP architect is designing a cloud environment that must comply with PCI-DSS 4.0. Which specific AWS feature should be configured within the AWS Control Tower to ensure that all new member accounts automatically inherit the necessary preventative guardrails for non-compliant S3 bucket configurations?

Accepted Answer

Service Control Policies (SCPs). AWS Control Tower uses Service Control Policies (SCPs) via Guardrails to enforce preventative controls across the landing zone, which is the standard architectural approach for automated PCI compliance enforcement.

Answer

IAM Permission Boundaries

Answer

AWS Config Rules

Answer

AWS Security Hub Standards

Question 8

To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?

Accepted Answer

Vulnerability (Probability of Action). FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.

Answer

Software Patch Level

Answer

Network Throughput

Question 9

An ISSAP architect is working with developers to ensure that the code repository is compliant with secure coding standards. Which tool within the GitHub ecosystem is specifically designed to detect secrets (e.g., API keys) before they are committed?

Accepted Answer

GitHub Advanced Security Secret Scanning. GitHub Secret Scanning is the native tool designed to identify and block secrets from being pushed to repositories.

Answer

GitHub Actions

Answer

GitHub Dependabot

Answer

GitHub Codespaces

Question 10

When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?

Accepted Answer

Vendor's SOC2 Type II report.. TPRM requires understanding the vendor's security posture before onboarding.

Answer

Vendor's physical office decor.

Answer

Vendor's marketing language.