ISC Practice Test 10 — 10 Questions

Question 1

An organization is migrating to a Zero Trust architecture as defined in NIST SP 800-207. Which component is responsible for evaluating the context of a request, such as device health and location, before granting access?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Policy Decision Point (PDP). The Policy Decision Point (PDP) is the architectural component that evaluates requests against security policies and context.

Answer

Policy Enforcement Point (PEP)

Answer

Security Information and Event Management (SIEM)

Answer

Identity Provider (IdP)

Question 2

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Accepted Answer

Its role in processing sensitive information. Security-critical components are those that enforce policy, handle sensitive data, or provide security functions.

Answer

Its location in the physical facility

Answer

Its cost of procurement

Question 3

Which THREE of the following are necessary to successfully implement Zero Trust in an existing enterprise environment?

Accepted Answer

Identity-based authentication.. Strong identity verification, micro-segmentation of the network, and continuous monitoring are the three pillars of a successful Zero Trust implementation.

Answer

Using static IP addresses for all users.

Answer

Trusting all traffic behind the firewall.

Question 4

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

Accepted Answer

To define the minimum security requirements for a system category. A baseline establishes the minimum set of security controls required to protect the system based on its impact level.

Answer

To replace the need for a risk assessment

Answer

To audit employee performance

Answer

To automate the deployment of security patches

Question 5

Which THREE items should be included in an Incident Response (IR) plan for an information system?

Accepted Answer

Communication and notification procedures.. An IR plan must include roles and responsibilities, specific procedures for different attack types, and communication/reporting protocols.

Answer

The history of the company logo.

Answer

The CEO's personal home phone number.

Question 6

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

Accepted Answer

They provide insights into potential system threats. Misuse cases define what a malicious actor might try to do to the system, helping to derive security requirements.

Answer

They automate the generation of firewall rules

Answer

They replace the need for unit testing

Answer

They track the progress of development sprints

Question 7

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

Accepted Answer

Zero-trust network architecture. Cloud security relies on zero-trust and defense-in-depth principles implemented through infrastructure-as-code and micro-segmentation.

Answer

Hardcoded credentials in application code

Answer

Public access to all S3 buckets

Answer

Monolithic application architecture

Question 8

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

Accepted Answer

SOC 2 Type II or equivalent audit reports. Assessing a CSP involves reviewing their security certifications, physical controls, and logical security isolation capabilities.

Answer

Employee cafeteria menu

Answer

Office interior design plans

Question 9

You are designing a secure microservices architecture. To meet the 'Data at Rest' security requirements, you decide to use envelope encryption. Which sequence correctly describes the flow of managing the Data Encryption Key (DEK)?

Accepted Answer

Encrypt data with DEK, encrypt DEK with KEK, store encrypted DEK with data.. Envelope encryption involves encrypting data with a DEK, then encrypting the DEK with a Key Encryption Key (KEK), storing the encrypted DEK alongside the data.

Answer

Encrypt data with KEK, encrypt KEK with DEK, store KEK in HSM.

Answer

Encrypt data with HSM-stored master key, store master key in memory.

Answer

Generate new DEK for every block, store all DEKs in a database.

Question 10

During a penetration test of a web application, you identify an insecure direct object reference (IDOR). What is the most effective way to verify that your remediation via access control checks is successful?

Accepted Answer

Execute automated authorization testing using a tool like Burp Suite Intruder to verify that non-authorized users receive a 403 Forbidden response.. Regression testing ensures that the fix addresses the vulnerability without breaking functionality.

Answer

Review the source code to ensure that the developer used a random UUID instead of sequential integers.

Answer

Run a vulnerability scanner to check for OWASP Top 10 compliance.

Answer

Perform a manual cross-site scripting (XSS) payload injection to confirm input sanitization.