ISC Practice Test 4 — 25 Questions

Question 1

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Istio with mTLS and AuthorizationPolicies.. Using a service mesh like Istio enables mTLS and granular authorization policies (RBAC) between microservices, which is the standard implementation for least privilege in containerized environments.

Answer

Use the default ClusterRoleBinding for all pods.

Answer

Deploy all microservices into a single flat network segment.

Answer

Enable Kubernetes NetworkPolicies only at the namespace level.

Question 2

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

Accepted Answer

Physical air-gapping and hardware-level encryption with HSMs.. Air-gapping (physical) combined with Hardware Security Modules (logical) provides the highest level of isolation for sensitive data.

Answer

Shared storage with ACLs.

Answer

VLAN tagging and firewall rules.

Answer

Container isolation with restricted network access.

Question 3

Which THREE items are required to verify the integrity of a downloaded software package?

Accepted Answer

The cryptographically signed hash (e.g., .asc or .sig file).. To verify integrity, you need the original package, the cryptographic hash of the package, and the signature or public key to verify that the hash was generated by the legitimate author.

Answer

The original source code repository URL.

Answer

The developer's password.

Question 4

You are assessing a system for compliance with FIPS 140-3. You need to ensure that the cryptographic module being used for TLS termination on a load balancer meets specific physical security requirements. Where should you look for the validation status of the cryptographic module?

Accepted Answer

NIST CMVP Module Registry. The NIST Cryptographic Module Validation Program (CMVP) maintains the official registry of all FIPS-validated modules.

Answer

Common Criteria Portal

Answer

CVE Database

Answer

ISO 27001 Annex A controls list

Question 5

You are designing an incident response architecture for a cloud environment. Which TWO of the following configurations are critical for ensuring effective forensic readiness according to NIST SP 800-61?

Accepted Answer

Centralizing logs in a read-only security account.. Forensic readiness requires high-fidelity, tamper-proof logs and centralized aggregation to ensure evidence integrity.

Answer

Using local disk storage for all incident response artifacts.

Answer

Enabling verbose debug mode on all production services.

Answer

Configuring short retention periods for all system logs to save cost.

Question 6

You are verifying the security configuration of an Amazon S3 bucket. Which S3 feature must be enabled to ensure that object deletions are reversible in case of accidental or malicious data loss?

Accepted Answer

S3 Versioning. S3 Versioning allows for the retrieval of previous versions of an object, even after deletion.

Answer

S3 Object Lock

Answer

S3 Block Public Access

Answer

S3 Lifecycle Policies

Question 7

Which THREE of the following are valid 'Authentication' factors?

Accepted Answer

Something you are (e.g., fingerprint). Authentication factors fall into categories: something you know, something you have, and something you are.

Answer

Where you sit in the office

Answer

Your mood at the time of login

Question 8

During a system migration, you need to ensure integrity of transferred data. What is the best cryptographic method?

Accepted Answer

Use HMAC for the data stream.. Using HMAC (Hash-based Message Authentication Code) with a shared key ensures both integrity and authenticity of the data stream.

Answer

Use TLS 1.0.

Answer

Use a simple CRC32 checksum.

Answer

Use base64 encoding.

Question 9

Which TWO items should be included in a system's security architecture documentation?

Accepted Answer

Network topology diagrams.. Network diagrams and data flow diagrams are essential for understanding the security posture of a system.

Answer

Marketing brochures for the software.

Answer

Office building blueprints.

Answer

Employee vacation schedules.

Question 10

A security engineer is validating the implementation of a TLS 1.3 configuration on an Nginx server. Which configuration directive must be verified to ensure only secure ciphers are used?

Accepted Answer

ssl_protocols TLSv1.3;. The 'ssl_protocols' and 'ssl_ciphers' directives are critical for TLS implementation verification.

Answer

ssl_session_cache shared:SSL:10m;

Answer

ssl_prefer_server_ciphers on;

Answer

ssl_verify_client on;

Question 11

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

Accepted Answer

Perform ping tests between VMs in different security zones.. Validating microsegmentation requires testing lateral movement between segments that should be isolated.

Answer

Inspect the physical switch port configuration.

Answer

Review the cloud provider's SLA.

Answer

Check the DNS records for the servers.

Question 12

When designing a system for 'High Integrity' (using the Biba model), which THREE rules must be enforced?

Accepted Answer

Simple Integrity Axiom (No Read Down). Biba is the dual of Bell-LaPadula: No Read Down (integrity) and No Write Up (integrity).

Answer

No Write Down

Answer

No Read Up

Question 13

What is the primary risk of a 'Privileged User' who lacks proper oversight?

Accepted Answer

They can bypass security controls and abuse access. Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.

Answer

They will slow down system performance

Answer

They cannot do their job

Answer

They will always be hackers

Question 14

An ISSEP is configuring an AWS S3 bucket. What policy setting best prevents public access while allowing access from a specific VPC?

Accepted Answer

Bucket Policy with 'Condition' element matching 'aws:SourceVpc'.. Using an S3 Bucket Policy with a 'Condition' block that checks the 'aws:SourceVpc' key is the standard way to restrict access to a private network.

Answer

Enable 'Block Public Access' and ACLs.

Answer

Create an IAM role for every user in the VPC.

Answer

Use an S3 Pre-signed URL.

Question 15

Which THREE elements are required in a high-security access control policy?

Accepted Answer

Authentication and authorization conditions.. Access control policies must define roles (who), resources (what), and the conditions (how/when) under which access is granted.

Answer

Employee home addresses.

Answer

Office kitchen menu.

Question 16

An organization is migrating to a Zero Trust architecture as defined in NIST SP 800-207. Which component is responsible for evaluating the context of a request, such as device health and location, before granting access?

Accepted Answer

Policy Decision Point (PDP). The Policy Decision Point (PDP) is the architectural component that evaluates requests against security policies and context.

Answer

Policy Enforcement Point (PEP)

Answer

Security Information and Event Management (SIEM)

Answer

Identity Provider (IdP)

Question 17

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Accepted Answer

Its role in processing sensitive information. Security-critical components are those that enforce policy, handle sensitive data, or provide security functions.

Answer

Its location in the physical facility

Answer

Its cost of procurement

Question 18

Which THREE of the following are necessary to successfully implement Zero Trust in an existing enterprise environment?

Accepted Answer

Identity-based authentication.. Strong identity verification, micro-segmentation of the network, and continuous monitoring are the three pillars of a successful Zero Trust implementation.

Answer

Using static IP addresses for all users.

Answer

Trusting all traffic behind the firewall.

Question 19

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

Accepted Answer

To define the minimum security requirements for a system category. A baseline establishes the minimum set of security controls required to protect the system based on its impact level.

Answer

To replace the need for a risk assessment

Answer

To audit employee performance

Answer

To automate the deployment of security patches

Question 20

Which THREE items should be included in an Incident Response (IR) plan for an information system?

Accepted Answer

Communication and notification procedures.. An IR plan must include roles and responsibilities, specific procedures for different attack types, and communication/reporting protocols.

Answer

The history of the company logo.

Answer

The CEO's personal home phone number.