How should I use these Infrastructure And System Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

ISC · topic practice

Infrastructure And System Security practice questions

Q: Can I practise just Infrastructure And System Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Infrastructure And System Security domain.

Practise (ISC)2 Information Systems Security Architecture Professional (CISSP-ISSAP, Aug 2025 blueprint) (ISC) Infrastructure And System Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Infrastructure And System Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Infrastructure And System Security

Infrastructure And System Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Infrastructure And System Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Infrastructure And System Security questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Infrastructure And System Security explanation →

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

Trap 1: Azure Monitor

Azure Monitor collects telemetry but does not perform FIM.

Trap 2: Network Watcher

Network Watcher is for monitoring network topology and traffic, not host integrity.

Trap 3: Azure Bastion

Azure Bastion provides secure RDP/SSH access, not endpoint security monitoring.

Study all Infrastructure And System Security common traps →

A
Azure Monitor
Why wrong: Azure Monitor collects telemetry but does not perform FIM.
B
Microsoft Defender for Servers
This service includes the agent-based FIM and vulnerability assessment capabilities required.
C
Network Watcher
Why wrong: Network Watcher is for monitoring network topology and traffic, not host integrity.
D
Azure Bastion
Why wrong: Azure Bastion provides secure RDP/SSH access, not endpoint security monitoring.

Infrastructure And System Security practice questions

What to know about Infrastructure And System Security

Common Infrastructure And System Security exam traps

Infrastructure And System Security questions

A company is migrating legacy workloads to Azure and requires host-based intrusion detection with file integrity monitoring (FIM) across hybrid environments. Which service provides this integrated capability?

To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?

A security architect is hardening a Linux-based server environment. Which TWO of the following kernel-level security modules should be configured to enforce mandatory access control?

A security architect is configuring an AWS VPC to ensure that traffic between two subnets is inspected by a centralized firewall appliance. Which configuration provides the most resilient design?

You are deploying a Zero Trust architecture for a remote workforce. Which THREE of the following technologies should be implemented to effectively enforce granular access control at the application layer?

You are designing a Zero Trust architecture in AWS. Which mechanism should you implement to enforce granular access control between microservices running in EKS without relying on traditional IP-based security groups?

You are configuring AWS S3 bucket security for sensitive data. Which THREE of the following are best practices to prevent unauthorized public access?

You are designing a VPC architecture in AWS. You need to ensure that database instances in a private subnet can download patches from the internet without being directly reachable from the public internet. Which architecture component should you deploy?

A security engineer is designing a zero-trust architecture for a hybrid environment. They need to ensure that local service-to-service communication is encrypted without modifying application code. Which tool should be used?

A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?

When configuring Cisco ASA firewalls for high availability, which protocol is used to maintain state information between the primary and standby units?

You are auditing a GCP environment. You discover that a Cloud Function is accessing a Cloud Storage bucket using the default Compute Engine service account. What is the primary security risk?

An organization is deploying Azure Kubernetes Service (AKS). To enforce organizational compliance, they must restrict which container images can be deployed. What is the most effective approach?

To protect against side-channel attacks on shared infrastructure, which hardware feature should be verified on physical host servers?

Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?

A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?

You are designing a secure data enclave using Confidential Computing. Which technology allows you to verify that the code running inside the TEE (Trusted Execution Environment) has not been tampered with?

When designing a secure network, which zone should host public-facing services to minimize the risk of lateral movement to internal networks?

An organization is using AWS Control Tower. How should they implement guardrails to ensure that no S3 bucket is ever created publicly, regardless of the IAM user's intent?

An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?

Track your progress over time

Start a Infrastructure And System Security only practice session

Related ISC topic practice pages

Infrastructure And System Security practice questions

Security Architecture Modeling practice questions

Governance Risk And Compliance practice questions

Identity And Access Management Architecture practice questions

ISC fundamentals practice questions

ISC scenario practice questions

ISC troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid