208 questions total · 3pages · All types, answers revealed
Page 1 of 3
Page 2Which THREE of the following are components of a defense-in-depth strategy?
Another layer of defense.
Why this answer
Defense-in-depth uses layers of security including host, network, and application controls.
You are designing a Zero Trust architecture in AWS. You need to implement micro-segmentation for a set of EC2 instances running a web application. Which AWS feature provides the most granular control over traffic flow between specific instances within the same VPC subnet?
Security Groups act as a virtual firewall for EC2 instances to control inbound and outbound traffic.
Why this answer
Security Groups are stateful and provide instance-level (interface-level) filtering, making them the appropriate tool for micro-segmentation within a subnet.
When establishing a Third-Party Risk Management (TPRM) process, which THREE factors must be considered during the initial due diligence?
Provides assurance of control effectiveness.
Why this answer
TPRM requires understanding the vendor's security posture before onboarding.
Which TWO of the following are essential for protecting against SQL Injection?
The most effective defense against SQLi.
Why this answer
Prepared statements and input validation are the primary defenses against SQLi.
When designing an architecture, which principle states that a system should be designed to be secure even if other security measures fail?
This involves layering security controls.
Why this answer
Defense in depth ensures that if one layer fails, others remain to protect the system.
Which TWO factors are mandatory for a secure 'MFA' implementation?
Independent validation is key to security.
Why this answer
MFA requires at least two distinct authentication factors from different categories (e.g., possession and knowledge).
Which security measure is most effective at preventing unauthorized access to a physical data center?
Physical barriers are the only defense against physical intrusion.
Why this answer
Layered physical security (e.g., mantraps, badge access, surveillance) provides the most comprehensive defense for physical infrastructure.
In a cloud architecture, what does the 'Principle of Least Privilege' (PoLP) imply regarding IAM roles?
This aligns with PoLP.
Why this answer
PoLP requires that identities are granted only the minimum permissions necessary to perform their assigned task, for the minimum duration required.
Which protocol should be prioritized when designing a secure logging infrastructure to prevent log tampering?
TLS provides both encryption and data integrity for log transport.
Which THREE of the following are common network security architecture tools?
Essential for monitoring and alerting.
Which THREE attributes should be evaluated when defining access policies in a modern Zero Trust Architecture?
Health and compliance status of the device is critical for access decisions.
Why this answer
Zero Trust evaluates the context of the user, the device, and the resource being accessed to make a dynamic decision.
Which TWO concepts are central to 'Federated Identity'?
The broker for identity claims.
Why this answer
A central Identity Provider (IdP) and the establishment of 'Trust' between organizations are the core concepts of federation.
You are configuring an AWS IAM policy to allow a user to list S3 buckets only if they are connected from a specific IP range. Which policy element is required?
The condition block implements the network-based access control.
Why this answer
The 'Condition' block is used to enforce context-based restrictions, such as 'aws:SourceIp', within an IAM policy.
To secure internal traffic within a VMware NSX-T environment using distributed firewalling, which object type is recommended for defining policies based on application identity rather than network topology?
Security Groups support dynamic membership based on tags, facilitating intent-based policy.
Why this answer
Security Groups in NSX-T allow administrators to bundle virtual machines based on tags or attributes, enabling identity-based micro-segmentation that persists regardless of IP changes.
When documenting a cloud-based architecture, which aspect is most critical to document for compliance?
This defines the division of security tasks between parties.
Why this answer
Shared Responsibility Model documentation is essential to define which security controls the provider manages vs. the customer.
When implementing FIDO2/WebAuthn for passwordless authentication, where does the private key reside?
The private key is bound to the FIDO2-compliant device.
Why this answer
In FIDO2, the private key is stored securely on the local authenticator (e.g., TPM, Secure Enclave, or hardware security key) and never leaves the device.
What is the primary security goal of an 'Air-Gapped' network segment?
Physical isolation prevents all network-based access.
Why this answer
Total physical isolation ensures that no network traffic can enter or leave the segment, protecting critical systems from remote attacks.
You are implementing threat modeling using the PASTA (Process for Attack Simulation and Threat Analysis) framework. What is the primary output of Stage 2?
Stage 2 involves identifying the architecture and technical scope.
Why this answer
Stage 2 of PASTA is defining the technical scope, which identifies assets, trust boundaries, and data flows.
In a SABSA (Sherwood Applied Business Security Architecture) model, you are mapping business attributes to security services. Which layer focuses on the 'What' from a business perspective?
The Contextual layer defines the business scope and 'What' the business needs.
Why this answer
SABSA uses a matrix where the Contextual layer (Layer 1) defines the 'What' (Business requirements).
When designing a secure multi-region cloud architecture, which THREE governance aspects must be clearly defined for data residency compliance?
Prevents unauthorized data migration.
Why this answer
Data residency requires physical and logical controls to ensure data stays where it should.
Which architectural principle is fundamental to implementing Zero Trust in a microservices environment?
Zero Trust requires verifying every connection regardless of origin, supported by granular segmentation.
Why this answer
Zero Trust assumes the network is compromised, requiring explicit verification for every request, typically via identity-based micro-segmentation.
A company is moving to a multi-tenant SaaS environment. To ensure data isolation between tenants at the application layer, what is the most robust strategy?
RLS provides strong, built-in isolation at the data tier.
Why this answer
Row-level security (RLS) or tenant-aware database schemas ensure that even if an application query is malformed, the database enforces isolation based on the tenant ID.
You are auditing a serverless architecture and find that functions are configured to use 'Public' network access. What is the biggest risk?
This exposes the attack surface and prevents internal network isolation.
Why this answer
If a function is not in a private VPC, it cannot interact with internal resources securely and is exposed to potential internet-based discovery and interaction.
Which authentication factor is considered 'inherence'?
Biometrics represent the 'inherence' factor.
Why this answer
Inherence factors are based on something the user is, such as biometrics (fingerprint, iris scan, facial recognition).
Which TWO methods are used to prevent 'Token Replay' attacks in an OAuth/OIDC architecture?
Links the response token to the request.
Why this answer
DPoP and nonces are both techniques used to bind tokens to the specific request session, preventing replay.
A security engineer is hardening a Linux system. Which kernel-level feature should be used to restrict processes so that even if they are compromised, they cannot access unauthorized files?
MAC provides a system-wide policy that is enforced regardless of user uid.
Why this answer
SELinux (or AppArmor) uses Mandatory Access Control (MAC) to restrict process capabilities based on security policies, regardless of user privileges.
A security architect is designing an authentication flow for a distributed system. Which method provides the best defense against replay attacks?
Nonces and short lifespans prevent attackers from reusing captured credentials.
Why this answer
Using a nonce or a short-lived token with a timestamp ensures that each authentication request is unique and can only be processed once.
Which THREE principles are core to a 'Zero Trust' architecture? (Select THREE)
Core Zero Trust pillar.
Why this answer
Zero Trust relies on explicit verification, least privilege, and assuming breach.
Which THREE components are involved in a standard OIDC authentication flow?
The user initiates the auth process.
Why this answer
The End User, the Relying Party (RP/Client), and the OpenID Provider (OP/IdP) are the standard actors in the OIDC flow.
Which governance model is characterized by decision-making being centralized at the corporate level to ensure consistency across the entire organization?
Focuses on uniformity from the top down.
Why this answer
Centralized governance provides consistent policy enforcement, though it may be less agile than decentralized models.
A firm wants to implement an 'Infrastructure-as-Code' security gate. Using AWS CloudFormation, which feature should be utilized to perform security checks on templates before they are provisioned?
Designed specifically for template validation.
Why this answer
CloudFormation Guard is an open-source tool that lets developers define policy-as-code to validate CloudFormation templates before deployment.
To implement governance for containerized workloads, which Kubernetes feature should an architect use to enforce that only images from a trusted registry are deployed?
Intercepts requests to enforce policy.
Why this answer
Admission Controllers (specifically OPA/Gatekeeper) are the mechanism in Kubernetes to enforce policy at the point of request.
Which THREE of the following are indicators of a potential system compromise?
Common sign of C2 activity.
Why this answer
Unusual login times, unauthorized file modification, and unexpected network traffic are common indicators of compromise (IoC).
When designing a secure API architecture, which pattern is the industry standard for securing inter-service communication?
mTLS provides robust cryptographic identity for services.
Why this answer
mTLS (mutual TLS) ensures that both parties in a connection verify each other's identity.
An organization must maintain HIPAA compliance in a hybrid cloud. Which architecture pattern best enables strict separation of duties between the administrative team and the data encryption keys?
Provides physical control and separation of duties for keys.
Why this answer
Using an external HSM (Hardware Security Module) like AWS CloudHSM ensures that administrators of the cloud infrastructure have no access to the keys, fulfilling the separation of duties requirement.
When conducting threat modeling using the STRIDE methodology, which category addresses a user gaining unauthorized access to an administrative account?
Elevation of privilege is the correct category for unauthorized access escalation.
Why this answer
Elevation of Privilege (E) occurs when a user gains access rights they should not possess.
To implement effective Risk Management integration into architecture using the FAIR (Factor Analysis of Information Risk) framework, which THREE metrics must an architect define for each identified scenario?
Crucial for determining if a threat results in a loss event.
Why this answer
FAIR focuses on quantifying loss event frequency and magnitude, which requires specific variables.
A firm is deploying a Just-In-Time (JIT) access model using CyberArk. Which component architecture is required to perform privileged session recording while ensuring the vault is not directly exposed to the internet?
The PSM handles the protocol proxying and visual recording of the privileged session.
Why this answer
The PSM (Privileged Session Manager) acts as a proxy, allowing session recording and isolation without exposing the vault directly to the endpoint.
What is the primary function of a Security Reference Architecture (SRA)?
An SRA provides reusable designs and standards.
Why this answer
SRA provides a proven, standardized model for security design that ensures consistency across an enterprise.
A company is implementing database encryption at rest. What is the most secure way to handle the master encryption keys?
HSMs are specifically designed for the secure management of cryptographic keys.
Why this answer
Using a FIPS 140-2 Level 3 Hardware Security Module (HSM) ensures that the master keys are never exposed in plaintext and are protected by tamper-evident hardware.
In a Zero Trust architecture, what is the primary role of a Policy Decision Point (PDP)?
The PDP is the 'brain' of the Zero Trust access flow.
Why this answer
The PDP is the architectural component that evaluates requests against predefined policies and returns an allow or deny decision to the Policy Enforcement Point (PEP).
You are troubleshooting an OIDC flow where the client fails to fetch the user information. What is the correct OIDC endpoint to call?
This is for fetching user profile information.
Why this answer
The UserInfo endpoint (defined in the OIDC discovery metadata) is used to retrieve claims about the authenticated user using an access token.
What is the primary function of a Security Content Automation Protocol (SCAP) in architecture?
SCAP is a framework for automated vulnerability and configuration checking.
Why this answer
SCAP provides a standardized way to automate security vulnerability management and configuration assessment.
Which TWO risks are significantly mitigated by implementing a Privileged Access Management (PAM) vault?
Vaults rotate and hide secrets.
Why this answer
Credential theft (from local storage) and persistent standing privileges are primary risks mitigated by PAM vaults.
Which TWO factors are critical when establishing a Risk Appetite statement for a new cloud-native architecture?
These set the floor for minimum acceptable risk.
Why this answer
Risk appetite must align with business goals and legal requirements to be effective.
You are securing a microservices architecture using mTLS. Which party is responsible for issuing the certificates that identify each service?
A PKI infrastructure is required to manage internal service identities.
Why this answer
A Private Certificate Authority (CA) or a Service Mesh (like Istio) acting as a CA is responsible for issuing and rotating certificates for service-to-service authentication.
Which TWO actions should be taken when integrating a new cloud service into an existing GRC program?
Required to identify new threats.
Why this answer
New cloud services require updated risk assessments and governance mapping.
Which component in a Privileged Access Management (PAM) solution is responsible for 'Credential Rotation'?
The vault manages the lifecycle of credentials, including rotation.
Why this answer
The PAM vaulting component (e.g., CyberArk Vault, HashiCorp Vault) is responsible for automatically updating and rotating passwords on target systems based on defined policies.
You are configuring an F5 BIG-IP LTM (Local Traffic Manager). You need to terminate SSL/TLS connections at the load balancer to inspect decrypted traffic before forwarding it to the backend web servers. Which object must you configure?
The Client SSL profile is applied to the Virtual Server to decrypt traffic arriving from the client.
Why this answer
A Client SSL profile is required on the Virtual Server to handle the decryption of traffic from the client.
In a SAML-based federation, what is the purpose of the 'RelayState' parameter?
This enables deep-linking in SSO flows.
Why this answer
RelayState is used to maintain the state of the user's intended destination URL, ensuring the user is redirected to the correct page after authentication.
Which THREE of the following are core principles of a Zero Trust Architecture (ZTA)?
This is a core ZTA principle.
Why this answer
Zero Trust relies on explicit verification, least privilege, and assuming breach, rather than perimeter-based defense.
An organization is building a microservices architecture. To ensure compliance with GDPR, where should the data classification metadata be enforced to ensure that PII is not stored in non-compliant regions?
Tags provide metadata for policy-based resource control.
Why this answer
Enforcing classification at the infrastructure level (e.g., tags or resource policies) allows automated tools to restrict data placement.
When using Google Cloud, which service is the primary point of integration for security policies to be applied across the entire organization hierarchy?
Centralized policy management for GCP.
Why this answer
Organization Policy Service allows for hierarchical policy enforcement across projects and folders.
An organization is migrating to SCIM (System for Cross-domain Identity Management) for automated provisioning. Which entity is responsible for receiving the provisioning request from the Identity Provider?
The Server holds the user store and processes the incoming provisioning requests.
Why this answer
The Service Provider (or Target Application) acts as the SCIM Server, receiving requests from the Client (IdP) to create, update, or delete users.
Which THREE attributes of a user session are typically monitored by a CASB (Cloud Access Security Broker)?
Provides visibility into sensitive data movement.
Why this answer
CASBs monitor user location, device state, and the specific application activity (actions taken).
Which THREE security mechanisms are recommended when using an API Gateway to handle authentication?
Ensures unauthorized traffic never reaches the backend.
Why this answer
Rate limiting (DDoS protection), authentication validation (at the edge), and logging (audit) are standard API Gateway security controls.
You are configuring an AWS IAM Identity Center (successor to AWS SSO) environment. You need to provide temporary, elevated access to a developer for a specific account. Which mechanism provides the most granular architectural approach for this?
Permission sets allow for defining specific roles applied to accounts, providing a clean, centralized way to manage elevated access.
Why this answer
AWS IAM Identity Center Permission Sets allow you to define granular access scoped to specific accounts, which can be assigned to users on-demand or via group membership.
Which mechanism is best suited for securing internal web traffic using mutual authentication at the TLS layer?
mTLS is the industry standard for secure service-to-service communication.
Why this answer
Mutual TLS (mTLS) requires both the client and the server to present valid X.509 certificates, proving the identity of both parties.
Which TWO security properties are provided by modern 'Passwordless' architectures?
The private key never leaves the device, eliminating password storage risks.
Why this answer
FIDO2/WebAuthn eliminates shared secrets (passwords) and provides phishing resistance via origin binding.
An architect is deploying a global application and needs to ensure that all HTTP traffic is redirected to HTTPS. Which service in AWS should be used to enforce this compliance globally?
Enforces HTTPS at the CDN edge.
Which document is considered the authoritative 'System Security Plan' (SSP) for an information system undergoing a formal authorization process?
The formal document required for authorization.
Why this answer
The SSP is the primary document that details how security controls are met for a system.
An organization is migrating to a serverless architecture. Which security control is most effective at preventing 'Insecure Serverless Function Configuration' attacks?
Preventative scanning of IaC is the best way to catch configuration drift before deployment.
Why this answer
Using Infrastructure as Code (IaC) scanning tools to audit function configurations before deployment ensures that least privilege and networking are correctly applied.
Which TWO types of certificates are used in a standard mTLS implementation?
Verifies the server to the client.
Why this answer
mTLS requires both a Server Certificate (to verify the server identity) and a Client Certificate (to verify the client identity).
An organization is migrating sensitive workloads to Azure. The compliance team mandates that all storage account keys be rotated automatically. Which service should the architect configure to meet this requirement?
This is the specific feature for automated key rotation.
Why this answer
Azure Key Vault managed storage account keys provide automated rotation for shared keys, aligning with security governance requirements.
You are implementing DNS Security (DNSSEC). What is the primary benefit of this implementation?
This is the core purpose of DNSSEC signing.
Why this answer
DNSSEC provides cryptographic authentication of DNS data, preventing DNS spoofing and cache poisoning attacks by verifying that records have not been modified.
An organization is deploying an EDR solution across their endpoints. To ensure maximum visibility without crashing legacy applications, what is the best deployment strategy?
This enables testing and tuning before full-scale enforcement.
Why this answer
Phased rollout starting with 'Audit Mode' allows the organization to baseline behavior and identify potential conflicts before enforcing blocking actions.
A security architect needs to implement a WAF to protect an API. Which feature is most critical to prevent BOLA (Broken Object Level Authorization) attacks?
Validating the structure and parameters helps prevent malicious object ID manipulation.
Why this answer
BOLA attacks involve manipulating object identifiers in API calls. While a WAF can help, API schema validation and strict parameter checking are critical.
Which THREE components are critical for an ISSAP architect when designing an audit trail that meets the legal requirements for non-repudiation?
Ensures accurate ordering for forensic analysis.
Why this answer
Non-repudiation requires evidence of identity and content integrity that cannot be challenged.
In the context of Enterprise Security Architecture, what is the primary goal of the 'Capability Maturity Model' (CMM) integration?
CMM is used to measure and improve the maturity of security processes.
Why this answer
CMM allows an organization to measure the effectiveness and repeatability of its security architecture processes.
An architect is designing an OAuth 2.0 implementation for a mobile application. To prevent authorization code injection attacks, which specific configuration must be enforced in the client registration?
PKCE is required for mobile clients to secure the authorization code exchange process.
Why this answer
PKCE (Proof Key for Code Exchange) is the standard defense against authorization code interception attacks in public clients, replacing the need for a client secret.
A firm needs to ensure that only approved machine images (AMIs) are used in production. Which AWS service should be used to create a golden image pipeline that enforces compliance before images are shared?
Designed for standardizing image creation.
Why this answer
EC2 Image Builder allows for the creation of an automated pipeline to build, test, and distribute hardened AMIs.
You are architecting a cloud-based application that needs to share secrets between two different cloud environments (AWS and Azure). What is the most secure way to exchange credentials?
OIDC provides a standardized and secure way to exchange identity claims.
Why this answer
Using a federation-based approach with an identity provider that supports OIDC (OpenID Connect) allows for secure, temporary, and audited credential exchange without storing static long-lived keys.
What is the primary role of an 'Attribute-Based Access Control' (ABAC) system compared to 'Role-Based Access Control' (RBAC)?
ABAC is designed for dynamic, complex authorization.
Why this answer
ABAC uses dynamic attributes (user, environment, resource) to make fine-grained decisions, whereas RBAC relies on static assignments of users to roles.
In the context of the OAuth 2.0 Authorization Code flow, why is the 'client_secret' never sent to the user's browser?
Confidentiality of the secret is paramount to ensure trust in the client application.
Why this answer
The client secret is a shared secret between the Authorization Server and the application. If exposed to the browser, it can be easily extracted and used by attackers to impersonate the client.
Which tool would you use to visualize the data flow between components in a cloud-native application for threat modeling?
DFDs illustrate data movement and boundaries for threat analysis.
Why this answer
Data Flow Diagrams (DFD) are the standard for visualizing how data moves through a system.
Page 1 of 3
Page 2Practice ISC by domain
Target a specific domain to shore up weak areas.