ISC Exam Questions and Answers

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.

Maintaining the Root Certification Authority in an offline state directly satisfies the security constraint to protect the most sensitive trust anchor of the Public Key Infrastructure from network-borne threats. Transporting the Certificate Signing Request via removable, air-gapped media ensures that the Root private key never touches a networked environment, completely eliminating remote attack vectors. Once signed locally by the isolated Root CA, the resulting certificate is securely transferred back via the same physical mechanism to issue the subordinate credential.

Authorization Code Flow with PKCE.

Native mobile applications cannot securely maintain client secrets because attackers can easily decompile binaries to extract embedded credentials. The Authorization Code Flow combined with Proof Key for Code Exchange (PKCE) successfully satisfies this critical public client constraint by replacing the static client secret with a dynamically generated cryptographic code verifier and challenge. This mechanism prevents interception attacks on the authorization code without requiring pre-registered confidential credentials, making it the industry standard for securing OAuth 2.0 implementations on mobile devices.

Use Cloud HSM to store keys and keep raw PII in an on-premises database.

Keeping raw personally identifiable information (PII) within an on-premises database directly satisfies the strict data sovereignty constraint of the stem by ensuring that jurisdictional data boundaries are not crossed. Utilizing a Cloud Hardware Security Module (HSM) to manage and store encryption keys remotely enables the organisation to retain cryptographic control over the data. This hybrid approach satisfies the cloud utilisation requirement while guaranteeing that the cloud provider never possesses the unencrypted data, thereby maintaining compliance with local data residency laws.

Implement Istio with mTLS and AuthorizationPolicies.

Service mesh frameworks such as Istio utilise mutual TLS (mTLS) combined with Kubernetes `AuthorizationPolicies` to enforce strict cryptographic identity verification and fine-grained, namespace-scoped access control between microservices. This capability directly satisfies the architectural constraint of enforcing the principle of Least Privilege at the service-to-service communication layer by restricting network traffic to explicitly authorised paths, thereby preventing lateral movement and unauthorized payload inspection within the cluster.

Select security and privacy controls.

Following the Categorise step, the Risk Management Framework mandates the selection of security and privacy controls to address the identified risk profile. This sequence satisfies the constraint of the RMF lifecycle, which dictates that baseline controls must be tailored based on the system's impact level before implementation. By selecting appropriate controls, organisations ensure that security measures align with the specific sensitivity of the data processed, a process often integrated into broader identity governance strategies managed through platforms like Microsoft Entra ID.

Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.

Enabling specific SQL injection and cross-site scripting inspection modules directly addresses the OWASP Injection category by implementing signature-based pattern matching and heuristic analysis at the application layer. These WAF policies intercept malicious payloads within HTTP requests, sanitising input before it reaches the backend database or client browser. By enforcing strict input validation and normalisation rules, the WAF effectively neutralises command injection attempts, satisfying the requirement to mitigate the primary risks associated with untrusted data execution within the web application environment.

Degaussing

Degaussing effectively satisfies the NIST 800-88 'Purge' standard for magnetic media by applying a powerful reverse magnetic field that disrupts and randomises the coercivity of the hard drive's ferromagnetic platters, completely neutralising the stored domains beyond laboratory reconstruction. This physical sanitisation method fulfills the strict requirement to render data unrecoverable using state-of-the-art laboratory techniques, unlike logical overwriting methods which can fail if sectors are damaged, making it the definitive physical countermeasure for decommissioned magnetic drives.

Sentinel Policy-as-Code

Sentinel enforces programmatic compliance checks directly within the Terraform workflow, satisfying the requirement to prevent unauthorized security-critical changes from reaching production. By intercepting the plan phase before application, this policy-as-code framework evaluates fine-grained rules against the resource dependency graph. It halts execution if proposed modifications violate predefined security thresholds, ensuring automated governance and authorization gates without relying solely on manual code reviews.

Protected Branches with Merge Request approvals

Protected Branches restrict who may push or merge to master, and Merge Request approvals require designated approvers before merging. Together they enforce authorised-engineer-only changes, satisfying the requirement that security-critical modifications be verified prior to reaching the master branch.

Inventory the assets

Establishing a comprehensive inventory of assets satisfies the fundamental constraint of visibility, which is the prerequisite for any secure decommissioning process. Before sanitisation or physical destruction can occur, administrators must identify every device, including those registered within Microsoft Entra ID, to ensure no hardware remains unaccounted for. This systematic accounting prevents the oversight of orphaned storage media or peripheral devices that could otherwise become vectors for data leakage, ensuring that the entire lifecycle management policy is applied consistently across the organisation’s infrastructure.

To determine if the security controls need re-evaluation

Reviewing the Federal Information Processing Standards (FIPS) 199 security categorisation—which rates confidentiality, integrity, and availability as low, moderate, or high—directly satisfies the system change constraint by identifying whether the modification alters the potential impact level. If the change elevates the impact baseline, the system requires a comprehensive re-evaluation of its security control baseline to ensure the implemented safeguards still adequately mitigate the newly defined risk posture.

Operational system disruption

Industrial Control Systems (ICS) rely on deterministic, real-time availability where unplanned downtime can cause catastrophic physical damage or severe safety incidents. During the 'Implement' phase of the Change Management plan, executing modifications—such as firmware updates or logic controller rewrites—directly risks operational system disruption because these environments often lack redundancy, cannot tolerate latency spikes, and run legacy software that fails unpredictably under modified operational states.

$50,000

Calculating the Annualised Loss Expectancy requires multiplying the Annualised Rate of Occurrence by the Single Loss Expectancy. By applying the provided values of 0.5 and $100,000 respectively, the resulting product is $50,000. This calculation satisfies the quantitative risk assessment constraint established in the stem, accurately reflecting the expected financial impact over a one-year period for the mission-critical database. This methodology allows security professionals to prioritise resource allocation effectively when managing organisational risk profiles.

The sensor firmware is not signed.

Unsigned firmware removes any cryptographic assurance of authenticity or integrity, so a compromised build can be flashed undetected across the sensor array. Because the devices share a common update path, one malicious image propagates systemically, defeating downstream controls and satisfying the stem's highest systemic risk criterion.

Perform a firmware update using the manufacturer's signed secure update process.

A manufacturer-signed firmware update replaces the vulnerable TPM firmware while preserving the endorsement key hierarchy and secure-boot chain of trust. This directly remediates the key-injection flaw, which unsigned or third-party flashing could not do safely.

That all cryptographic modules utilized by the system are FIPS 140-3 validated.

FIPS 140-3 compliance mandates that any cryptographic module employed within a system must undergo formal validation by an accredited laboratory to ensure it meets rigorous security requirements. By verifying that all modules are explicitly validated against this standard during the design phase, the ISSEP ensures the infrastructure satisfies the constraint of regulatory adherence. This proactive validation prevents the integration of non-compliant components, thereby maintaining the cryptographic integrity and legal conformity required for the cloud environment’s security architecture.

Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.

Unidirectional gateways permit telemetry to flow out of the control network while physically preventing any inbound path, so exploits cannot traverse the non-standard protocol. Since DPI cannot parse that protocol, hardware-enforced isolation removes the attack vector rather than attempting ineffective inspection.

Apply differential privacy techniques to the training process.

Applying differential privacy during the training process introduces mathematically bounded noise into the learning algorithm or the gradients, which directly satisfies the constraint of preventing model inversion attacks. By limiting the influence of any single data point on the final model parameters, this engineering control ensures that an attacker cannot reconstruct granular, sensitive training records simply by querying the model or analysing its outputs.

Run 'kube-bench --targets etcd' to perform the automated audit.

`kube-bench` directly satisfies the requirement to automate CIS Benchmark validations specifically against a Kubernetes control plane component. By invoking `--targets etcd`, the tool parses the local node configuration files, process arguments, and file permissions associated with the distributed key-value store, comparing them directly against the Centre for Internet Security guidelines. This programmatic inspection removes manual verification overhead and targets the specific constraint defined in the stem.

Deploy an AWS Config custom rule using an AWS Lambda function to evaluate resource configurations.

AWS Config custom rules invoke a Lambda function that evaluates resource configuration items against bespoke logic, satisfying the requirement for continuous compliance monitoring against a custom policy. Managed rules only cover predefined checks, so custom logic is essential where no built-in rule matches the policy.

Run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1.

Reading `/proc/sys/crypto/fips_enabled` returns 1 only when the kernel's crypto API has FIPS mode active, confirming the validated module enforces FIPS-approved algorithms on this on-premises Linux server. This directly satisfies the stem's requirement to verify intended FIPS operation rather than merely checking package installation.

manage-bde -status C:

The `manage-bde` utility serves as the primary command-line interface for administering BitLocker Drive Encryption within Windows environments. By executing the `-status` parameter specifically against the `C:` drive, an administrator retrieves the current encryption state, protection status, and conversion progress. This command directly satisfies the requirement to verify the implementation of disk encryption on a Windows server, providing the granular technical feedback necessary to confirm that the operating system volume is secured and functioning as intended.

Verify the use of mutual TLS (mTLS) and log hashing/signing in the syslog configuration.

Mutual TLS (mTLS) ensures the authenticity of the communication channel by requiring both the sender and the SIEM to present valid certificates, preventing unauthorised interception. Simultaneously, log hashing and digital signatures provide cryptographic assurance that the data remains unaltered during transit and storage. By combining transport-layer security with payload-level verification, this approach directly satisfies the requirement for log integrity, ensuring that the logs received by the SIEM are both genuine and untampered, which is superior to simple connectivity checks or basic transport encryption.

Verify the presence and integrity of tamper-evident seals on the chassis.

Annual physical validation of a Hardware Security Module (HSM) housing root Certificate Authority keys requires inspecting the physical security posture to detect unauthorized access attempts. Verifying the presence and integrity of tamper-evident seals satisfies the specific constraint of confirming external physical tampering, as these mechanical indicators reveal whether the chassis has been opened or compromised since the last audit. This directly addresses the requirement for verifying physical security controls without needing to execute a destructive internal inspection of the cryptographic boundary.

Applying security controls at multiple architectural layers

Implementing security controls across diverse architectural layers—such as the perimeter, network, host, application, and data tiers—directly satisfies the core constraint of 'Defense in Depth'. This multilayered technical mechanism ensures that if a single defensive barrier fails or is bypassed by an attacker, subsequent overlapping controls continue to protect the system assets. By avoiding a single point of failure and enforcing cumulative safeguards, the architecture achieves the robustness required to mitigate sophisticated, multi-stage threats effectively.

Ensuring diversity in security technologies and controls

Employing a heterogeneous mix of security technologies and vendor implementations directly satisfies the structural constraint of diversity required for robust Defense in Depth. By avoiding monocultures across defensive layers—such as combining firewalls from different vendors or integrating disparate endpoint detection mechanisms—an organisation ensures that a zero-day exploit, configuration flaw, or implementation vulnerability compromising one specific product will not automatically bypass subsequent controls. This technical strategy forces an attacker to expend significantly more resources, as bypassing the architecture requires discovering entirely distinct exploits for fundamentally different technological foundations.

Requirements Analysis

Requirements Analysis is where stakeholder needs are decomposed into functional and security requirements, establishing the baseline from which architecture and design trace downward. Defining security functional requirements here ensures each maps to system architecture components later in the V-Model.

SAST (Static Application Security Testing)

Static Application Security Testing (SAST) analyses proprietary source code without executing it, satisfying the strict requirement for automated vulnerability detection during the 'Build' stage of a CI/CD pipeline. By parsing the abstract syntax tree of the custom codebase, SAST tools identify logic flaws, insecure coding patterns, and known vulnerability signatures early in the software development lifecycle before artefacts are packaged. This white-box approach provides immediate developer feedback, aligning directly with DevSecOps principles by embedding security checks natively into the compilation workflow.

Document the risk and implement compensating controls

Documenting the risk and implementing compensating controls addresses the fundamental constraint of legacy system incompatibility with TLS 1.3. Since the legacy architecture cannot natively support modern cryptographic suites, an ISSE must isolate the system behind a reverse proxy or a secure gateway that terminates TLS 1.3 connections externally. This approach maintains the required security posture without necessitating a full system replacement, while potentially integrating with modern identity providers like Microsoft Entra ID to enforce robust authentication and traffic inspection at the perimeter.

Identifying security-relevant system components

Identifying security-relevant system components is vital during the System Design phase to satisfy the architectural constraint of isolating high-value assets and establishing trust boundaries within the system element baseline. By systematically mapping boundaries and interfaces, engineers can enforce strict access control mechanisms and cryptographic controls directly onto sensitive data flows, thereby preserving both confidentiality and integrity against unauthorized modification or disclosure.

Specifying security-enforcing interfaces

Specifying security-enforcing interfaces directly satisfies the system design constraint of enforcing strict boundaries and data flow controls to protect confidentiality and integrity. By rigorously defining trust boundaries, input validation protocols, and least-privilege access points between system components, engineers prevent unauthorized data exposure and tampering. This targeted architectural practice ensures that interactions across system modules are mediated securely, fulfilling the precise requirements of NIST SP 800-160 by systematically reducing the attack surface during the design phase.

Defining system trust boundaries

Defining system trust boundaries satisfies the 'System Design' constraint by segregating components with disparate security categorisations, directly enforcing confidentiality and integrity. Establishing precise perimeters ensures that privilege escalation vectors are contained and data flow traversing security domains undergoes mandatory validation. This architectural partitioning prevents unauthorized information disclosure and protects system state modifications from malicious tampering during the engineering lifecycle.

Integrity

Tampering directly violates the security principle of integrity by involving the unauthorized modification or destruction of data, code, or system configurations in transit or at rest. Within the STRIDE methodology, this threat specifically maps to the integrity constraint because it undermines the trustworthiness and reliability of information, ensuring that data cannot be altered by malicious actors without detection.