ISC Practice Test 1 — 10 Questions

Question 1

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 2

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized PII database creates a single aggregation point: one successful compromise (SQL injection, credential theft, misconfigured access) exposes the entire PII dataset at once. This violates the principle of minimizing blast radius and is the primary architectural risk, which is why regulations like GDPR and CCPA push for data minimization, segmentation, and encryption. The other options describe operational concerns, not the core security risk of centralization.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 3

An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?

Accepted Answer

Implement the change under emergency change procedures with the security impact documented and a post-implementation review scheduled.. An emergency change to audit logging must proceed quickly but cannot bypass accountability. Using the emergency change procedure with documented security impact and a scheduled post-implementation review lets the change take effect within the four-hour window while ensuring the reduced logging is evaluated, compensated, and formally accepted or rolled back.

Answer

Deny the change because audit logging modifications always require full board approval.

Answer

Reduce log volume by filtering events at the collection tier instead of changing the source configuration.

Answer

Implement the change immediately and document it after the peak period ends.

Question 4

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.

Question 5

What is the primary risk of a 'Privileged User' who lacks proper oversight?

Accepted Answer

They can bypass security controls and abuse access. Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.

Answer

They will slow down system performance

Answer

They cannot do their job

Answer

They will always be hackers

Question 6

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Accepted Answer

Connect as an authorized user, inspect the assigned routes and the negotiated cipher, and confirm no local network access is permitted.. Validating policy enforcement requires observing real session behavior against each requirement. Establishing an authorized session and inspecting the routes, negotiated cipher, and local network reachability confirms group enforcement, absence of split tunneling, and AES-256 encryption simultaneously. Configuration review, authentication logs, and a single negative test each cover only part of the policy and cannot demonstrate full enforcement.

Answer

Check the concentrator's authentication logs to confirm that only 'Remote Users' group members have connected recently.

Answer

Review the VPN concentrator's configuration file to confirm the group, split tunneling, and encryption settings are present.

Answer

Attempt to connect as a user who is not in the 'Remote Users' group and confirm the connection is rejected.

Question 7

An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?

Accepted Answer

False Acceptance Rate (FAR). The risk of an unauthorized individual being granted access is quantified by the False Acceptance Rate (FAR). FAR directly measures the likelihood of a biometric false positive, which is a security concern. The ISSEP should use FAR to assess the risk and then determine if additional controls are needed. Other metrics like FRR and EER address different aspects and do not isolate the false acceptance risk.

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Question 8

An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?

Accepted Answer

System Security Plan (SSP). The System Security Plan is the RMF artifact that describes the system's authorization boundary, the selected security controls, and how each control is implemented. It accompanies the system through assessment and authorization and is the foundational document the Authorizing Official reviews. The SAR, POA&M, and ATO each serve distinct roles later in the process but do not substitute for the SSP.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

Authority to Operate (ATO) memorandum

Question 9

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

Accepted Answer

SCAP Compliance Checker (SCC). SCAP Compliance Checker (SCC) is specifically designed to automate the assessment of systems against Security Content Automation Protocol (SCAP) benchmarks, including DISA STIGs. It efficiently scans OS configurations, compares them to the STIG requirements, and generates detailed compliance reports. Unlike general-purpose tools, SCC directly consumes SCAP content, which is the standardized format for expressing STIG rules, making it the most efficient and accurate tool for this task.

Answer

Wireshark

Answer

Microsoft Baseline Security Analyzer (MBSA)

Answer

Nmap

Question 10

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

Accepted Answer

To prevent unauthorized code injection. Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

Answer

To simplify the audit process

Answer

To reduce operational costs

Answer

To increase server performance