ISC Practice Test 10 — 10 Questions

Question 1

An ISSE is leading the security design for a system that will process Controlled Unclassified Information (CUI). The system must comply with NIST SP 800-171. The ISSE needs to ensure that the design includes mechanisms to protect the confidentiality of CUI at rest and in transit. Which set of controls from SP 800-171 should the ISSE prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System and Communications Protection (SC) and Media Protection (MP). To protect CUI confidentiality at rest and in transit under SP 800-171, the ISSE should prioritize System and Communications Protection (SC) for encryption and secure communications, and Media Protection (MP) for safeguarding media that store CUI. These families provide the technical and physical safeguards that directly address the stated requirement.

Answer

Awareness and Training (AT) and Personnel Security (PS)

Answer

Media Protection (MP) and Physical Protection (PE)

Answer

Access Control (AC) and Identification and Authentication (IA)

Question 2

An ISSEP is designing a secure network architecture for a Department of Defense (DoD) system that must comply with the NIST Risk Management Framework (RMF) and DoD Instruction 8510.01. The system will use a demilitarized zone (DMZ) to host a public-facing web server. The ISSEP must ensure that the DMZ design follows the principle of least privilege and prevents direct access to the internal network. Which design approach best meets these requirements?

Accepted Answer

Segment the DMZ from the internal network using a firewall that allows only specific, necessary traffic from the DMZ to the internal network.. A DMZ must be isolated from the internal network by a firewall that enforces least privilege. Only specific, necessary traffic should be allowed from the DMZ to the internal network. This limits the impact of a compromised public-facing server. Other options either place the server in the internal network, allow routing between networks, or rely solely on VLANs, which are insufficient for a secure DMZ.

Answer

Use a dual-homed host with two network interfaces: one connected to the DMZ and one to the internal network, with routing enabled.

Answer

Place the web server in the internal network and use a reverse proxy in the DMZ to forward requests.

Answer

Connect the DMZ and internal network to the same VLAN but use VLAN access control lists (VACLs) to filter traffic.

Question 3

An ISSE is defining the security requirements for a new system that will be developed using a systems security engineering approach. The ISSE must ensure that the requirements address the system's ability to protect against, detect, and respond to security incidents. Which TWO activities should the ISSE perform to derive these requirements? (Choose two.)

Accepted Answer

Conduct a threat modeling exercise to identify potential attack vectors and adversary capabilities.. Threat modeling and defining security functional requirements from the security categorization are both direct requirements elicitation activities. Threat modeling identifies what the system must protect against, while functional requirements translate controls into specific capabilities for protection, detection, and response. Together, they ensure the system's security requirements are comprehensive and risk-based.

Answer

Develop a configuration management plan to track changes to the system throughout its lifecycle.

Answer

Perform a business impact analysis to determine the criticality of system assets and processes.

Answer

Create a continuous monitoring strategy to track the effectiveness of security controls over time.

Question 4

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

Accepted Answer

Revoke a test certificate, attempt authentication with the corresponding smart card, and confirm that authentication is denied with a revocation-related error.. The strongest assurance that revoked certificates are rejected comes from an end-to-end test: revoke a certificate, attempt authentication, and confirm denial. This validates the relying party's revocation checking behavior, which is the actual security control. CA-side checks and CRL signature verification confirm that revocation data exists and is trustworthy but do not prove that authentication systems enforce it.

Answer

Confirm that the Certification Authority has a valid CRL Distribution Point extension in issued certificates and that the CRL is published on schedule.

Answer

Verify that the CA's certificate revocation list is signed with the CA's private key and that the signature validates using the CA's public key.

Answer

Review the CA's audit logs to confirm that the revocation request was processed and that the certificate serial number was added to the CRL.

Question 5

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

Accepted Answer

Compare the raw log output from a critical server with the events received by the SIEM for the same time period.. The most effective technique is to compare raw logs from the source with events in the SIEM. This end-to-end verification pinpoints where in the pipeline events are lost, whether at generation, forwarding, or ingestion. Other options address only parts of the system and do not provide definitive evidence of the root cause. This method aligns with ISSEP validation principles of tracing data flow and verifying each component.

Answer

Run a vulnerability scan on the critical servers to check for logging-related CVEs.

Answer

Check the SIEM's storage capacity to ensure it is not dropping events due to full disks.

Answer

Review the SIEM's correlation rules to ensure they include all authentication event IDs.

Question 6

A security engineer is validating the implementation of a network intrusion prevention system (IPS) in inline mode. The requirement is that the IPS must block malicious traffic without disrupting legitimate business traffic. Which validation test is MOST appropriate to verify this requirement?

Accepted Answer

Use a traffic generator to send known malicious payloads and legitimate traffic simultaneously, then verify that malicious packets are dropped and legitimate packets pass.. The most appropriate validation is to simulate both malicious and legitimate traffic and verify that the IPS blocks the former while allowing the latter. This dynamic test confirms inline blocking capability and ensures no disruption to business traffic. Other options are either static checks or passive monitoring, which do not fully validate the requirement. This approach aligns with ISSEP principles of testing security controls under realistic conditions.

Answer

Review the IPS signature database to ensure it contains the latest signatures for known threats.

Answer

Check the IPS logs for alerts generated during normal business hours to see if any malicious traffic was detected.

Answer

Run a vulnerability scan against a test server behind the IPS to see if exploits are blocked.

Question 7

You are an ISSEP designing a cross-domain solution (CDS) that will allow data to flow from a low-assurance network to a high-assurance network. The security requirement is to ensure that only authorized data transfers occur and that the high side is protected from malicious content. Which architectural approach best meets this requirement?

Accepted Answer

Deploy a cross-domain solution with a content filter and protocol break.. A cross-domain solution with content filtering and protocol break is designed to securely transfer data between security domains of different classifications. The content filter inspects and sanitizes data to remove malicious content and enforce data transfer policies. The protocol break terminates and re-originates protocols, preventing protocol-based attacks. This combination ensures only authorized transfers occur and protects the high side.

Answer

Implement a firewall with strict ACLs between the networks.

Answer

Use a data diode to enforce one-way flow from low to high.

Answer

Use a VPN tunnel to encrypt data in transit between the networks.

Question 8

A security engineer is verifying that a new web application's authentication mechanism meets the organization's requirement that all passwords must be transmitted and stored using strong cryptography. The application uses HTTPS for transport and stores password hashes in a database. During validation, the engineer inspects the database and finds that passwords are stored as unsalted SHA-256 hashes. Which validation finding is most accurate?

Accepted Answer

The storage mechanism is non-compliant because unsalted SHA-256 hashes are vulnerable to rainbow table attacks and do not meet the requirement for strong cryptographic protection.. Password storage requires a slow, salted key-derivation function to resist offline attacks. Unsalted SHA-256 is fast and deterministic, making it vulnerable to rainbow tables and parallel brute-force. Transport encryption and access controls do not compensate for weak storage. The accurate finding is that the unsalted SHA-256 storage is non-compliant with the strong cryptography requirement.

Answer

The storage mechanism is non-compliant only because the hashes are not encrypted with a symmetric key before storage.

Answer

The storage mechanism is compliant because HTTPS encrypts passwords in transit, and the database is access-controlled.

Answer

The storage mechanism is compliant because SHA-256 is a strong cryptographic hash algorithm approved for password storage.

Question 9

An ISSE is tasked with evaluating the security architecture of a new system that will process top secret information. The system will use a combination of commercial and government-off-the-shelf components. The ISSE must ensure that the architecture supports the required security objectives. Which two security architecture principles are most critical to address when integrating COTS and GOTS components into a high-assurance system? (Choose two.)

Accepted Answer

Reference monitor. For a high-assurance system integrating COTS and GOTS, the reference monitor ensures all access is mediated and the trusted path ensures secure communication for security-critical operations. These two principles are essential for enforcing the security policy and preventing unauthorized access or spoofing. Other principles like modularity, open design, and economy of mechanism are valuable but do not directly address the core assurance needs of multilevel security.

Answer

Open design

Answer

Economy of mechanism

Answer

Modularity

Question 10

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

Accepted Answer

The Requirements Traceability Matrix (RTM). Verification that security requirements flow from concept into design depends on bidirectional traceability. The Requirements Traceability Matrix is the engineering artifact that records each requirement's source and its allocated design, implementation, and verification artifacts. An SSP, configuration audit, or risk report serves different purposes and cannot demonstrate allocation. Reviewing the RTM lets the engineer confirm that no security requirement is orphaned and that each has an accountable component owner, which is the precise evidence the scenario requires.

Answer

The system security plan (SSP)

Answer

The functional baseline configuration audit report

Answer

The risk assessment report