ISC Practice Test 11 — 15 Questions

Question 1

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

Accepted Answer

Attempt to log in with valid credentials and verify that the system prompts for the secondary token.. Successful authentication with a second factor is the ultimate proof of correct implementation.

Answer

Verify that the account has a 'mobile' field populated.

Answer

Review the MFA server logs for daily activity.

Answer

Check the user account settings in the Active Directory console.

Question 2

In the context of the NIST Cybersecurity Framework, which function is specifically supported by the 'Systems Security Engineering' process during the 'Identify' stage?

Accepted Answer

Risk Assessment (ID.RA). Systems Engineering identifies assets and risks, which aligns with the 'Identify' function in the NIST CSF.

Answer

Recovery Planning (RC.RP)

Answer

Access Control (PR.AC)

Answer

Detection Processes (DE.DP)

Question 3

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

Accepted Answer

Kerckhoffs's Principle. Kerckhoffs's Principle (or Shannon's Maxim) states that a system should be secure even if everything about it is known, except for the keys.

Answer

Fail-safe defaults

Answer

Security through obscurity

Answer

Least privilege

Question 4

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

Accepted Answer

It provides no actual protection against determined attackers. Obscurity is not a reliable control; if the design is discovered (which it eventually will be), the system has no remaining security.

Answer

It makes the code too complex

Answer

It increases hardware costs

Answer

It prevents auditing

Question 5

In the context of the NIST Risk Management Framework (RMF), which step involves the initial identification of security controls based on the system's impact level?

Accepted Answer

Select. Step 2 of the RMF is 'Select', where security controls are selected based on the categorization performed in Step 1.

Answer

Implement

Answer

Assess

Answer

Categorize

Question 6

Which of the following is an example of an 'Administrative' security control?

Accepted Answer

Incident Response Plan. Administrative controls focus on policies, procedures, and guidelines, such as an incident response plan.

Answer

Security guard

Answer

Biometric scanner

Answer

Firewall rules

Question 7

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

Accepted Answer

Real-time incident detection. Continuous monitoring relies on real-time data, automated alerting, and periodic reporting to maintain a security posture.

Answer

Quarterly hardware refresh

Answer

Manual annual log review

Question 8

When architecting a system to meet ISO 27001 requirements for secure system engineering, which TWO of the following design principles should be prioritized for protecting sensitive data at rest?

Accepted Answer

Enforcing strict access control policies for data access.. Encryption and access control (least privilege) are fundamental controls required by ISO 27001 for data protection.

Answer

Hosting all data on a single centralized server to simplify management.

Answer

Using a single administrative account for all data operations.

Answer

Disabling all logging to reduce storage overhead.

Question 9

Which THREE of the following are considered 'Common Criteria' (ISO/IEC 15408) elements for evaluating the security functionality of a product?

Accepted Answer

Protection Profile (PP). Common Criteria uses Protection Profiles and Security Targets to define and evaluate security requirements.

Answer

Sales and Marketing Specification

Answer

Employee Training Records

Question 10

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

Accepted Answer

Implementing a Software Bill of Materials (SBOM). Software Bill of Materials (SBOM) allows organizations to track and manage the components in their software, facilitating the identification of vulnerable third-party dependencies.

Answer

Limiting the number of developers

Answer

Enforcing password complexity

Answer

Using only open-source software

Question 11

An ISSEP professional is reviewing an architecture for compliance with NIST SP 800-160, Systems Security Engineering. Which THREE of the following activities are core to the 'Trustworthiness' objective for an engineered system?

Accepted Answer

Hardware-based root of trust integration.. Trustworthiness is built through robust design, consistent verification, and proactive mitigation of vulnerabilities throughout the lifecycle.

Answer

Prioritizing feature release speed over security patches.

Answer

Outsourcing all security monitoring to third-party providers.

Question 12

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

Accepted Answer

Verifiability of security functions. The TCB is the set of all hardware, software, and firmware components that are critical to the security of the system; it must be verifiable and correct.

Answer

System performance metrics

Answer

User-friendliness of the interface

Answer

The versioning history of the software

Question 13

When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?

Accepted Answer

It lacks the rigorous peer review of standard algorithms. Custom cryptography is prone to subtle implementation errors that are difficult to detect and often break the security of the underlying algorithm.

Answer

It makes key management too difficult

Answer

It is always too slow for real-time systems

Answer

It requires special hardware

Question 14

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

Accepted Answer

The corresponding system component or design element. An SRTM maps requirements to design elements and test cases to ensure no security requirement is overlooked.

Answer

The vendor contact information

Answer

The employee performance review score

Answer

The marketing department's sales forecast

Question 15

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model focuses on confidentiality by enforcing the 'no read up, no write down' rules.

Answer

Clark-Wilson model

Answer

Biba model

Answer

Brewer-Nash model