ISC Practice Test 12 — 15 Questions

Question 1

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

Accepted Answer

Integrity. Tampering threats target the Integrity aspect of the CIA triad by attempting to modify data or system configurations.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 2

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Accepted Answer

nmap -p 80 <target_ip>. Nmap is a standard network scanning tool used to verify that specific ports are blocked or filtered.

Answer

nslookup <target_ip>

Answer

netstat -an

Answer

ipconfig /all

Question 3

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

Accepted Answer

Configure API Gateway rate limiting policies per user or per IP.. Implementing API rate limiting at the API Gateway level prevents single clients from overwhelming the backend services.

Answer

Require an API key for every request.

Answer

Load balance the API across more servers.

Answer

Use a custom header to validate the request source.

Question 4

Which type of change is typically excluded from a formal Change Advisory Board review process?

Accepted Answer

Standard changes. Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

Answer

Emergency changes

Answer

Security patches

Answer

Significant changes

Question 5

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

Accepted Answer

It serves as the contract between the vendor and the evaluator. The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.

Answer

It replaces the need for a threat model

Answer

It is a marketing document for end users

Answer

It defines the operating system kernel

Question 6

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Accepted Answer

Statement of Applicability (SoA).. The Statement of Applicability (SoA) is the required document in ISO 27001 that outlines which controls are applicable and provides justifications for those that are excluded.

Answer

Risk Assessment Report (RAR).

Answer

System Security Plan (SSP).

Answer

Business Impact Analysis (BIA).

Question 7

Which TWO methods are effective for managing cryptographic keys in a cloud architecture?

Accepted Answer

Deploy a dedicated Hardware Security Module (HSM).. Using a managed Key Management Service (KMS) or a Hardware Security Module (HSM) are the industry standard approaches for secure key management.

Answer

Hardcode keys in the application source code.

Answer

Save keys as plain text files on the VM.

Answer

Store keys in environment variables.

Question 8

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

Accepted Answer

Version control systems (e.g., Git). Documentation must be version-controlled and subject to strict change management to remain accurate.

Answer

Relying on verbal updates from team members

Answer

Posting documents on a public forum

Answer

Periodic manual document destruction

Question 9

Which THREE of the following are valid 'Authentication' factors?

Accepted Answer

Something you are (e.g., fingerprint). Authentication factors fall into categories: something you know, something you have, and something you are.

Answer

Where you sit in the office

Answer

Your mood at the time of login

Question 10

Which THREE elements are required in a high-security access control policy?

Accepted Answer

Authentication and authorization conditions.. Access control policies must define roles (who), resources (what), and the conditions (how/when) under which access is granted.

Answer

Employee home addresses.

Answer

Office kitchen menu.

Question 11

Which THREE of the following are necessary to successfully implement Zero Trust in an existing enterprise environment?

Accepted Answer

Identity-based authentication.. Strong identity verification, micro-segmentation of the network, and continuous monitoring are the three pillars of a successful Zero Trust implementation.

Answer

Using static IP addresses for all users.

Answer

Trusting all traffic behind the firewall.

Question 12

You are designing a secure microservices architecture. To meet the 'Data at Rest' security requirements, you decide to use envelope encryption. Which sequence correctly describes the flow of managing the Data Encryption Key (DEK)?

Accepted Answer

Encrypt data with DEK, encrypt DEK with KEK, store encrypted DEK with data.. Envelope encryption involves encrypting data with a DEK, then encrypting the DEK with a Key Encryption Key (KEK), storing the encrypted DEK alongside the data.

Answer

Encrypt data with KEK, encrypt KEK with DEK, store KEK in HSM.

Answer

Encrypt data with HSM-stored master key, store master key in memory.

Answer

Generate new DEK for every block, store all DEKs in a database.

Question 13

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

Accepted Answer

It provides no actual protection against determined attackers. Obscurity is not a reliable control; if the design is discovered (which it eventually will be), the system has no remaining security.

Answer

It makes the code too complex

Answer

It increases hardware costs

Answer

It prevents auditing

Question 14

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

Accepted Answer

Kerckhoffs's Principle. Kerckhoffs's Principle (or Shannon's Maxim) states that a system should be secure even if everything about it is known, except for the keys.

Answer

Fail-safe defaults

Answer

Security through obscurity

Answer

Least privilege

Question 15

Which of the following is an example of an 'Administrative' security control?

Accepted Answer

Incident Response Plan. Administrative controls focus on policies, procedures, and guidelines, such as an incident response plan.

Answer

Security guard

Answer

Biometric scanner

Answer

Firewall rules