ISC Practice Test 12 — 15 Questions

Question 1

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

Accepted Answer

It is a component that strictly applies security policies. A security-enforcing component is one that actively mandates security policies, such as a reference monitor or a gatekeeper.

Answer

It can be easily bypassed by users

Answer

It is a component that only audits traffic

Answer

It is a component that is optional for performance

Question 2

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 3

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

Accepted Answer

Assigning security requirements to developers. An SDL integrates security into every phase of development: planning, design, implementation, testing, and release.

Answer

Physical security of the office parking lot

Answer

Hiring external marketing staff

Question 4

You are validating the security of a containerized environment (e.g., Docker). Which THREE of the following configurations should be checked for security compliance?

Accepted Answer

Ensure the container processes do not run as the root user.. Container security verification requires checking privilege levels, root usage, and image source trust.

Answer

Check that all containers have unlimited CPU and memory allocation.

Answer

Ensure the host OS is Windows 98.

Question 5

You are performing an audit of a new system's 'Trusted Computing Base' (TCB). Which observation would indicate a violation of the 'Separation of Duties' principle?

Accepted Answer

The same person who requests a system access change also approves it. Separation of Duties ensures that no single individual has the authority to perform all steps of a critical security task.

Answer

The administrator configures the firewall rules

Answer

Two administrators are required for root access

Answer

The security team monitors logs

Question 6

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Accepted Answer

Graceful degradation. Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.

Answer

Maximal feature set

Answer

Hardware redundancy only

Answer

Complete system lockdown upon error

Question 7

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

Accepted Answer

Hashing and off-loading logs to a secure, write-only destination. Logs must be protected from tampering; hashing and secure remote storage are standard methods to ensure they remain trustworthy.

Answer

Including as much noise as possible

Answer

Storing logs only on the local server

Answer

Storing logs in plain text

Question 8

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

Accepted Answer

Conducting the security control assessment. The Assess step focuses on determining the effectiveness of the security controls implemented in the system.

Answer

Authorizing the system for operation

Answer

Disposing of the system components

Question 9

What is the primary objective of a 'Security Design Review' early in the lifecycle?

Accepted Answer

To catch design-level security flaws early. A design review aims to identify security flaws before they are implemented, as it is much cheaper to fix them in the design phase than during production.

Answer

To finalize the user interface layout

Answer

To conduct penetration testing

Answer

To verify the system's performance metrics

Question 10

What is the primary function of an 'API Gateway' in a microservices security architecture?

Accepted Answer

To provide centralized authentication and rate limiting. An API Gateway acts as a single entry point that handles authentication, rate limiting, and request routing for microservices.

Answer

To compile the source code

Answer

To store the application database

Answer

To act as a physical firewall

Question 11

When engineering a 'Secure Boot' sequence, what is the primary security objective?

Accepted Answer

To ensure only trusted, signed code is executed. Secure Boot ensures that every piece of software loaded during the boot process is digitally signed by a trusted entity, preventing rootkits from loading early.

Answer

To allow for easy BIOS updates

Answer

To bypass the need for an OS

Answer

To speed up the boot process

Question 12

As part of an accreditation process, you are validating that the system meets NIST 800-53 requirements for incident response. Which THREE items must be present in the verification evidence?

Accepted Answer

Records of periodic incident response training/exercises.. NIST 800-53 requires documented procedures, staff training, and test results for incident response validation.

Answer

The physical security badge access logs for the entire building.

Answer

A list of all employees' home addresses.

Question 13

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

Accepted Answer

System boundary description. An SSP describes the system, its security boundaries, the controls applied, and the risk management strategy.

Answer

Office breakroom rules

Answer

Personal employee salary data

Question 14

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

Accepted Answer

Standards and procedures. Policies must define the 'what' (High-level), the 'how' (Standards/Procedures), and the 'how-to' (Guidelines).

Answer

Office cleaning schedule

Answer

Employee salary structure

Question 15

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

Accepted Answer

SPF (Sender Policy Framework) record implementation.. SPF, DKIM, and DMARC are the three pillars of email sender verification.

Answer

Disabling TLS for incoming connections to save bandwidth.

Answer

Enabling the 'forward all traffic' rule.