ISC Practice Test 14 — 15 Questions

Question 1

An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?

Accepted Answer

Easy extraction of keys through reverse engineering the binary.. Hardcoded API keys are embedded directly in the application binary or source code, so anyone who obtains the app package (APK/IPA) can decompile or disassemble it and recover the keys. Tools like jadx, apktool, Frida, and strings make this trivial, and once extracted the keys can be abused to impersonate the app, incur billing charges, or access third-party data. This is a classic CWE-798 (Use of Hard-coded Credentials) issue and is the dominant risk, not performance or availability.

Answer

Increased latency for API calls.

Answer

The keys will expire too quickly.

Answer

The app will crash when the API is unavailable.

Question 2

You are designing an incident response architecture for a cloud environment. Which TWO of the following configurations are critical for ensuring effective forensic readiness according to NIST SP 800-61?

Accepted Answer

Centralizing logs in a read-only security account.. Forensic readiness requires high-fidelity, tamper-proof logs and centralized aggregation to ensure evidence integrity.

Answer

Using local disk storage for all incident response artifacts.

Answer

Enabling verbose debug mode on all production services.

Answer

Configuring short retention periods for all system logs to save cost.

Question 3

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

Accepted Answer

Attribute-Based Access Control (ABAC). ABAC evaluates access decisions dynamically against attributes of the subject, resource, action, and environment (e.g., user department, data classification, time of day, request origin). In a microservices architecture, where hundreds of services call each other with varying contexts and fine-grained data scopes, ABAC's policy-driven, context-aware model enforces least privilege far more precisely than static role assignments. This granularity is essential when roles proliferate across services and environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 4

You are assessing a system for compliance with FIPS 140-3. You need to ensure that the cryptographic module being used for TLS termination on a load balancer meets specific physical security requirements. Where should you look for the validation status of the cryptographic module?

Accepted Answer

NIST CMVP Module Registry. The NIST Cryptographic Module Validation Program (CMVP) maintains the official registry of all FIPS-validated modules.

Answer

Common Criteria Portal

Answer

CVE Database

Answer

ISO 27001 Annex A controls list

Question 5

An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. The ALE is calculated by multiplying the SLE by the ARO (100,000 * 0.5 = 50,000).

Answer

$200,000

Answer

$500,000

Answer

$100,000

Question 6

Which TWO criteria are used to determine if a change request must be reviewed by the Change Advisory Board (CAB)?

Accepted Answer

Potential impact on system availability. Changes that have a significant risk or potential for wide-reaching impact must undergo CAB review to ensure proper oversight.

Answer

The time of day the change is performed

Answer

The color of the hardware

Answer

The name of the lead technician

Question 7

An ISSEP needs to secure inter-process communication (IPC) on a Linux host. Which feature should be configured to prevent unauthorized processes from accessing sensitive memory space?

Accepted Answer

Enable and configure SELinux with restrictive policies.. SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) mechanism that enforces fine-grained policies to restrict processes from accessing memory, files, and other resources. By configuring SELinux with restrictive policies, an ISSEP can prevent unauthorized processes from accessing sensitive memory space, even if they run with elevated privileges. This directly addresses IPC security.

Answer

Set file permissions to 600.

Answer

Use a rootkit scanner.

Answer

Update the host kernel.

Question 8

An ISSEP is developing a security architecture for a system that will use a service-oriented architecture (SOA) with multiple web services. The system must ensure that messages are protected end-to-end and that services can verify the identity of the sender. Which TWO security standards or specifications should be incorporated into the architecture to meet these requirements? (Choose two.)

Accepted Answer

SAML 2.0. WS-Security and SAML 2.0 together provide message-level security and identity federation for SOA. WS-Security secures SOAP messages with signatures and encryption, ensuring end-to-end protection. SAML 2.0 supplies assertions that verify the sender's identity and attributes. Used together, they allow services to authenticate the sender and maintain message integrity across intermediaries, which is essential for a secure service-oriented architecture.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

TLS 1.3

Question 9

Which TWO aspects of a system's lifecycle must be documented in the decommission plan?

Accepted Answer

Data sanitization method applied. Option C is correct because a decommission plan must document the data sanitization method applied (e.g., NIST SP 800-88 purge/clear, cryptographic erase, or physical destruction) to prove that residual data was securely removed before disposal or reuse, satisfying data remanence and privacy requirements. Option E is correct because the plan must record removal from the hardware and software inventory so that CMDB/asset records, monitoring, licensing, and support entitlements are updated and no orphaned or phantom assets remain. Option A is not required, since original purchase price is a financial/accounting detail rather than a lifecycle decommissioning control. Option B is irrelevant, as the vendor CEO's name has no bearing on secure retirement of the system. Option D is irrelevant, since server casing color is a cosmetic attribute with no decommissioning significance.

Answer

The original purchase price of the equipment

Answer

The name of the vendor's CEO

Answer

The color of the server casing

Question 10

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

Accepted Answer

Implement Istio with mTLS and AuthorizationPolicies.. Using a service mesh like Istio enables mTLS and granular authorization policies (RBAC) between microservices, which is the standard implementation for least privilege in containerized environments.

Answer

Use the default ClusterRoleBinding for all pods.

Answer

Deploy all microservices into a single flat network segment.

Answer

Enable Kubernetes NetworkPolicies only at the namespace level.

Question 11

What is the primary function of an 'API Gateway' in a microservices security architecture?

Accepted Answer

To provide centralized authentication and rate limiting. An API Gateway acts as a single entry point that handles authentication, rate limiting, and request routing for microservices.

Answer

To compile the source code

Answer

To store the application database

Answer

To act as a physical firewall

Question 12

You are the ISSE responsible for a change to an accredited system that will replace the cryptographic module used for data-at-rest encryption. The system is in the Operations phase and processes Controlled Unclassified Information. The change has been approved by the Configuration Control Board. Before implementation, which action BEST ensures the change does not invalidate the existing authorization?

Accepted Answer

Perform a security impact analysis and update the system security plan, then obtain approval from the Authorizing Official if the risk posture changes.. A cryptographic module replacement changes the implemented controls and may affect the system's risk level. The ISSE must perform a security impact analysis, update the system security plan, and involve the Authorizing Official when risk changes. Only this sequence maintains the authorization's validity and ensures the change is properly assessed before implementation.

Answer

Submit the change to the Change Advisory Board for approval before notifying the Authorizing Official.

Answer

Test the new cryptographic module in a lab environment and document the results in the configuration management database.

Answer

Implement the change and then conduct a vulnerability assessment within 30 days to verify that no new weaknesses were introduced.

Question 13

During a security verification of a Linux server, you need to confirm that the implementation of mandatory access control (MAC) is enforcing the intended policy for a custom application. The server uses SELinux in enforcing mode. The application's binary is labeled with a custom type, and the policy includes allow rules for its required operations. However, the application is failing to write to a log directory. Which command should you use to verify whether SELinux is denying the write operation?

Accepted Answer

ausearch -m avc -ts recent. To verify whether SELinux is denying a specific operation, you must inspect the audit logs for AVC denial messages. The ausearch command with the avc message type and a recent time filter retrieves exactly those events, showing the denied permission and contexts. Other commands either display configuration, attempt remediation, or report global mode, none of which confirm a runtime denial.

Answer

getenforce

Answer

semanage fcontext -l | grep log

Answer

restorecon -Rv /var/log

Question 14

During a system security engineering review, an ISSEP discovers that a critical supplier's component firmware is updated automatically over the internet without cryptographic signature verification. The component is embedded in a system that processes Controlled Unclassified Information (CUI). Which risk treatment strategy should the ISSEP recommend FIRST?

Accepted Answer

Mitigate the risk by requiring the supplier to implement digitally signed firmware updates and verifying signatures before installation.. The absence of cryptographic signature verification for firmware updates is a supply chain vulnerability that can lead to arbitrary code execution. The most effective first response is to mitigate by mandating digitally signed updates and verifying them prior to installation. This control directly prevents tampered firmware from being loaded, reducing the risk to CUI. Other strategies either do not address the root cause or are premature.

Answer

Avoid the risk by disconnecting the component from all networks.

Answer

Accept the risk because the supplier is contractually obligated to provide secure updates.

Answer

Transfer the risk by purchasing cyber insurance that covers supply chain attacks.

Question 15

You are finalizing the verification and validation report for a system entering the authorization phase. The approving official requires evidence that the implemented security controls are not only present but operating correctly, and that residual weaknesses are documented. Which TWO activities must be completed to satisfy this requirement? (Choose two.)

Accepted Answer

Document identified deficiencies, their assessed risk, and the planned remediation or acceptance rationale in a residual risk statement. The approving official needs two things: proof that controls operate as intended and an honest accounting of what remains weak. Executing test and evaluation procedures against expected results supplies the operational evidence, while documenting deficiencies with risk and remediation or acceptance rationale supplies the residual risk picture. Together they let the authorizing official make an informed, defensible decision rather than relying on design intent.

Answer

Compile the original design specification documents and confirm they are stored in the configuration management repository

Answer

Schedule the next periodic vulnerability scan and confirm the scanning credentials will be available to the operations team

Answer

Obtain a vendor letter confirming the product version is supported under an active maintenance agreement