ISC Practice Test 15 — 15 Questions

Question 1

An ISSEP is reviewing the security architecture of a system that uses a trusted platform module (TPM) for hardware root of trust. The system must ensure that the boot process is measured and that the integrity of the boot components can be verified remotely. Which TPM feature should be used to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Platform Configuration Registers (PCRs) with remote attestation.. Platform Configuration Registers (PCRs) are used to store measurements of boot components, creating a record of the boot process. Remote attestation allows a remote party to verify these measurements by having the TPM sign them with an Attestation Identity Key. This combination provides a hardware-rooted assurance that the boot process is unmodified, meeting the requirement for measured boot and remote verification.

Answer

Sealed storage using the Storage Root Key (SRK).

Answer

Endorsement Key (EK) for cryptographic operations.

Answer

Attestation Identity Key (AIK) for signing PCR values.

Question 2

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Accepted Answer

.xml. In an SCAP-compliant environment, security check definitions for DISA STIGs are typically provided in XML format, specifically using the .xml file extension. SCAP (Security Content Automation Protocol) uses XML-based specifications such as XCCDF (Extensible Configuration Checklist Description Format) and OVAL (Open Vulnerability and Assessment Language) to define and automate security compliance checks. DISA STIGs are commonly distributed as SCAP content in XML files, which can be consumed by SCAP-validated tools for automated assessment.

Answer

.txt

Answer

.stig

Answer

.ovl

Question 3

During a system validation audit, you must verify the configuration of a hardware security module (HSM). Which THREE of the following are valid validation checks?

Accepted Answer

Confirm the HSM is running the latest vendor-signed firmware.. Option A is correct because validating that an HSM runs the latest vendor-signed firmware ensures it has the most recent security patches and that the firmware's cryptographic signature verifies authenticity and integrity, preventing tampered or outdated code from undermining key protection. Option D is correct because HSMs commonly enforce M-of-N quorum or split-knowledge authorization so that no single administrator can perform sensitive operations alone, satisfying separation-of-duties and dual-control requirements during an audit. Option E is correct because physical security controls such as a locked rack protect the HSM from theft, tampering, or unauthorized physical access, which is essential since physical access can bypass logical protections. Option B is incorrect because storing keys in plaintext on a management PC violates core key-protection principles; keys should remain inside the HSM or be wrapped/encrypted. Option C is incorrect because allowing anonymous administrative shell access is a severe misconfiguration, not a valid validation check.

Answer

Ensure all keys are stored in plaintext on the HSM's management PC.

Answer

Check if the HSM allows anonymous access to the administrative shell.

Question 4

When conducting a security validation of a cloud-based infrastructure, which TWO of the following tasks are essential for verification?

Accepted Answer

Verifying that security group ingress rules are restrictive.. Option A is correct because verifying that security group ingress rules are restrictive directly confirms that network exposure is minimized—only explicitly permitted ports, protocols, and source CIDRs should be allowed, which is a core control in cloud security validation. Option B is correct because reviewing IAM role definitions for least privilege ensures identities are granted only the permissions required for their function, reducing the blast radius of compromised credentials; this is a fundamental cloud access-control verification task. Option C does not belong because auditing billing for cost anomalies is a financial/FinOps activity, not a security validation control. Option D does not belong because in a cloud-based infrastructure the customer typically has no access to physical server hardware, and tamper evidence is the provider's responsibility under the shared responsibility model. Option E does not belong because the underlying host OS is managed by the cloud provider (for IaaS, the hypervisor/host layer), so customers cannot validate its patch level; they would instead validate guest OS patching on their own instances.

Answer

Ensuring the billing account is audited for cost anomalies.

Answer

Checking the physical server hardware for tamper evidence.

Answer

Validating the OS patch level of the underlying host.

Question 5

You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?

Accepted Answer

Run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1.. The correct command is to run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1. This virtual file reflects the kernel's FIPS mode status. When FIPS mode is enabled, the value is 1; otherwise, it is 0. This is the standard method to verify FIPS mode on Linux systems that use the kernel crypto API.

Answer

Inspect '/etc/fips.conf' for the FIPS_ENABLED=true directive.

Answer

Check the status using 'systemctl status crypto-policy'.

Answer

Execute 'openssl verify -CApath /etc/ssl/certs' to validate certificate chains.

Question 6

An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?

Accepted Answer

That all cryptographic modules utilized by the system are FIPS 140-3 validated.. FIPS 140-3 is a U.S. government standard (superseding FIPS 140-2) that specifies security requirements for cryptographic modules. To claim FIPS 140-3 compliance, every cryptographic module the system relies on — for encryption, hashing, key generation, TLS, signing, etc. — must be validated under the CMVP (Cryptographic Module Validation Program) and appear on the NIST validated modules list. The ISSEP must verify this during design because swapping in a non-validated module later invalidates the entire compliance posture.

Answer

That the system uses TLS 1.3 for data in transit.

Answer

That the cloud management console uses Multi-Factor Authentication (MFA).

Answer

That the cloud provider's storage is encrypted at rest.

Question 7

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

Accepted Answer

Identify the assets and the relevant security requirements.. The first step in any security validation process is to identify the assets and the relevant security requirements. Without knowing what systems, applications, and data need protection and what security policies apply, you cannot effectively validate security controls. This foundational step ensures that subsequent actions like logging, patching, or penetration testing are scoped correctly and address the right risks.

Answer

Enable all logging mechanisms.

Answer

Patch the operating system.

Answer

Run a full-scale penetration test.

Question 8

A system is undergoing accreditation. You need to verify that automated vulnerability scanning is occurring on a recurring basis. Which artifact provides the best evidence?

Accepted Answer

A series of scan reports spanning the required frequency interval.. A series of scan reports spanning the required frequency interval provides the best evidence because it demonstrates actual, recurring vulnerability scanning over time. Each report typically includes timestamps, scan targets, and findings, proving that scans were performed at the required intervals. This is concrete, verifiable evidence that an auditor can independently review, unlike policy documents or assertions.

Answer

A copy of the security policy document.

Answer

An email from the security team confirming they run scans.

Answer

A screenshot of the vulnerability scanner dashboard.

Question 9

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

Accepted Answer

Deploy an AWS Config custom rule using an AWS Lambda function to evaluate resource configurations.. AWS Config custom rules allow you to define your own compliance logic using AWS Lambda functions that evaluate resource configurations against your specific security policy. This enables continuous monitoring because AWS Config automatically triggers the Lambda function whenever a relevant resource changes or on a periodic schedule, and it records compliance results. Unlike built-in managed rules, custom rules give you the flexibility to enforce bespoke policies that aren't covered out-of-the-box.

Answer

Configure Amazon GuardDuty to alert on unauthorized resource modifications.

Answer

Use AWS Trusted Advisor to scan for unencrypted S3 buckets.

Answer

Enable AWS CloudTrail to log all API calls and review the logs for policy violations.

Question 10

An ISSEP is tasked with designing a security architecture for a system that must comply with the NIST RMF. During the architecture definition, the ISSEP needs to ensure that the system can be authorized to operate. Which activity should be performed to provide the necessary evidence for the authorization decision?

Accepted Answer

Conduct a security assessment to determine the effectiveness of implemented controls. The security assessment is the RMF activity that tests and evaluates implemented controls to determine their effectiveness. It produces the security assessment report (SAR), which, along with the SSP and POA&M, forms the authorization package. The authorizing official uses the SAR to make an informed risk-based decision to authorize the system. Without a security assessment, there is no independent verification that the controls are working as designed.

Answer

Create a plan of action and milestones (POA&M) to track remediation of weaknesses

Answer

Develop a system security plan (SSP) that documents the control implementation

Answer

Perform a risk assessment to identify threats and vulnerabilities

Question 11

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

Accepted Answer

SAST (Static Application Security Testing). Static Application Security Testing (SAST) tools analyze source code for security vulnerabilities without executing the code, making them ideal for the build stage.

Answer

DAST (Dynamic Application Security Testing)

Answer

IDS (Intrusion Detection System)

Answer

SIEM (Security Information and Event Management)

Question 12

Which TWO actions should be included in a secure decommissioning process for a physical server?

Accepted Answer

Sanitizing all storage media according to NIST 800-88. Inventory management and secure media sanitization are critical to preventing data leakage during decommissioning.

Answer

Exporting the full system logs to a public folder

Answer

Changing the BIOS password

Answer

Reformatting the drive with FAT32

Question 13

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

Accepted Answer

Fail-over systems can introduce insecure states or bypasses. Fail-over mechanisms often create race conditions or temporary bypasses that attackers can exploit to gain unauthorized access.

Answer

Fail-over systems are too expensive

Answer

The fail-over process might be too slow

Answer

Fail-over systems use too much power

Question 14

An ISSEP is reviewing the risk of data residency for a system. Why is data residency a significant factor in a cloud-based risk assessment?

Accepted Answer

Legal and regulatory frameworks may mandate that sensitive data be stored within specific jurisdictions.. Data residency requirements often dictate that data must remain within specific geographic boundaries to comply with legal/regulatory obligations (e.g., GDPR, local laws), making it a significant compliance risk.

Answer

Cloud storage is inherently slower in some regions.

Answer

Cloud providers do not allow the choice of storage location.

Answer

Data residency is only applicable to on-premises systems.

Question 15

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

Accepted Answer

Document the risk and implement compensating controls. The ISSE should perform a gap analysis to determine if a compensating control can mitigate the risk until the legacy system can be upgraded or replaced.

Answer

Forcibly inject TLS 1.3 into the binary

Answer

Ignore the finding because it is a legacy system

Answer

Immediately shut down the system