ISC Practice Test 15 — 15 Questions

Question 1

You are managing the lifecycle of an enterprise-level cryptographic key. What is the most critical step prior to key decommissioning?

Accepted Answer

Archiving the key. Archiving the key is necessary to decrypt legacy data that was encrypted with the old key, otherwise, that data becomes permanently inaccessible.

Answer

Sending a notification email

Answer

Updating the firewall rules

Answer

Overwriting the key in RAM

Question 2

Which THREE strategies are used to mitigate risk during a production software change?

Accepted Answer

Phased rollout (canary deployment). Phased rollouts, automated rollback, and canary testing are standard industry practices to limit the blast radius of a failed change.

Answer

Increasing the system clock speed

Answer

Sending a company-wide email notification

Question 3

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

Accepted Answer

Deploy an AWS Config custom rule using an AWS Lambda function to evaluate resource configurations.. AWS Config rules allow for the definition of custom policies that trigger evaluations based on resource configuration changes.

Answer

Configure Amazon GuardDuty to alert on unauthorized resource modifications.

Answer

Use AWS Trusted Advisor to scan for unencrypted S3 buckets.

Answer

Enable AWS CloudTrail to log all API calls and review the logs for policy violations.

Question 4

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

Accepted Answer

Verify that Security Groups follow the principle of least privilege.. Network security validation in the cloud involves checking security groups, NACLs, and VPC flow logs.

Answer

Configure the VPC to allow all inbound traffic from 0.0.0.0/0.

Answer

Disable the firewall on all EC2 instances to improve performance.

Question 5

In a Kubernetes environment, you are updating a security sidecar container. Which deployment strategy ensures zero downtime while maintaining security posture?

Accepted Answer

RollingUpdate. Rolling updates allow for updating pods incrementally, ensuring the security sidecar is active throughout the transition.

Answer

Recreate

Answer

Canary Release

Answer

Blue/Green Deployment

Question 6

An organization is deploying a serverless architecture (AWS Lambda). How does the risk of patch management change compared to a traditional IaaS model?

Accepted Answer

Patch management of the underlying host OS is handled by the cloud provider.. In serverless, the provider manages the underlying operating system and runtime patches, shifting the responsibility of patch management from the user to the provider, though the user still remains responsible for their code and configuration.

Answer

Patch management complexity increases due to the number of functions.

Answer

The user must now use a specialized patching tool for the serverless platform.

Answer

The user is no longer responsible for any patching.

Question 7

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

Accepted Answer

Identify the assets and the relevant security requirements.. Inventory and understanding the threat landscape are prerequisites for any validation effort.

Answer

Enable all logging mechanisms.

Answer

Patch the operating system.

Answer

Run a full-scale penetration test.

Question 8

An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?

Accepted Answer

That all cryptographic modules utilized by the system are FIPS 140-3 validated.. FIPS 140-3 certification is specific to the cryptographic modules used within the system. The ISSEP must ensure that all cryptographic operations are handled by modules validated to this standard.

Answer

That the system uses TLS 1.3 for data in transit.

Answer

That the cloud management console uses Multi-Factor Authentication (MFA).

Answer

That the cloud provider's storage is encrypted at rest.

Question 9

Which TWO criteria are used to determine if a change request must be reviewed by the Change Advisory Board (CAB)?

Accepted Answer

Potential impact on system availability. Changes that have a significant risk or potential for wide-reaching impact must undergo CAB review to ensure proper oversight.

Answer

The time of day the change is performed

Answer

The color of the hardware

Answer

The name of the lead technician

Question 10

When validating the security implementation of a Cisco ASA firewall, which command provides the most accurate verification of the currently applied Access Control List (ACL) to a specific interface?

Accepted Answer

show access-list. The 'show access-list' command displays the ordered list of rules and their hit counts, which is vital for validation.

Answer

show run interface

Answer

show version

Answer

show interface status

Question 11

You are validating the security of a web application. Which TWO of the following actions verify that input validation is effective against SQL injection?

Accepted Answer

Attempting to input common SQL injection characters (e.g., ') in application fields.. Using parameterized queries and reviewing input filter logic are the two most effective ways to verify SQLi defenses.

Answer

Verifying that the database administrator account has full system access.

Answer

Ensuring the website uses SSL/TLS for all traffic.

Answer

Checking that the web server is running on the latest patch version.

Question 12

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

Accepted Answer

Attribute-Based Access Control (ABAC). Attribute-Based Access Control (ABAC) provides granular control based on user, environment, and resource attributes, ideal for complex microservice environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 13

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. NIST SP 800-53 SA controls (System and Services Acquisition) specifically cover the lifecycle management, including initial configuration and security baseline maintenance.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 14

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

Accepted Answer

Checking that the audit logging mechanism is active.. Database security verification includes reviewing access controls, encryption, and audit settings.

Answer

Disabling all backups to ensure the database remains small.

Answer

Ensuring the database is configured to accept all remote connections.

Question 15

You are assessing a system that uses 'Homomorphic Encryption' for data processing. What is the primary operational trade-off the system designer must consider?

Accepted Answer

Significant computational overhead and latency.. Homomorphic encryption allows computation on encrypted data, but it is extremely resource-intensive, resulting in significant latency and performance overhead compared to processing unencrypted data.

Answer

Increased security of data at rest.

Answer

Incompatibility with standard database engines.

Answer

Complexity of key management.