ISC Practice Test 16 — 15 Questions

Question 1

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

Accepted Answer

Protected Branches with Merge Request approvals. GitLab protected branches allow for granular permissions to restrict who can push or merge, which is a standard security control for change management.

Answer

Global Runner tags

Answer

Pipeline schedules for automated auditing

Answer

Webhook integration with Jira

Question 2

Which TWO actions should be included in a secure decommissioning process for a physical server?

Accepted Answer

Sanitizing all storage media according to NIST 800-88. Inventory management and secure media sanitization are critical to preventing data leakage during decommissioning.

Answer

Exporting the full system logs to a public folder

Answer

Changing the BIOS password

Answer

Reformatting the drive with FAT32

Question 3

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

Accepted Answer

Move to WORM media. Moving data to offline, immutable storage (WORM) ensures compliance with retention policies while protecting against unauthorized modification or deletion.

Answer

Copy to an unencrypted thumb drive

Answer

Delete the database server

Answer

Store on a public cloud share

Question 4

An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?

Accepted Answer

Easy extraction of keys through reverse engineering the binary.. Hardcoded keys are easily extractable via reverse engineering the app binary, leading to unauthorized use of the third-party services and potential compromise of the developer's account.

Answer

Increased latency for API calls.

Answer

The keys will expire too quickly.

Answer

The app will crash when the API is unavailable.

Question 5

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Accepted Answer

.xml. XCCDF (Extensible Configuration Checklist Description Format) is the standard for defining SCAP security checklists.

Answer

.txt

Answer

.stig

Answer

.ovl

Question 6

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

Accepted Answer

Adjust the baseline controls to address the specific system environment and mission.. Tailoring involves selecting, adapting, and supplementing controls to fit the specific mission and environment, rather than applying a blanket baseline.

Answer

Select all controls from the highest security baseline.

Answer

Exclude all controls that are difficult to implement.

Answer

Only apply controls that are mandated by law.

Question 7

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Accepted Answer

Verify that 'Secure Boot' is set to 'Enabled' and the 'Platform Key' (PK) is installed.. Secure Boot validation requires ensuring the UEFI firmware is set to enforce digital signatures on bootloaders.

Answer

Validate the TPM version is 2.0.

Answer

Check that 'Legacy Boot' is set to 'Disabled'.

Answer

Ensure the system clock is synchronized with a secure NTP server.

Question 8

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

Accepted Answer

Fail-over systems can introduce insecure states or bypasses. Fail-over mechanisms often create race conditions or temporary bypasses that attackers can exploit to gain unauthorized access.

Answer

Fail-over systems are too expensive

Answer

The fail-over process might be too slow

Answer

Fail-over systems use too much power

Question 9

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized database creates a 'single point of failure' (or 'single point of compromise'), where an attacker gaining access to the database potentially compromises all stored PII at once.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 10

You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?

Accepted Answer

Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.. When protocol-specific inspection is impossible, network segmentation and the implementation of unidirectional security gateways (data diodes) provide the highest assurance of protecting critical control systems from external threat vectors.

Answer

Replace the proprietary protocol with OPC-UA to enable standard security monitoring.

Answer

Implement a host-based firewall on the SCADA master station.

Answer

Deploy an intrusion detection system (IDS) that uses behavioral pattern matching.

Question 11

Which TWO of the following are essential components of a robust threat modeling process for an engineered system?

Accepted Answer

Creation of data flow diagrams (DFDs).. Threat modeling requires understanding the system architecture (data flow diagrams) and identifying potential threats using established methodologies like STRIDE to systematically address risks.

Answer

A detailed legal review of all contracts.

Answer

A complete inventory of all organizational personnel.

Answer

A list of all software vendors used by the organization.

Question 12

You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?

Accepted Answer

Zero-trust network policies that enforce default-deny communication between containers.. Micro-segmentation uses policies to restrict communication between workloads, typically at the application or service level. Deny-all by default policies between containers would prevent reconnaissance.

Answer

Enabling flow logging on the network switches.

Answer

Host-based IPS (HIPS).

Answer

Implementing a web application firewall (WAF) at the edge.

Question 13

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

Accepted Answer

Run 'kube-bench --targets etcd' to perform the automated audit.. kube-bench is the industry-standard tool for checking Kubernetes against CIS benchmarks.

Answer

Use 'kubectl get pods' to check the etcd pod configuration.

Answer

Perform a manual audit using 'etcdctl get --prefix /'.

Answer

Use the 'kubectl describe nodes' command to check for node hardening.

Question 14

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

Accepted Answer

sha256sum. Hashing is the standard method for verifying that a file has not been altered.

Answer

cat <filename>

Answer

grep 'modified' <filename>

Answer

ls -l

Question 15

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

Accepted Answer

Send a flood of requests exceeding the defined rate limit and verify that the API returns a 429 Too Many Requests status code.. Testing rate limiting involves exceeding the defined threshold to see if the gateway returns the correct error code.

Answer

Use a vulnerability scanner to check for OWASP API vulnerabilities.

Answer

Review the API Gateway configuration files for the 'rate_limit' keyword.

Answer

Monitor the CPU usage of the backend server.