ISC Practice Test 17 — 15 Questions

Question 1

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

Accepted Answer

Verify the use of mutual TLS (mTLS) and log hashing/signing in the syslog configuration.. Log integrity is verified by ensuring the logs are digitally signed or protected from tampering during transit.

Answer

Verify that the SIEM administrative account has read-only permissions.

Answer

Review the firewall logs to see if port 514 is open.

Answer

Check if the SIEM has received a sample log entry via 'tail -f'.

Question 2

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

Accepted Answer

Automated security scanning and log aggregation.. ConMon requires both the technical capability to detect changes/vulnerabilities and the organizational capability to respond to those findings in a timely manner.

Answer

Manual inspection of every system component once per year.

Answer

A complete cessation of all system updates.

Answer

Limiting the scope of monitoring to only the primary web server.

Question 3

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model focuses on confidentiality by enforcing the 'no read up, no write down' rules.

Answer

Clark-Wilson model

Answer

Biba model

Answer

Brewer-Nash model

Question 4

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 5

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 6

When engineering a 'Secure Boot' sequence, what is the primary security objective?

Accepted Answer

To ensure only trusted, signed code is executed. Secure Boot ensures that every piece of software loaded during the boot process is digitally signed by a trusted entity, preventing rootkits from loading early.

Answer

To allow for easy BIOS updates

Answer

To bypass the need for an OS

Answer

To speed up the boot process

Question 7

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

Accepted Answer

Perform ping tests between VMs in different security zones.. Validating microsegmentation requires testing lateral movement between segments that should be isolated.

Answer

Inspect the physical switch port configuration.

Answer

Review the cloud provider's SLA.

Answer

Check the DNS records for the servers.

Question 8

An ISSEP is conducting a security architecture review for a system that will process classified information. The system owner wants to ensure that the architecture includes appropriate boundary defense mechanisms. The ISSEP must recommend controls that provide boundary defense. Which two controls should the ISSEP recommend? (Choose two.)

Accepted Answer

Using access control lists (ACLs) on boundary routers. Boundary defense controls are those that protect the network perimeter, such as firewalls, DMZs, and router ACLs. A DMZ with dual-homed firewalls and ACLs on boundary routers both provide traffic filtering and segmentation at the boundary. HIDS, encryption at rest, and security awareness training are important but do not serve as boundary defense mechanisms. Therefore, the correct recommendations are the DMZ with dual-homed firewalls and the use of ACLs on boundary routers.

Answer

Encrypting all data at rest using AES-256

Answer

Implementing host-based intrusion detection systems (HIDS) on all servers

Answer

Conducting regular security awareness training for all users

Question 9

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

Accepted Answer

Confirmation that no new vulnerabilities were introduced. A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

Answer

The total budget spent on the project

Answer

List of employees who didn't like the change

Question 10

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

Accepted Answer

Attempt to log in with valid credentials and verify that the system prompts for the secondary token.. Successful authentication with a second factor is the ultimate proof of correct implementation.

Answer

Verify that the account has a 'mobile' field populated.

Answer

Review the MFA server logs for daily activity.

Answer

Check the user account settings in the Active Directory console.

Question 11

Which TWO of the following are common pitfalls when tailoring security controls in an RMF implementation?

Accepted Answer

Tailoring controls without documenting the security justification.. Tailoring must be justified and documented. Pitfalls include excessive tailoring (reducing security too much) or lack of justification, which both undermine the compliance posture.

Answer

Using the NIST 800-53 catalog to select controls.

Answer

Consulting with the System Owner during the tailoring process.

Answer

Including too many controls, which is always acceptable.

Question 12

What is the primary objective of the 'Assessment' phase in the NIST RMF?

Accepted Answer

Verify that security controls are implemented correctly and operating as intended.. The Assessment phase is dedicated to determining if the selected security controls are correctly implemented and operating as intended.

Answer

Document the risk acceptance by the authorizing official.

Answer

Define the system's security impact level.

Answer

Deploy security software to endpoints.

Question 13

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

Accepted Answer

The security control is bypassed, allowing unauthorized access.. A 'fail-open' configuration means that when a security control (MFA) is unavailable, the system grants access anyway, effectively bypassing the security requirement and creating a critical vulnerability.

Answer

The system's performance will decrease.

Answer

The MFA provider will charge extra fees.

Answer

The system will be inaccessible to users.

Question 14

An ISSEP professional is reviewing an architecture for compliance with NIST SP 800-160, Systems Security Engineering. Which THREE of the following activities are core to the 'Trustworthiness' objective for an engineered system?

Accepted Answer

Hardware-based root of trust integration.. Trustworthiness is built through robust design, consistent verification, and proactive mitigation of vulnerabilities throughout the lifecycle.

Answer

Prioritizing feature release speed over security patches.

Answer

Outsourcing all security monitoring to third-party providers.

Question 15

What is the primary goal of the 'Authorization' phase in the NIST RMF?

Accepted Answer

For the Authorizing Official to formally accept the system's risk.. The authorization phase is where the Authorizing Official (AO) reviews the security documentation and decides whether to accept the risk associated with operating the system.

Answer

To patch all identified vulnerabilities.

Answer

To define the system's security controls.

Answer

To set up the monitoring tools.