ISC Practice Test 19 — 15 Questions

Question 1

An ISSEP is assessing a system that uses an air-gapped network for processing highly sensitive data. The security team argues that because the network is air-gapped, risk from external threat actors is negligible and no further analysis is needed. Which response should the ISSEP provide?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Explain that air gaps reduce network-based attack paths but do not remove risk from insider threats, supply chain compromise, or removable media, so a full risk assessment is still required.. Air gaps change the threat landscape but do not eliminate risk. External actors can still reach the system through insiders, compromised supply chain components, or removable media. The ISSEP must ensure the risk assessment considers all credible attack paths and vulnerabilities, not just network-based ones, so that controls and residual risk are properly understood and documented.

Answer

Agree, because air gaps eliminate all network-based attack paths and therefore eliminate external risk.

Answer

State that risk analysis is only needed for systems connected to public networks, so the air-gapped system is exempt.

Answer

Recommend removing the air gap and connecting the network to the enterprise so that centralized monitoring tools can be deployed.

Question 2

An ISSE is developing a security architecture for a new payroll processing system that handles PII and financial data. The system will be deployed on a private cloud and must comply with NIST SP 800-53 controls. The ISSE needs to ensure that the system's security requirements are traceable from initial stakeholder needs through design, implementation, and testing. Which systems security engineering activity best supports this traceability?

Accepted Answer

Establishing a requirements traceability matrix (RTM) that links security requirements to design, code, and test cases.. A requirements traceability matrix provides a structured, auditable link from each security requirement to its origins, design, implementation, and verification. This supports compliance, impact analysis, and verification that all requirements are met. Other activities like threat modeling, security impact analysis, or CMDB maintenance are important but do not fulfill the need for end-to-end requirements traceability in systems security engineering.

Answer

Performing a security impact analysis for each proposed change to the system.

Answer

Conducting a threat modeling exercise using STRIDE during the design phase.

Answer

Implementing a configuration management database (CMDB) to track all hardware and software components.

Question 3

An ISSE is evaluating a commercial off-the-shelf (COTS) product for use in a system that processes classified information. The vendor claims the product is 'secure by design' but provides no formal evaluation. The ISSE must determine the level of assurance that can be placed in the product's security features. Which factor is most critical in assessing the product's assurance level?

Accepted Answer

The presence of independent third-party evaluation and certification, such as Common Criteria.. Assurance in a COTS product for classified use is best determined by independent third-party evaluation, such as Common Criteria, which provides a standardized, rigorous assessment of security functionality and assurance. Vendor reputation, marketing features, and cost are not reliable substitutes for objective evidence. Common Criteria certification indicates the product has been tested against a protection profile and achieved a specific EAL.

Answer

The product's price and licensing cost compared to competitors.

Answer

The number of security features listed in the product's marketing materials.

Answer

The vendor's reputation and market share in the security industry.

Question 4

In the context of the NIST Risk Management Framework (RMF), which step involves the initial identification of security controls based on the system's impact level?

Accepted Answer

Select. Step 2 of the RMF is 'Select', where security controls are selected based on the categorization performed in Step 1.

Answer

Implement

Answer

Assess

Answer

Categorize

Question 5

An ISSE is preparing a disposal plan for a system that has reached end of life. The system includes custom-developed software, commercial hardware, and interfaces to an external identity provider. Which TWO activities must be included in the disposal plan to address security and continuity obligations? (Choose two.)

Accepted Answer

Notify the external identity provider to revoke the system's registered client credentials and service accounts.. A disposal plan must close both the internal security boundary and any external trust relationships. Documenting the removal or transfer of unique security controls ensures no orphaned safeguard remains, and notifying the external identity provider to revoke credentials terminates the system's access path. Retention, unsanitized reuse, and public release do not satisfy disposal obligations.

Answer

Reassign the system's hardware to a new project without sanitizing the storage media.

Answer

Retain the production database indefinitely in case future litigation requires historical records.

Answer

Publish the system's source code to a public repository to preserve it for future reference.

Question 6

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the foundational document that documents all security requirements, controls, and their implementation for a system. It captures the system boundary, control implementations, and inherited controls, making it the authoritative source for ensuring all security requirements are identified and addressed during a risk assessment. Reviewing the SSP first ensures the ISSEP has a complete picture of what controls are required and how they are implemented.

Answer

The vendor's marketing materials.

Answer

The project budget.

Answer

The organizational chart.

Question 7

An ISSEP is leading a risk assessment for a new cloud-based system that will store sensitive customer data. The organization must comply with GDPR and other privacy regulations. Which TWO of the following are the most critical factors to consider when assessing data residency risks? (Choose two.)

Accepted Answer

The cloud provider's data backup and disaster recovery locations.. Data residency risks are primarily concerned with where data is stored and processed, including backup and disaster recovery sites. The physical location of data centers determines which legal jurisdictions apply, and backup locations can inadvertently introduce cross-border transfers. Encryption, user count, and uptime SLAs, while important for security and availability, do not directly address the legal and regulatory aspects of data residency.

Answer

The number of users who will access the system.

Answer

The cloud provider's service level agreement (SLA) for uptime.

Answer

The encryption algorithms used for data at rest and in transit.

Question 8

A security engineer is drafting a change management procedure for a financial institution's production environment. The procedure must ensure that changes are approved before implementation and that emergency changes are handled without bypassing security controls. Which element is essential to include in the procedure?

Accepted Answer

A defined emergency change process that allows retrospective approval within a specified timeframe.. A formal emergency change process with retrospective approval allows critical changes to be implemented swiftly while maintaining security governance through post-implementation review. This ensures that emergency actions do not bypass controls entirely and that all changes are eventually documented and approved by authorized personnel.

Answer

A requirement that all changes be approved by the Chief Information Security Officer (CISO) personally.

Answer

A rule that changes can only be deployed during a monthly maintenance window.

Answer

A policy that all changes must be tested in a staging environment that mirrors production exactly.

Question 9

A security engineer is validating a server's hardening posture against CIS Benchmarks. Which TWO of the following configurations must be verified for the SSH service?

Accepted Answer

Verifying that 'PermitEmptyPasswords' is set to 'no'.. Hardening SSH requires disabling insecure protocols and authentication methods.

Answer

Configuring the service to use only the RSA algorithm.

Answer

Enabling 'AllowTcpForwarding' for all users.

Answer

Setting the default port to 8080.

Question 10

An ISSEP is designing a system that will use a public key infrastructure (PKI) for authentication and encryption. The system owner is concerned about the security of the private keys used by the certificate authorities (CAs) and end entities. The ISSEP must recommend a key management strategy that protects private keys throughout their lifecycle. Which strategy should the ISSEP recommend?

Accepted Answer

Use hardware security modules (HSMs) for CA private keys and smart cards for end-entity private keys.. The best strategy to protect private keys throughout their lifecycle is to use hardware security modules for CA private keys and smart cards for end-entity private keys. HSMs provide tamper-resistant storage and cryptographic processing, while smart cards protect end-entity keys in a portable hardware token. Software keystores, key distribution, and same-server encryption are less secure and do not adequately protect private keys. Therefore, the use of HSMs and smart cards is the correct recommendation.

Answer

Distribute private keys to multiple administrators to ensure availability.

Answer

Encrypt private keys with a symmetric key stored on the same server.

Answer

Store private keys in a software-based keystore protected by a password.

Question 11

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Accepted Answer

Designing effective security countermeasures.. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) requires identifying threats, mapping them to system components, and planning countermeasures.

Answer

Conducting a public relations campaign.

Answer

Automating the software build process.

Question 12

You are advising a program on the disposal of a system that processes Sensitive But Unclassified information. The system uses solid-state drives. The program wants to reuse the drives in a lower-security environment. Which sanitization method is MOST appropriate to allow reuse while ensuring the data cannot be recovered?

Accepted Answer

Use the drive manufacturer's sanitization command to perform a cryptographic erase, and verify the drive's sanitization status.. Cryptographic erase destroys the encryption key, rendering all data on the SSD unrecoverable, and allows the drive to be reused. Verifying the sanitization status confirms the operation succeeded. This method is recommended for SSDs when reuse in a lower-security environment is intended, as it addresses wear leveling and over-provisioning.

Answer

Degauss the solid-state drives to remove all magnetic traces, then reuse them.

Answer

Perform a single-pass overwrite using a software wiping utility, then reuse the drives.

Answer

Physically shred the solid-state drives and purchase new drives for the lower-security environment.

Question 13

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 14

An ISSE is defining the boundary of a system under development and must document which components are inside the trusted computing base (TCB) versus outside it. The system includes a commercial hypervisor, guest virtual machines, a management console, and a hardware security module (HSM). Which criterion most directly determines whether a component belongs inside the TCB?

Accepted Answer

Whether failure or subversion of the component could cause the system to violate its security policy.. The TCB comprises all hardware, firmware, and software whose correct operation is necessary to enforce the system security policy. A component belongs inside the boundary when its failure or subversion would allow a policy violation, regardless of vendor, data classification, or physical location. Applying that criterion keeps the boundary defensible and keeps the evaluation scope manageable.

Answer

Whether the component is supplied by a third-party vendor rather than developed in-house.

Answer

Whether the component resides on the same physical host as the security kernel.

Answer

Whether the component processes data classified above the system's accreditation level.

Question 15

Which of the following is the most appropriate action when an ISSEP identifies a high-risk vulnerability in a system that is currently in production?

Accepted Answer

Document the vulnerability in the POA&M and coordinate a remediation plan with the system owner.. The ISSEP must report the vulnerability to the system owner and the authorization official, then document it in the POA&M to track its remediation while managing the risk in the interim.

Answer

Ignore the vulnerability until the next scheduled maintenance window.

Answer

Immediately shut down the system.

Answer

Fix the vulnerability immediately without informing anyone.