ISC Practice Test 2 — 10 Questions

Question 1

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security control is bypassed, allowing unauthorized access.. A 'fail-open' configuration means that when a security control (MFA) is unavailable, the system grants access anyway, effectively bypassing the security requirement and creating a critical vulnerability.

Answer

The system's performance will decrease.

Answer

The MFA provider will charge extra fees.

Answer

The system will be inaccessible to users.

Question 2

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Answer

User access manual

Answer

Help desk FAQ

Answer

Network topology diagram

Question 3

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

Accepted Answer

Update the System Security Plan (SSP) to include the missing controls and implement the baseline via Infrastructure-as-Code (IaC) templates.. The RMF requires that security controls be implemented and documented. Identifying a missing baseline during the assessment phase necessitates updating the System Security Plan (SSP) and verifying the implementation of baseline controls before proceeding to the 'Authorize' step.

Answer

Modify the Security Assessment Plan (SAP) to exclude the container layer from the current assessment scope.

Answer

Proceed to authorization and defer the container baseline to the next Continuous Monitoring cycle.

Answer

Request a waiver from the Chief Information Security Officer (CISO) for container orchestration security.

Question 4

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 5

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 6

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Accepted Answer

Verification confirms the system meets specifications; Validation confirms it meets mission goals. Verification ensures the system is built correctly (conformance to requirements), while validation ensures the correct system is built (meeting user needs).

Answer

Verification is for security; Validation is for performance

Answer

Verification is done by vendors, Validation by end-users

Answer

Verification is for software, Validation is for hardware

Question 7

An ISSEP is evaluating the risk of an API that uses basic authentication over HTTP. What is the most significant risk, and how should it be mitigated?

Accepted Answer

Credential interception; mitigate by upgrading to HTTPS/TLS.. Basic authentication sends credentials in cleartext; HTTP does not provide encryption. The risk is credential interception, and it must be mitigated by upgrading to HTTPS (TLS).

Answer

Denial of Service (DoS); mitigate by using a WAF.

Answer

API rate limiting; mitigate by adding a rate limiter.

Answer

Unauthorized data access; mitigate by using OAuth 2.0.

Question 8

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 9

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 10

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

Answer

Formatting the partition

Answer

Degaussing