ISC Practice Test 2 — 10 Questions

Question 1

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 2

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

Accepted Answer

Revoke all certificates and credentials associated with the system.. Secure decommissioning requires sanitizing storage media to prevent data remanence and revoking credentials to eliminate access. These actions address the two primary risks: residual data and lingering trust. Updating disaster recovery plans, scanning for vulnerabilities, or archiving data are not essential for secure disposal and may even conflict with the objective.

Answer

Update the disaster recovery plan to remove the system.

Answer

Conduct a vulnerability scan of the system before decommissioning.

Answer

Back up all data to a long-term archive for potential future use.

Question 3

An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?

Accepted Answer

Escalate the finding to the Authorizing Official with an assessment of the risk and recommended alternatives, since risk acceptance authority rests with that official.. Accepting risk to an accredited system is the Authorizing Official's prerogative. The ISSEP's proper contribution is a clear risk analysis and escalation with alternatives, preserving both the technical record and the formal accountability chain. Unilateral action or informal acceptance would bypass the authorization framework that governs classified systems.

Answer

Direct the operations team to encrypt the tapes immediately and update the security plan, since the ISSEP has authority over security configuration of accredited systems.

Answer

Document the risk acceptance in the plan of action and milestones and allow the system owner to proceed without further action.

Answer

Perform a new quantitative risk assessment to calculate the Annualized Loss Expectancy of tape loss and let the resulting dollar value determine whether the risk is acceptable.

Question 4

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

Accepted Answer

X-Frame-Options: DENY or SAMEORIGIN.. The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.

Answer

X-Content-Type-Options: nosniff.

Answer

Strict-Transport-Security: max-age=63072000.

Answer

X-XSS-Protection: 1; mode=block.

Question 5

An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?

Accepted Answer

Continuously monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official.. Continuous monitoring under RMF is an ongoing process of monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official. This enables timely risk-based decisions and maintains the authorization. Periodic activities like full assessments or penetration tests are supporting elements, not the primary focus.

Answer

Performing an annual penetration test to identify new vulnerabilities.

Answer

Updating the system security plan (SSP) only when a major change occurs.

Answer

Conducting a full security assessment every three years to renew the ATO.

Question 6

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

Accepted Answer

Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.. In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.

Answer

Accept the risk because the API is internal-facing.

Answer

Disable the API entirely.

Answer

Monitor API logs for suspicious activity.

Question 7

An ISSEP is tasked with ensuring that a new information system complies with the organization's security requirements. The system will be deployed in a cloud environment and will process sensitive but unclassified data. The ISSEP must select an appropriate set of security controls and tailor them to the cloud deployment. Which NIST publication provides the security control catalog and guidance for tailoring controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the authoritative catalog of security and privacy controls, and it includes detailed guidance on tailoring controls to specific environments, including cloud deployments. It allows the ISSEP to select controls based on the system's categorization and apply scoping and parameterization. Other publications like SP 800-37 describe the RMF process but do not contain the control catalog itself.

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Answer

NIST SP 800-145

Question 8

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

Accepted Answer

Requirements Analysis. In the Systems Engineering V-Model, the left side represents decomposition and definition phases. Requirements Analysis is the stage where stakeholder needs are translated into system-level requirements, including security functional requirements. Defining security requirements here ensures they are allocated to the system architecture and can be traced through design, implementation, and testing. This early definition is critical for traceability and for avoiding costly rework later.

Answer

Detailed Design

Answer

System Integration and Testing

Answer

Operational Maintenance

Question 9

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

Accepted Answer

The sensor firmware is not signed.. Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.

Answer

The sensor housing is not tamper-evident.

Answer

The sensors use an older version of Bluetooth.

Answer

The vendor does not provide a Service Level Agreement (SLA).

Question 10

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

Accepted Answer

Real-time incident detection. Option A (Real-time incident detection) is correct because ConMon depends on continuous telemetry and alerting (e.g., SIEM correlation, IDS/IPS, EDR) to identify threats as they occur rather than at a point-in-time assessment. Option D (Established incident response procedures) is correct because detection has value only when paired with documented, tested IR playbooks that define triage, escalation, containment, eradication, and recovery actions. Option E (Automated security control status monitoring) is correct because ConMon, per NIST SP 800-137, requires ongoing automated assessment of control effectiveness (e.g., SCAP, continuous diagnostics and mitigation) to maintain an accurate, near-real-time authorization posture. Option B (Quarterly hardware refresh) is not a ConMon factor—hardware lifecycle management is a separate asset management concern and does not provide continuous visibility into security control status or incidents. Option C (Manual annual log review) is not appropriate because annual, manual review is periodic and retrospective, contradicting the continuous, automated nature of an effective ConMon program.

Answer

Quarterly hardware refresh

Answer

Manual annual log review