ISC Practice Test 20 — 15 Questions

Question 1

A security engineer is verifying that an implemented boundary device correctly performs deep inspection of allowed application traffic rather than only permitting it based on port and protocol. The requirement states that the device must detect and block protocol anomalies within permitted sessions. Which verification approach provides the strongest evidence that this inspection capability is genuinely operating?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Send crafted traffic containing a known protocol anomaly inside an otherwise permitted session and confirm the device blocks or alerts. Deep inspection requirements demand evidence that the engine examines content within permitted sessions, not merely that the feature is licensed or referenced. Crafting a known protocol anomaly inside an allowed flow and observing the block or alert exercises the full inspection path. This dynamic verification confirms the capability is bound to the policy and functioning, which configuration review and logging alone cannot establish.

Answer

Review the rule base to confirm that inspection profiles are referenced by the rules permitting the application traffic

Answer

Verify that the device logs all permitted sessions with source and destination information for audit purposes

Answer

Confirm the device's feature list includes application inspection modules and that the relevant licenses are active

Question 2

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 3

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

Accepted Answer

Conducting the security control assessment. The Assess step focuses on determining the effectiveness of the security controls implemented in the system.

Answer

Authorizing the system for operation

Answer

Disposing of the system components

Question 4

You are the ISSE for a system that has just been decommissioned. The system security plan included a contingency plan that referenced a failover site. Which action is MOST important to perform during the disposal phase to prevent unauthorized access to sensitive data that may remain at the failover site?

Accepted Answer

Verify that all media and backup copies at the failover site are sanitized or destroyed according to the approved disposal plan.. Decommissioning a primary system does not automatically sanitize data replicated to a failover site. The ISSE must verify that all media and backups at the failover site are sanitized or destroyed per the disposal plan. This prevents unauthorized access to residual sensitive data that could be overlooked if only the primary site is addressed.

Answer

Conduct a vulnerability scan of the failover site to identify any open ports that could expose data.

Answer

Notify the failover site administrator that the system is decommissioned and request confirmation that no data remains.

Answer

Update the contingency plan to remove references to the failover site and archive the plan.

Question 5

You are performing a security validation of a database to ensure that all administrative actions are captured. Which feature must be checked to confirm that logging is capturing these events?

Accepted Answer

Audit Policy configuration. Audit Policy configuration is the database feature that determines which administrative and user actions are written to audit logs, including privileged operations like GRANT, CREATE USER, and ALTER SYSTEM. To confirm administrative actions are captured, you must verify that the audit policy explicitly includes those statement types and privilege classes. Without a properly scoped audit policy, the database engine will not emit audit records regardless of other settings.

Answer

Database connection pool settings

Answer

Database backup settings

Answer

Database user permissions

Question 6

An ISSEP is reviewing the security architecture for a system that will handle law enforcement sensitive data. The system owner wants to ensure that the design supports the concept of least privilege and separation of duties. Which security engineering principle should the ISSEP apply to enforce these requirements at the architectural level?

Accepted Answer

Implement role-based access control (RBAC) with mutually exclusive roles and granular permissions. Role-based access control with mutually exclusive roles and granular permissions is a proven architectural approach to enforce least privilege and separation of duties. By defining roles that align with job functions and ensuring conflicting roles cannot be assigned to the same user, the system prevents privilege abuse and conflicts of interest. Granular permissions within each role further restrict access to only what is required, satisfying both principles.

Answer

Establish a rule-based access control (RuBAC) system that evaluates access based on environmental conditions

Answer

Configure discretionary access control (DAC) where data owners set permissions on their own resources

Answer

Deploy a mandatory access control (MAC) model using sensitivity labels and clearances

Question 7

A system is undergoing security control assessment before authorization to operate. The assessor must determine whether the implemented audit logging control satisfies the stated requirement that all authentication events, including failures, are recorded with sufficient detail for accountability. Which assessment method yields the most defensible evidence for this determination?

Accepted Answer

Generating both successful and failed authentication attempts, then examining the resulting log entries for required detail. Assessment methods fall into interview, examine, and test categories, and control effectiveness claims need the strongest applicable evidence. Triggering real authentication successes and failures and then reading the resulting records both demonstrates event capture and reveals entry detail. This directly addresses the requirement for complete, accountable authentication logging and produces artifacts that can be independently re-verified.

Answer

Interviewing the system administrator about how logging was configured during deployment

Answer

Reviewing the vendor's product documentation describing which authentication events the platform can log

Answer

Confirming that the log retention policy specifies a period consistent with the organization's records schedule

Question 8

A federal information system is being decommissioned. The ISSE must ensure that hardware containing controlled unclassified information is disposed of in a manner that satisfies both the agency's media protection policy and its contract with a cloud service provider that hosted backups. Which action best addresses the disposal obligation for the provider-held backups?

Accepted Answer

Request a certificate of destruction from the provider covering the backup media.. When a provider holds backups of controlled unclassified information, the agency must obtain documented assurance that the media was sanitized or destroyed. A certificate of destruction provides that evidence and aligns with the media protection policy. Retaining data until a schedule expires, deleting portal references, or revoking access does not demonstrate that the information is gone.

Answer

Rely on the provider's standard data retention schedule to expire the backups.

Answer

Download the backups to agency storage and delete them from the provider portal.

Answer

Revoke the provider's access keys and close the service account.

Question 9

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

Accepted Answer

Select security and privacy controls.. The RMF sequence is: Categorize, Select, Implement, Assess, Authorize, Monitor. Selecting controls follows categorization.

Answer

Implement security and privacy controls.

Answer

Monitor security and privacy controls.

Answer

Assess security and privacy controls.

Question 10

Which THREE elements are essential in a Change Management policy?

Accepted Answer

Requirements for audit logging and evidence collection. A robust policy requires defined roles, a clear process flow, and mandatory audit logging to ensure accountability and compliance.

Answer

Hardware shipping methods

Answer

Instructions on how to write code

Question 11

An ISSEP is performing a system-level risk assessment for a new payroll processing system that will operate in a shared datacenter. The system owner insists on using a qualitative risk matrix because the organization lacks reliable historical incident data. During validation, the ISSEP notes that two different assessors assigned the same threat scenario to different likelihood categories, and the risk scores diverged significantly. Which action best addresses this inconsistency while preserving the qualitative approach?

Accepted Answer

Define explicit ordinal scales with documented criteria and anchor examples for each likelihood and impact level, then calibrate assessors against them.. The inconsistency stems from ambiguous likelihood and impact definitions, not from the qualitative method itself. Establishing explicit ordinal scales with documented criteria and anchor examples gives assessors a common reference, and calibration exercises align their judgments. This directly corrects the divergence while retaining the qualitative approach that the missing historical data makes necessary. Averaging, escalation, or switching to quantitative methods does not fix the definitional ambiguity.

Answer

Replace the qualitative matrix with a purely quantitative Annualized Loss Expectancy (ALE) calculation using industry-average exposure factors.

Answer

Escalate every disputed scenario to the Authorizing Official for a final risk determination before the assessment can continue.

Answer

Average the two assessors' likelihood ratings for every scenario and use the mean value as the final likelihood category.

Question 12

A government agency is decommissioning a legacy mainframe that processes sensitive but unclassified data. The agency must ensure that all data is irretrievably destroyed and that the destruction is verifiable for audit purposes. Which disposal method best meets these requirements?

Accepted Answer

Incineration at a licensed facility with a certificate of destruction.. Incineration is a physical destruction method that ensures data cannot be recovered and produces a certificate of destruction, which is essential for audit verification. Other methods like overwriting, degaussing, or reformatting either leave the media intact or do not provide verifiable proof of destruction.

Answer

Overwriting each disk with a random pattern using a certified wiping tool.

Answer

Degaussing the mainframe's tape reels and disk packs.

Answer

Deleting all files and reformatting the storage volumes.

Question 13

You are validating the implementation of security controls for a database server that stores sensitive customer data. The requirement is to verify that the database enforces encryption at rest and that access is restricted to authorized users. Which TWO of the following verification activities best confirm that these requirements are met? (Choose two.)

Accepted Answer

Review database user accounts and roles to confirm that only authorized personnel have access and that least privilege is enforced.. Encryption at rest is verified by confirming TDE and secure key storage, while access restriction is verified by reviewing user accounts and roles for least privilege. Network scanning, backup tape encryption, and audit logging address other security aspects but do not directly confirm the two stated requirements. The combination of TDE/HSM and role review provides the most direct evidence.

Answer

Confirm that the database audit log records all SELECT statements on sensitive tables.

Answer

Verify that database backups are stored on encrypted tape media.

Answer

Run a network vulnerability scan against the database server to identify open ports and missing patches.

Question 14

Which TWO items should be included in a system's security architecture documentation?

Accepted Answer

Network topology diagrams.. Network diagrams and data flow diagrams are essential for understanding the security posture of a system.

Answer

Marketing brochures for the software.

Answer

Office building blueprints.

Answer

Employee vacation schedules.

Question 15

A systems security engineer is performing a functional decomposition of a new command-and-control system. The chief engineer insists that every allocated security control be traceable back to an approved stakeholder requirement before the preliminary design review. Which artifact should the ISSE produce to satisfy this demand?

Accepted Answer

A requirements traceability matrix linking each security control to its parent stakeholder requirement. Functional decomposition breaks stakeholder needs into lower-level functions and allocates security controls to them. Proving that each allocated control descends from an approved stakeholder requirement requires a requirements traceability matrix, which records parent-child relationships and exposes orphan controls or unallocated requirements. The other artifacts address implementation status, assessment results, or change governance, none of which establish requirement lineage at the preliminary design review.

Answer

A configuration management plan describing change control for the decomposed system elements

Answer

A security assessment report capturing findings from testing of the decomposed functions

Answer

A system security plan documenting the implemented controls and their operational environment