ISC Practice Exam 4 — 20 Questions

Question 1

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

Accepted Answer

Verify the module is on the NIST CMVP validated list.. The cryptographic module must be explicitly listed on the CMVP (Cryptographic Module Validation Program) validated list, not just 'based on' an algorithm.

Answer

Ensure the vendor claims the product is FIPS compliant.

Answer

Ensure the product is open source.

Answer

Verify the algorithms are AES-256.

Question 2

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

Accepted Answer

Configure API Gateway rate limiting policies per user or per IP.. Implementing API rate limiting at the API Gateway level prevents single clients from overwhelming the backend services.

Answer

Require an API key for every request.

Answer

Load balance the API across more servers.

Answer

Use a custom header to validate the request source.

Question 3

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

Accepted Answer

It serves as the contract between the vendor and the evaluator. The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.

Answer

It replaces the need for a threat model

Answer

It is a marketing document for end users

Answer

It defines the operating system kernel

Question 4

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

Accepted Answer

Use Cloud HSM to store keys and keep raw PII in an on-premises database.. Data at rest is kept on-premises in a sovereign zone, while ephemeral processing is performed in the cloud, utilizing encryption with customer-managed keys (CMK) stored on-premises to ensure control.

Answer

Implement a full database mirror in the cloud without encryption.

Answer

Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.

Answer

Use public cloud object storage and rely on IP whitelisting.

Question 5

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Accepted Answer

Statement of Applicability (SoA).. The Statement of Applicability (SoA) is the required document in ISO 27001 that outlines which controls are applicable and provides justifications for those that are excluded.

Answer

Risk Assessment Report (RAR).

Answer

System Security Plan (SSP).

Answer

Business Impact Analysis (BIA).

Question 6

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

Accepted Answer

The IdP must digitally sign the SAML assertion.. SAML assertions must be digitally signed by the Identity Provider (IdP) to ensure integrity and authenticity.

Answer

Use a shared secret between the IdP and SP.

Answer

Use HTTPS with TLS 1.3 for transport.

Answer

The Service Provider must encrypt the assertion.

Question 7

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

Accepted Answer

POA&M (Plan of Action and Milestones).. The POA&M (Plan of Action and Milestones) is the document used to track security weaknesses and the progress of remediation efforts.

Answer

Risk Management Framework (RMF) Guide.

Answer

System Security Plan (SSP).

Answer

Security Assessment Report (SAR).

Question 8

Which TWO of the following are considered critical components of a Secure Software Development Life Cycle (SDLC)?

Accepted Answer

Threat Modeling.. Security requirements analysis and threat modeling are fundamental proactive steps in an SDLC.

Answer

Patching the OS of the build server.

Answer

Using a dark theme for the IDE.

Answer

Final penetration testing before release.

Question 9

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 10

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

Accepted Answer

PermitRootLogin. PermitRootLogin no is a standard hardening requirement for SSH.

Answer

PubkeyAuthentication

Answer

X11Forwarding

Answer

PasswordAuthentication

Question 11

What is the primary benefit of modularity in secure systems design?

Accepted Answer

Facilitates security analysis and component isolation. Modularity allows for fault isolation and easier security verification of individual components.

Answer

Reduces the total number of lines of code

Answer

Eliminates the need for API gateways

Answer

Guarantees the system cannot be hacked

Question 12

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

Accepted Answer

Version control systems (e.g., Git). Documentation must be version-controlled and subject to strict change management to remain accurate.

Answer

Relying on verbal updates from team members

Answer

Posting documents on a public forum

Answer

Periodic manual document destruction

Question 13

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

Accepted Answer

It provides redundancy and DoS mitigation. Load balancers distribute traffic, preventing any single instance from being overwhelmed (a form of DoS mitigation) and allowing for maintenance without downtime.

Answer

It caches all static content

Answer

It replaces the need for a firewall

Answer

It encrypts all traffic

Question 14

Which TWO methods are effective for managing cryptographic keys in a cloud architecture?

Accepted Answer

Deploy a dedicated Hardware Security Module (HSM).. Using a managed Key Management Service (KMS) or a Hardware Security Module (HSM) are the industry standard approaches for secure key management.

Answer

Hardcode keys in the application source code.

Answer

Save keys as plain text files on the VM.

Answer

Store keys in environment variables.

Question 15

An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?

Accepted Answer

Network segmentation. Network segmentation and compartmentalization are essential for preventing lateral movement.

Answer

Unified authentication store

Answer

Centralized logging

Answer

Flat network topology

Question 16

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

Accepted Answer

Implement Istio with mTLS and AuthorizationPolicies.. Using a service mesh like Istio enables mTLS and granular authorization policies (RBAC) between microservices, which is the standard implementation for least privilege in containerized environments.

Answer

Use the default ClusterRoleBinding for all pods.

Answer

Deploy all microservices into a single flat network segment.

Answer

Enable Kubernetes NetworkPolicies only at the namespace level.

Question 17

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

Accepted Answer

Physical air-gapping and hardware-level encryption with HSMs.. Air-gapping (physical) combined with Hardware Security Modules (logical) provides the highest level of isolation for sensitive data.

Answer

Shared storage with ACLs.

Answer

VLAN tagging and firewall rules.

Answer

Container isolation with restricted network access.

Question 18

Which THREE items are required to verify the integrity of a downloaded software package?

Accepted Answer

The cryptographically signed hash (e.g., .asc or .sig file).. To verify integrity, you need the original package, the cryptographic hash of the package, and the signature or public key to verify that the hash was generated by the legitimate author.

Answer

The original source code repository URL.

Answer

The developer's password.

Question 19

You are assessing a system for compliance with FIPS 140-3. You need to ensure that the cryptographic module being used for TLS termination on a load balancer meets specific physical security requirements. Where should you look for the validation status of the cryptographic module?

Accepted Answer

NIST CMVP Module Registry. The NIST Cryptographic Module Validation Program (CMVP) maintains the official registry of all FIPS-validated modules.

Answer

Common Criteria Portal

Answer

CVE Database

Answer

ISO 27001 Annex A controls list

Question 20

You are designing an incident response architecture for a cloud environment. Which TWO of the following configurations are critical for ensuring effective forensic readiness according to NIST SP 800-61?

Accepted Answer

Centralizing logs in a read-only security account.. Forensic readiness requires high-fidelity, tamper-proof logs and centralized aggregation to ensure evidence integrity.

Answer

Using local disk storage for all incident response artifacts.

Answer

Enabling verbose debug mode on all production services.

Answer

Configuring short retention periods for all system logs to save cost.