ISC Practice Exam 4 — 20 Questions

Question 1

An ISSEP is evaluating a proposed change to a system that will introduce a new external interface for partner data exchange. The change is scheduled for next week, and the program manager wants to skip a formal risk assessment to meet the deadline. Which action should the ISSEP take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform an abbreviated risk assessment focused on the new interface, document the findings, and present them to the authorizing official for a decision.. When a change introduces a new external interface, a focused risk assessment of that change is appropriate and can be completed quickly. Documenting the findings and presenting them to the authorizing official preserves the decision-making process and provides an auditable record. This approach respects both the schedule and the need to manage risk, rather than skipping assessment or blocking the change entirely.

Answer

Approve the change without assessment because the schedule is tight and the interface is with a trusted partner.

Answer

Reject the change outright because no changes are permitted without a full system-level reassessment.

Answer

Defer the risk assessment until after the interface is deployed and operating, then assess based on real traffic.

Question 2

An ISSEP is reviewing the risk management framework for a defense program. The program uses a continuous monitoring strategy that includes automated vulnerability scanning and configuration compliance checks. A recent audit found that findings are being generated but not consistently reviewed or remediated within the program's defined timelines. Which action should the ISSEP recommend to address the ROOT cause?

Accepted Answer

Establish and enforce a formal risk management process with defined roles, review cadences, and escalation paths for continuous monitoring findings.. The audit finding describes a process failure: findings are generated but not consistently reviewed or remediated. The root cause is the absence of defined accountability, review cadence, and escalation. Increasing scan frequency, changing tools, or reducing scope all address symptoms or workload rather than the governance gap. Establishing a formal risk management process with clear roles, scheduled reviews, and escalation paths creates the structure needed to ensure findings are acted upon within the program's timelines.

Answer

Reduce the scope of continuous monitoring to only critical vulnerabilities so that fewer findings require review.

Answer

Increase the frequency of automated vulnerability scans from weekly to daily to generate more complete data.

Answer

Replace the automated scanning tools with a different vendor's product that has better reporting dashboards.

Question 3

You are an ISSE for a healthcare provider. A legacy server that stored electronic protected health information (ePHI) is being decommissioned. The server's hard drives are encrypted with AES-256, and the encryption keys are managed by a hardware security module (HSM). The drives will be repurposed within the organization for non-sensitive data. According to NIST SP 800-88 Rev. 1, which sanitization method is most appropriate to render the ePHI unrecoverable while allowing drive reuse?

Accepted Answer

Purge the drives by performing a cryptographic erase (crypto-erase) using the HSM to destroy the encryption keys.. Cryptographic erase is the most appropriate method because the drives are already encrypted and the keys can be securely destroyed via the HSM. This renders the ePHI unrecoverable while allowing the drives to be reused. NIST SP 800-88 Rev. 1 recognizes cryptographic erase as a Purge method, which is suitable for media that will be reused within the organization. It is efficient and meets the assurance level required for ePHI.

Answer

Physically destroy the drives by shredding them into 2 mm particles.

Answer

Clear the drives by overwriting with a single pass of zeros.

Answer

Degauss the drives to remove all data and then reuse them.

Question 4

An ISSEP is establishing a risk management process for a new Engineered System that will process controlled unclassified information. The program office wants to ensure that risk decisions are defensible and repeatable across the system lifecycle. Which TWO activities are essential to achieving that outcome? (Choose two.)

Accepted Answer

Defining explicit risk acceptance criteria and the authority levels empowered to accept each category of risk.. Defensible and repeatable risk management depends on pre-established acceptance criteria with clear authority, and on a risk register that is actively maintained as the system and its environment evolve. Together these provide consistency across decisions and traceability over time, which are the properties oversight bodies expect from a lifecycle risk process.

Answer

Using only qualitative risk ratings so that numeric precision cannot be challenged during oversight reviews.

Answer

Requiring every risk to be mitigated to zero before the system receives an Authority to Operate.

Answer

Delegating all risk decisions to the system owner to accelerate the accreditation timeline.

Question 5

An ISSEP is reviewing the risk analysis for an Engineered System that relies on a commercial cloud provider for data storage. The analysis lists provider-side outages as the only supply chain risk. The ISSEP knows the provider uses subcontractors for data center operations and hardware maintenance. Which deficiency in the analysis should the ISSEP address first?

Accepted Answer

The analysis fails to consider dependencies introduced by the provider's subcontractors and the associated visibility and control gaps.. Supply chain risk in cloud environments includes subcontractors and their access to systems, facilities, and data. An analysis that stops at prime provider outages misses fourth-party dependencies, so the ISSEP should first expand the scope to identify and evaluate those relationships, their visibility constraints, and the controls that apply to them.

Answer

The analysis needs to add a business impact analysis that maps outage duration to revenue loss for each business unit.

Answer

The analysis should replace qualitative outage ratings with quantitative availability metrics from the provider's service level agreement.

Answer

The analysis should be recalculated using the provider's annual certification reports as evidence that supply chain risk is managed.

Question 6

An ISSEP is drafting the security architecture for a new federal financial system. The system will process moderate-impact data and must follow the NIST Risk Management Framework (RMF). The system owner asks which document provides the initial allocation of security controls to the system based on the security categorization. Which document should the ISSEP reference?

Accepted Answer

Control baseline from NIST SP 800-53B. The RMF Select step begins with a control baseline from NIST SP 800-53B based on the system's security categorization. For a moderate-impact system, the moderate baseline is the starting point. The ISSEP then tailors the baseline by applying scoping guidance, compensating controls, and organization-defined parameters. The SSP, SAR, and POA&M are later artifacts that document implementation, assessment, and remediation, not the initial allocation.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Question 7

An ISSEP is leading the security engineering effort for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to ensure that the system's security requirements are derived from a formal threat model and that the design mitigates identified threats before development begins. Which activity should the ISSEP perform FIRST to integrate security into the early stages of the system development life cycle?

Accepted Answer

Perform a threat modeling exercise using a methodology such as STRIDE.. Threat modeling is a proactive security engineering activity that identifies threats and informs security requirements early in the SDLC. By using a methodology like STRIDE, the ISSEP can analyze data flows and trust boundaries, then derive specific mitigations. This ensures the system's design addresses threats before development, which is more effective and cost-efficient than retrofitting controls later.

Answer

Conduct a vulnerability assessment on the proposed system architecture.

Answer

Implement a continuous monitoring strategy using automated tools.

Answer

Develop a security assessment plan for the system's authorization package.

Question 8

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

Accepted Answer

Implementing a cloud security posture management (CSPM) tool that continuously monitors for configuration drift.. CSPM tools are designed to continuously monitor cloud environments for configuration drift and compliance with security baselines. They automatically assess resources against policies and provide alerts, enabling real-time verification. This is essential for maintaining a secure cloud posture, especially in dynamic environments where changes occur frequently. Manual reviews, vulnerability scans, and penetration tests are point-in-time activities that do not provide continuous assurance, making CSPM the best choice for this scenario.

Answer

Conducting a penetration test after each deployment.

Answer

Periodic vulnerability scans of the cloud environment.

Answer

Manual review of the IaC templates before deployment.

Question 9

An ISSEP is designing a secure network architecture for a defense contractor that must comply with NIST SP 800-171. The system will handle CUI and requires protection against advanced persistent threats (APTs). The ISSEP proposes using a demilitarized zone (DMZ) with firewalls and intrusion detection systems. Which additional architectural control is most critical to satisfy the NIST SP 800-171 requirement for boundary protection?

Accepted Answer

Establish controlled interfaces at all external and internal boundaries, including subnetworks for publicly accessible components.. NIST SP 800-171 requirement 3.13.1 mandates monitoring, controlling, and protecting communications at external and key internal boundaries. It also requires subnetworks for publicly accessible components. Establishing controlled interfaces at all boundaries directly satisfies this by filtering and inspecting traffic, limiting connections to essential services, and segmenting public-facing components from internal networks. This is the most critical architectural control for boundary protection.

Answer

Deploy a web application firewall (WAF) at the internet boundary to inspect HTTP traffic.

Answer

Implement a screened subnet with stateful firewalls and a proxy for all outbound traffic.

Answer

Encrypt all data in transit using TLS 1.3 between all internal and external endpoints.

Question 10

An ISSEP is drafting the initial security documentation for a new federal payroll system before any controls have been implemented. The authorizing official wants a document that records the system boundary, the security categorization, and the security controls selected from NIST SP 800-53 Rev. 5, and that will serve as the primary artifact supporting the authorization decision throughout the RMF. Which document should the ISSEP produce?

Accepted Answer

System Security Plan (SSP). The System Security Plan is the central RMF artifact that describes the system boundary, the FIPS 199 security categorization, the tailored NIST SP 800-53 Rev. 5 control baseline, and the implementation status of each control. The authorizing official relies on it together with the SAR and POA&M to accept risk, and it must be maintained current across the system lifecycle.

Answer

Security Assessment Report (SAR)

Answer

Information System Contingency Plan (ISCP)

Answer

Plan of Action and Milestones (POA&M)

Question 11

An ISSEP is designing a cross-domain solution (CDS) to allow data transfer between a high-assurance network and a low-assurance network. The solution must enforce a strict one-way flow of data and prevent any possibility of a covert channel back to the high side. Which architectural approach BEST satisfies this requirement?

Accepted Answer

A data diode that physically enforces unidirectional data flow.. A data diode provides a hardware-enforced one-way data path, making it impossible for data to flow from the low side back to the high side. This eliminates covert channels through the transfer mechanism itself. Other solutions like firewalls, VPNs, or proxies are software- or configuration-based and remain bidirectional in principle, so they cannot guarantee the strict unidirectional requirement for a high-assurance CDS.

Answer

A VPN tunnel with IPsec in transport mode between the two networks.

Answer

A dual-homed firewall with stateful inspection and strict ACLs.

Answer

A proxy server that inspects and filters application-layer data.

Question 12

An ISSE is reviewing a system architecture where the design team plans to mitigate a spoofing threat to an external interface by adding a digital signature to each message. During the design review, the ISSE notes that the signing key is stored in plaintext in the same configuration file as the application. Which security engineering principle is most directly violated by this design decision?

Accepted Answer

Cryptographic key management. Digital signatures only provide authenticity and integrity if the private signing key remains secret. Placing that key in plaintext in a configuration file exposes it to anyone with file read access, allowing message forgery and defeating the control. Proper cryptographic key management demands that keys be stored in protected locations such as hardware security modules or encrypted keystores, separate from application code and configuration.

Answer

Separation of duties

Answer

Least common mechanism

Answer

Defense in depth

Question 13

An ISSEP is leading the security engineering effort for a new cloud-based system that will process sensitive but unclassified information. The system must comply with FedRAMP Moderate baseline. The ISSEP is selecting security controls from NIST SP 800-53 Rev. 5. Which TWO controls are most appropriate to address the risk of unauthorized access to data at rest in the cloud environment? (Choose two.)

Accepted Answer

SC-28 Protection of Information at Rest. SC-28 and SC-13 are the most appropriate controls because they directly address the protection of data at rest through cryptographic means. SC-28 mandates protection of information at rest, while SC-13 ensures the use of validated cryptographic modules. Together, they provide confidentiality and integrity for stored data in a cloud environment, meeting FedRAMP Moderate requirements. Other controls like account management, logging, and configuration settings are supportive but do not directly protect data at rest.

Answer

AC-2 Account Management

Answer

CM-6 Configuration Settings

Answer

AU-2 Event Logging

Question 14

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

Accepted Answer

Execute test traffic that attempts each authorized and unauthorized flow across the boundary and observe the device's mediation decisions.. Verification of information flow enforcement requires observing the mechanism in action. Crafted test traffic exercises both permitted and denied paths, exposing rule ordering errors, shadowed rules, and protocol-based bypasses that a documentation review would miss. This dynamic evidence directly ties observed mediation decisions to the approved policy, making it the most defensible proof of correct implementation.

Answer

Confirm that the device firmware is at the vendor-recommended baseline version and that administrative access uses multifactor authentication.

Answer

Collect and review the device's audit logs for the previous 90 days to identify any anomalous traffic patterns.

Answer

Review the device's rule set against the approved information flow policy and confirm that every rule maps to an authorized flow.

Question 15

An ISSEP is designing a secure architecture for a system that will use a cloud-based service. The system must comply with the NIST Risk Management Framework (RMF) and the organization's security policy. The ISSEP must ensure that the cloud provider's security controls are assessed and that the organization retains the ability to authorize the system. Which approach best meets these requirements?

Accepted Answer

Use the cloud provider's FedRAMP authorization package to inherit controls, and then assess and authorize the organization's system using the RMF process.. The organization should use the cloud provider's FedRAMP authorization to inherit controls, then assess the controls it implements and authorize its own system. This leverages existing assessments, avoids duplication, and ensures the organization retains authorization authority. Relying solely on FedRAMP, conducting a redundant assessment, or transferring all responsibilities are incorrect because they either miss organizational responsibilities or duplicate efforts.

Answer

Transfer all security responsibilities to the cloud provider and rely on their continuous monitoring.

Answer

Rely solely on the cloud provider's FedRAMP authorization and accept the system as is.

Answer

Conduct a separate assessment of the cloud provider's controls and issue a new authorization to operate (ATO) for the system.

Question 16

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

Accepted Answer

Security requirements identified early can be allocated to system components and traced through design, reducing costly rework later.. Systems security engineering is most effective when it begins with concept and requirements definition, because security requirements can then be derived, allocated, and traced through the lifecycle. This early allocation lets designers build controls into the architecture instead of retrofitting them, which reduces cost and schedule risk. The other statements either overstate what early involvement guarantees or misdescribe the purpose of early security work.

Answer

Starting early guarantees that the system will be certified and accredited without any residual risk.

Answer

Early involvement allows the ISSE to defer all security control selection until the operations and maintenance phase.

Answer

Early security engineering eliminates the need for security testing because threats are addressed during requirements analysis.

Question 17

During the security architecture review of a new identity management system, the ISSEP must choose an authentication protocol that supports native single sign-on across organizational boundaries and carries signed assertions about the user so relying parties can make authorization decisions without contacting the identity provider on every request. Which protocol best meets these requirements?

Accepted Answer

SAML 2.0. SAML 2.0 was built for federated identity: the identity provider issues signed assertions that a service provider validates and uses locally. That lets relying parties make authorization decisions from the assertion content without a live call to the identity provider, and it works across organizational boundaries. Kerberos, RADIUS, and LDAP solve different authentication or directory problems.

Answer

RADIUS with EAP-TLS

Answer

LDAPv3 with StartTLS

Answer

Kerberos 5 with cross-realm trusts

Question 18

An ISSEP is reviewing the supply chain risk for a system that will embed a commercial off-the-shelf cryptographic module. The program requires assurance that the module's cryptographic functions were independently tested against a published standard and that the module's security features are documented against a recognized protection profile. Which artifact should the ISSEP require from the vendor?

Accepted Answer

A Common Criteria certificate with a validated Protection Profile for the module. Common Criteria evaluation by an accredited laboratory against a validated Protection Profile provides the independent, standard-based assurance the program requires. The certificate confirms the module's security functions were tested and its features documented against recognized criteria. Vendor self-attestation, ISO/IEC 27001, and SOC 2 reports address the vendor or its management system, not the module's evaluated security functionality.

Answer

An ISO/IEC 27001 certificate covering the vendor's development facility

Answer

A vendor self-attestation letter confirming FIPS 140-3 compliance

Answer

A SOC 2 Type II report on the vendor's production environment

Question 19

A financial services firm runs a three-tier web application on-premises. The security team must apply an emergency patch to the TLS library on all web servers because of an actively exploited vulnerability. The change management policy requires an emergency change process, but the firm's regulator mandates that production changes be traceable and approved by someone other than the implementer. Which sequence best satisfies both the emergency response need and the regulatory requirement?

Accepted Answer

Convene the Emergency Change Advisory Board (ECAB), obtain approval from a designated approver who is not the implementer, apply the patch, and document the outcome.. An emergency change still requires independent approval to meet the regulator's separation-of-duties mandate. The ECAB provides a fast-track approval path, and having a different person authorize the patch preserves the control while enabling rapid response. Applying the patch first or combining roles would violate the regulatory requirement, and waiting for the regular CAB would leave the exploited vulnerability unmitigated. Documenting the outcome completes the traceability chain.

Answer

Apply the patch immediately to all servers, then document the change and obtain retroactive approval from the change manager within 24 hours.

Answer

Have the security team lead both approve and apply the patch to shorten the response time, then notify the change manager afterward.

Answer

Wait for the next scheduled Change Advisory Board meeting to obtain approval, then apply the patch during the standard maintenance window.

Question 20

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

Accepted Answer

Bell-LaPadula model. The requirement is a mandatory confidentiality flow control across sensitivity labels, which is the defining purpose of the Bell-LaPadula model. Its simple security property blocks reading above one's clearance, and its star property blocks writing below the object's classification. Together they ensure TOP SECRET data cannot reach UNCLASSIFIED subjects, satisfying the command-and-control system's multilevel security mandate.

Answer

Brewer-Nash (Chinese Wall) model

Answer

Clark-Wilson integrity model

Answer

Biba integrity model