ISC Practice Test 21 — 15 Questions

Question 1

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

Accepted Answer

The corresponding system component or design element. An SRTM maps requirements to design elements and test cases to ensure no security requirement is overlooked.

Answer

The vendor contact information

Answer

The employee performance review score

Answer

The marketing department's sales forecast

Question 2

An ISSE is drafting the security architecture description for a system that will undergo an assessment against the ISO/IEC 21827 (SSE-CMM) process areas. The assessor asks which work products demonstrate that the risk process area is being performed. Which TWO work products best provide that evidence? (Choose two.)

Accepted Answer

A risk management plan that defines the organization's risk tolerance, assessment methodology, and monitoring approach.. The risk process area is demonstrated by a governing risk management plan and the resulting risk assessment reports. Together they show that an organization defined how risk is handled and then actually analyzed threats, vulnerabilities, and impacts. The other artifacts belong to configuration management, security requirements, or training process areas and would be assessed under those headings.

Answer

A configuration management plan listing baselines and change control board procedures.

Answer

A training record showing that developers completed secure coding awareness courses.

Answer

A system security plan describing the operational environment and control implementation.

Question 3

An ISSE is reviewing a system architecture that uses a trusted path for security-critical operations. The developer proposes implementing the trusted path as a software-only mechanism within the general-purpose operating system. Which characteristic of a trusted path is most important for the ISSE to verify in this design?

Accepted Answer

The trusted path must be isolated from untrusted software so that it cannot be intercepted, modified, or spoofed.. A trusted path is trusted because untrusted software cannot intercept, modify, or spoof it. When the path is implemented in software within a general-purpose OS, the ISSE must verify that the path is isolated from untrusted processes, often through a secure attention sequence and TCB mediation. Authentication, encryption, and hardware implementation may support the path but do not by themselves establish the trust property.

Answer

The trusted path must encrypt all communications between the user and the system to protect against network eavesdropping.

Answer

The trusted path must be implemented in hardware to guarantee that it cannot be bypassed by any software.

Answer

The trusted path must be able to authenticate the user before any security-critical operation is allowed.

Question 4

Which THREE strategies are used to mitigate risk during a production software change?

Accepted Answer

Phased rollout (canary deployment). Phased rollouts, automated rollback, and canary testing are standard industry practices to limit the blast radius of a failed change.

Answer

Increasing the system clock speed

Answer

Sending a company-wide email notification

Question 5

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 6

An ISSEP is performing a system-level risk assessment for a new payroll system. The team decides to use a qualitative approach because quantitative data is scarce. Which of the following best describes a key limitation of qualitative risk assessment that the ISSEP should communicate to stakeholders?

Accepted Answer

It produces results that are subjective and difficult to express in monetary terms.. Qualitative risk assessment relies on expert judgment and descriptive scales, which introduces subjectivity and makes it difficult to express risk in monetary terms. Stakeholders often need financial figures to prioritize investments. While it can prioritize risks, the lack of quantitative precision is a key limitation that the ISSEP must communicate. The other options mischaracterize the method's applicability or requirements.

Answer

It cannot prioritize risks for remediation.

Answer

It requires specialized statistical expertise to perform.

Answer

It is only applicable to physical security risks, not cyber risks.

Question 7

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

Accepted Answer

Checking that the audit logging mechanism is active.. Database security verification includes reviewing access controls, encryption, and audit settings.

Answer

Disabling all backups to ensure the database remains small.

Answer

Ensuring the database is configured to accept all remote connections.

Question 8

An ISSEP is assessing a border control system that uses biometric facial recognition for traveler verification. The system's FAR is 0.001 and FRR is 0.05 at the current threshold. The mission owner wants to reduce the chance of a false match to near zero. Which action should the ISSEP recommend FIRST?

Accepted Answer

Increase the decision threshold to lower the False Acceptance Rate, accepting a higher False Rejection Rate as a trade-off.. The mission owner wants to minimize false matches, which corresponds to lowering the False Acceptance Rate. In biometric systems, FAR and FRR are inversely related through the decision threshold. Increasing the threshold makes matching stricter, reducing FAR at the cost of higher FRR. This is the most direct, lowest-cost first action because it uses the existing system and can be tuned operationally. More complex changes like multimodal fusion or system replacement should be considered only if threshold tuning cannot achieve the required risk reduction.

Answer

Deploy a second, independent biometric modality such as iris recognition and require both to match for verification.

Answer

Reduce the size of the enrolled biometric template database to lower the probability of a random false match.

Answer

Replace facial recognition with a knowledge-based challenge-response system to eliminate biometric error rates entirely.

Question 9

During a system migration, you need to ensure integrity of transferred data. What is the best cryptographic method?

Accepted Answer

Use HMAC for the data stream.. Using HMAC (Hash-based Message Authentication Code) with a shared key ensures both integrity and authenticity of the data stream.

Answer

Use TLS 1.0.

Answer

Use a simple CRC32 checksum.

Answer

Use base64 encoding.

Question 10

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

Accepted Answer

sha256sum. Hashing is the standard method for verifying that a file has not been altered.

Answer

cat <filename>

Answer

grep 'modified' <filename>

Answer

ls -l

Question 11

An ISSEP is reviewing the security architecture of a system that will be accredited under the DoD Information Assurance Certification and Accreditation Process successor, the RMF. The system owner proposes to accept a known configuration weakness because compensating controls reduce the exploit likelihood. Before endorsing the risk acceptance, which action must the ISSEP take to ensure the decision is defensible?

Accepted Answer

Document the weakness, the compensating controls, and the residual risk in the Plan of Action and Milestones and obtain Authorizing Official acceptance. A defensible risk acceptance requires documenting the weakness, the compensating controls, and the resulting residual risk, then obtaining formal acceptance from the Authorizing Official through the POA&M or equivalent risk acceptance record. This preserves accountability and an audit trail. Closing findings as false positives, undocumented waivers, or altering categorization do not satisfy that requirement.

Answer

Reclassify the weakness as a false positive in the vulnerability scanner and close the finding

Answer

Increase the system's FIPS 199 availability impact rating to offset the weakness

Answer

Waive the weakness without documentation because compensating controls are in place

Question 12

You are the security engineer for a federal agency that must follow NIST SP 800-53 configuration management controls. A system administrator submits an emergency change to modify a firewall rule to allow a new business partner's IP range. The change is implemented immediately and documented afterward. Which configuration management control requirement does this action violate?

Accepted Answer

CM-3 Configuration Change Control, which requires documented approval before implementation.. CM-3 requires that changes to systems be reviewed and approved before implementation, with emergency changes documented and approved within a defined period. Implementing the firewall rule first and documenting later bypasses the required authorization, undermining configuration change control and leaving the agency unable to demonstrate compliance to auditors.

Answer

CM-8 System Component Inventory, which requires an accurate inventory of system components.

Answer

CM-2 Baseline Configuration, which requires a documented baseline for the system.

Answer

CM-6 Configuration Settings, which requires security settings to be enforced automatically.

Question 13

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

Accepted Answer

Update the System Security Plan (SSP) to include the missing controls and implement the baseline via Infrastructure-as-Code (IaC) templates.. The RMF requires that security controls be implemented and documented. Identifying a missing baseline during the assessment phase necessitates updating the System Security Plan (SSP) and verifying the implementation of baseline controls before proceeding to the 'Authorize' step.

Answer

Modify the Security Assessment Plan (SAP) to exclude the container layer from the current assessment scope.

Answer

Proceed to authorization and defer the container baseline to the next Continuous Monitoring cycle.

Answer

Request a waiver from the Chief Information Security Officer (CISO) for container orchestration security.

Question 14

When conducting a security impact analysis for a system change in a Federal environment, what is the primary purpose of reviewing the FIPS 199 categorization?

Accepted Answer

To determine if the security controls need re-evaluation. FIPS 199 defines the impact level (Low, Moderate, High), which dictates the rigor of the change management testing requirements.

Answer

To calculate the budget

Answer

To verify physical location

Answer

To update the system inventory

Question 15

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

Accepted Answer

SOC 2 Type II or equivalent audit reports. Assessing a CSP involves reviewing their security certifications, physical controls, and logical security isolation capabilities.

Answer

Employee cafeteria menu

Answer

Office interior design plans