ISC Practice Test 22 — 15 Questions

Question 1

When architecting a system to meet ISO 27001 requirements for secure system engineering, which TWO of the following design principles should be prioritized for protecting sensitive data at rest?

Accepted Answer

Enforcing strict access control policies for data access.. Encryption and access control (least privilege) are fundamental controls required by ISO 27001 for data protection.

Answer

Hosting all data on a single centralized server to simplify management.

Answer

Using a single administrative account for all data operations.

Answer

Disabling all logging to reduce storage overhead.

Question 2

A healthcare provider is retiring an on-premises electronic health record (EHR) system that stored protected health information (PHI). The decommissioning plan includes data migration, media sanitization, and contract termination with the hardware maintenance vendor. The security engineer must ensure that residual PHI on the vendor's diagnostic laptops and spare parts inventory is addressed before the maintenance contract ends. Which action best closes this disposal gap?

Accepted Answer

Require the maintenance vendor to certify in writing that all diagnostic laptops and spare parts have been sanitized according to the organization's media disposal standard.. Third-party diagnostic equipment and spare parts can retain PHI from troubleshooting activities, so the decommissioning plan must extend sanitization requirements to vendor-controlled media. Requiring written certification against the organization's disposal standard provides assurance and audit evidence. Network scanning cannot prove data absence, and relying on generic contract clauses or future contract language leaves the current residual PHI unaddressed, which is a compliance risk under HIPAA.

Answer

Perform a network scan of the vendor's diagnostic laptops before contract termination to confirm that no PHI is present on their storage.

Answer

Terminate the maintenance contract immediately and rely on the vendor's standard end-of-contract clause to handle equipment disposition.

Answer

Include a clause in the new maintenance contract requiring future diagnostic devices to be sanitized, and let the current contract expire without further action.

Question 3

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 4

A security engineer is conducting verification and validation for a new Windows Server 2022 deployment on a classified network that must meet DISA STIG requirements. The engineer needs to verify that the audit policy is correctly implemented and that audit records are being generated for a specific security-relevant event. Which action provides the most direct evidence that the audit policy is functioning as intended?

Accepted Answer

Trigger the security-relevant event and confirm that a corresponding entry appears in the Security event log with the expected Event ID.. The most direct evidence that an audit policy is functioning is observing the audit record that results from the audited event. Triggering the event and confirming the expected Event ID in the Security log validates the entire auditing chain from policy application through record generation. Configuration reviews and policy displays confirm intent but cannot prove that audit records are actually produced.

Answer

Check that the Security event log file size is configured to at least 196 MB and that log retention is set to overwrite as needed.

Answer

Run auditpol /get /category:* to display the current audit policy settings and confirm the expected subcategories are enabled.

Answer

Review the Group Policy Object that configures Advanced Audit Policy Configuration to confirm the settings match the STIG requirement.

Question 5

You are validating the security implementation of a wireless network. Which THREE of the following are necessary to verify that WPA3 is properly configured?

Accepted Answer

Check that the network is configured to use AES-GCMP encryption.. WPA3 validation focuses on encryption, authentication method, and management frame protection.

Answer

Ensure that CCMP-128 is the only cipher suite enabled.

Answer

Enable support for WEP as a fallback for older devices.

Question 6

When validating a server's security implementation, which THREE of the following log files or directories should be reviewed to check for unauthorized activity?

Accepted Answer

/var/log/syslog. On Linux, the /var/log/ directory contains critical logs for security verification.

Answer

/tmp/

Answer

/home/

Question 7

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

Accepted Answer

Verify that Security Groups follow the principle of least privilege.. Option A is correct because Security Groups act as stateful virtual firewalls at the instance/ENI level, and verifying that their inbound and outbound rules grant only the minimum required ports, protocols, and source/destination CIDRs confirms least-privilege enforcement at the network boundary. Option B is correct because NACLs are stateless subnet-level filters with numbered allow/deny rules evaluated in order, so auditing their inbound and outbound rules ensures unauthorized traffic is explicitly blocked before reaching subnets. Option E is correct because VPC Flow Logs capture IP traffic metadata (accepted and rejected) for ENIs, subnets, or the VPC, and enabling and reviewing them provides the visibility needed to detect anomalous or unauthorized traffic patterns at the boundary. Option C is incorrect because allowing all inbound traffic from 0.0.0.0/0 removes boundary protection rather than verifying it. Option D is incorrect because disabling firewalls on EC2 instances weakens security and is not a valid verification task.

Answer

Configure the VPC to allow all inbound traffic from 0.0.0.0/0.

Answer

Disable the firewall on all EC2 instances to improve performance.

Question 8

An ISSEP is reviewing a system's risk register and notices that several entries list only the threat source and the affected asset, without any statement of the potential mission consequence. The system owner asks why consequence information is necessary when the threat and asset are already recorded. What is the most accurate justification for including consequence detail?

Accepted Answer

Consequence detail enables prioritization and supports the Authorizing Official in determining whether the residual risk is acceptable for the mission.. Risk combines likelihood with consequence, so a register that omits consequence cannot convey risk magnitude. Consequence detail allows findings to be ranked, remediation to be prioritized, and the Authorizing Official to judge whether residual risk is tolerable for the mission. It links technical findings to mission outcomes, which is precisely the information decision-makers need and the reason the register exists.

Answer

Consequence detail replaces the need to identify threat sources because the impact alone determines the appropriate control set.

Answer

Consequence detail is primarily used to calculate the Annualized Loss Expectancy for each risk entry in the register.

Answer

Consequence detail is required only for systems processing classified information, so it can be omitted for unclassified systems.

Question 9

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

Accepted Answer

SPF (Sender Policy Framework) record implementation.. SPF, DKIM, and DMARC are the three pillars of email sender verification.

Answer

Disabling TLS for incoming connections to save bandwidth.

Answer

Enabling the 'forward all traffic' rule.

Question 10

Which document outlines the specific security steps to be taken when a workstation reaches its end-of-life?

Accepted Answer

Data Sanitization Policy. The System Disposal Plan or Data Sanitization Policy outlines the specific requirements for decommissioning equipment to ensure no sensitive data remains.

Answer

Password Policy

Answer

Incident Response Plan

Answer

Acceptable Use Policy

Question 11

An ISSEP is designing a secure storage solution for a database. To ensure data integrity, which mechanism is most reliable?

Accepted Answer

Implement continuous file integrity monitoring (FIM) with cryptographic hashing.. Continuous file integrity monitoring (FIM) with cryptographic hashing is the most reliable mechanism for ensuring data integrity because it detects unauthorized changes to files by comparing current hash values against known good baselines. This provides ongoing verification that data has not been altered, whether maliciously or accidentally. FIM is specifically designed to alert on integrity violations.

Answer

Use RAID 10 for storage redundancy.

Answer

Require multi-factor authentication for database access.

Answer

Perform daily backups to an offsite location.

Question 12

Which command line utility is used on Linux to verify the integrity of binary files during a maintenance patch update?

Accepted Answer

sha256sum. sha256sum is the Linux utility that computes and verifies SHA-256 cryptographic hashes of files, making it the standard tool for verifying binary integrity after a patch download. By comparing the computed hash against the vendor-published hash, administrators confirm the file was not corrupted or tampered with during transfer.

Answer

chown

Answer

dd

Answer

chmod

Question 13

You are an ISSEP leading the security architecture review for a new command-and-control system. The system will process classified information and must support defense in depth. The program manager asks which two principles are most critical to apply when defining the security architecture to ensure resilience against advanced persistent threats. (Choose two.)

Accepted Answer

Separation of duties. Least privilege and separation of duties are fundamental security engineering principles that directly support defense in depth. Least privilege minimizes the access granted to users and processes, reducing the blast radius of a compromise. Separation of duties ensures that critical actions require multiple authorized individuals, preventing single-point failures and insider threats. Together they strengthen resilience against advanced persistent threats.

Answer

Single sign-on (SSO)

Answer

Open network trust

Answer

Security through obscurity

Question 14

What is the correct order of operations when handling a vulnerability in a production system according to the RMF?

Accepted Answer

Identify, Assess Risk, Remediate, Verify.. Identify (scan), analyze (risk), remediate, and verify (scan again).

Answer

Remediate, Identify, Assess Risk, Verify.

Answer

Identify, Remediate, Assess Risk, Authorize.

Answer

Authorize, Identify, Remediate, Verify.

Question 15

An ISSEP is reviewing a system's risk management plan. The plan states that risk will be assessed using a qualitative approach. Which of the following best describes a qualitative risk assessment?

Accepted Answer

It uses subjective ratings such as high, medium, and low to prioritize risks.. A qualitative risk assessment uses descriptive ratings such as high, medium, and low to characterize risk. This method is subjective but valuable for prioritizing risks when quantitative data is unavailable or not cost-effective to obtain. The other options describe quantitative techniques that involve monetary values or numerical simulations, which do not align with the stated qualitative approach.

Answer

It uses Monte Carlo simulations to model risk probabilities.

Answer

It calculates the Annualized Loss Expectancy (ALE) for each identified risk.

Answer

It assigns monetary values to assets and calculates expected annual loss.