ISC Practice Test 23 — 15 Questions

Question 1

A security engineer is developing a media disposal plan for a data center that is being decommissioned. The plan must address the secure disposal of various media types, including hard disk drives (HDDs), solid-state drives (SSDs), and magnetic tapes. Which two actions should be included in the plan to ensure compliance with NIST SP 800-88 Rev. 1? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

For magnetic tapes, degauss the tapes to render data unrecoverable.. For SSDs, ATA Secure Erase or cryptographic erase is the recommended Purge method, and for magnetic tapes, degaussing is effective. These actions align with NIST SP 800-88 Rev. 1 for secure disposal. Single-pass overwrite on HDDs is only Clear, file deletion is insufficient, and degaussing SSDs is ineffective.

Answer

For all media types, use a software-based file deletion utility to remove files.

Answer

For HDDs, perform a single-pass overwrite with a fixed pattern to achieve Purge.

Answer

For SSDs, degauss the drives to purge data.

Question 2

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

Accepted Answer

Assigning security requirements to developers. An SDL integrates security into every phase of development: planning, design, implementation, testing, and release.

Answer

Physical security of the office parking lot

Answer

Hiring external marketing staff

Question 3

During a security verification review, an engineer is examining how a web application handles user-supplied input that is used to build a database query. The application uses parameterized statements for most queries, but one legacy module concatenates input directly into a query string. The engineer wants to confirm whether the legacy module is exploitable before recommending remediation. Which verification technique is most appropriate to demonstrate the vulnerability?

Accepted Answer

Run a dynamic application security test that submits crafted input to the legacy module and observes the database response.. Demonstrating that the legacy module is actually exploitable requires exercising the deployed code with crafted input and observing the outcome. Dynamic application security testing submits payloads through the real request path and reveals whether concatenation leads to unintended query execution. Static review, log inspection, and firewall rule checks provide context or compensating controls but cannot confirm runtime exploitability, which is the specific verification objective.

Answer

Review the database server's audit logs for previously executed queries containing unusual syntax.

Answer

Perform a source code review of the legacy module to trace how the input reaches the query construction.

Answer

Inspect the web application firewall rules to confirm they block common injection patterns.

Question 4

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

Accepted Answer

Run 'kube-bench --targets etcd' to perform the automated audit.. kube-bench is the CIS-certified tool that automates Kubernetes CIS Benchmark checks, and its --targets etcd flag runs only the etcd-specific controls (e.g., ensuring etcd data dir permissions, peer/client cert authentication, and encryption at rest). It reads the etcd manifest and configuration files directly on the control plane node to produce pass/fail results mapped to CIS control IDs. This is the standard automated audit method for etcd hardening.

Answer

Use 'kubectl get pods' to check the etcd pod configuration.

Answer

Perform a manual audit using 'etcdctl get --prefix /'.

Answer

Use the 'kubectl describe nodes' command to check for node hardening.

Question 5

An ISSE is helping a program office plan a certification and accreditation effort for a system that will process controlled unclassified information. The program director wants to know how an assurance case differs from a traditional security test report. Which description best characterizes the purpose of an assurance case in this context?

Accepted Answer

It presents a structured argument, supported by evidence, that the system satisfies its security requirements in its intended environment.. An assurance case is a reasoned argument that ties security claims to evidence within stated assumptions and scope. It differs from a test report because it explains why the evidence is sufficient for the claims, rather than merely presenting results. That structure gives the authorizing official a defensible basis for accepting residual risk in the intended operating environment.

Answer

It is a formal proof that the system contains no exploitable vulnerabilities under any conditions.

Answer

It is the authorization decision memo signed by the designated approving authority after reviewing the security assessment.

Answer

It is a comprehensive record of every test case executed, including raw outputs and tool logs.

Question 6

You are utilizing Terraform to manage infrastructure as code. To ensure security-critical changes are not committed to production without authorization, which feature should you implement?

Accepted Answer

Sentinel Policy-as-Code. Sentinel policies in Terraform Enterprise allow for Policy-as-Code, enabling automated enforcement of security rules before infrastructure is provisioned.

Answer

Terraform Refresh

Answer

Provider Aliases

Answer

State Locking

Question 7

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

Accepted Answer

Implementing a Software Bill of Materials (SBOM). Software Bill of Materials (SBOM) allows organizations to track and manage the components in their software, facilitating the identification of vulnerable third-party dependencies.

Answer

Limiting the number of developers

Answer

Enforcing password complexity

Answer

Using only open-source software

Question 8

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Accepted Answer

manage-bde -status C:. manage-bde is the CLI tool for BitLocker administration.

Answer

cipher /e

Answer

bitlocker-check

Answer

diskpart /info

Question 9

Which TWO of the following are essential components of a robust threat modeling process for an engineered system?

Accepted Answer

Creation of data flow diagrams (DFDs).. Option B is correct because data flow diagrams (DFDs) are a foundational artifact in threat modeling: they map how data moves between external entities, processes, data stores, and trust boundaries, which is exactly what you need to systematically identify where threats can be introduced or where controls are missing. Option E is correct because established frameworks such as STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) and PASTA (Process for Attack Simulation and Threat Analysis) provide a repeatable, structured methodology for enumerating threats and prioritizing them, which is essential for a robust and consistent process. Option A is not essential to threat modeling because contract and legal review is a governance/compliance activity, not a technique for identifying threats against an engineered system. Option C is not essential because a full personnel inventory does not describe system architecture, data flows, or attack surface, and threat modeling focuses on the system rather than a complete HR roster. Option D is not essential because a vendor list alone does not reveal how components interact or where trust boundaries lie, so it cannot substitute for architectural modeling and a threat enumeration framework.

Answer

A detailed legal review of all contracts.

Answer

A complete inventory of all organizational personnel.

Answer

A list of all software vendors used by the organization.

Question 10

An ISSE is reviewing a proposed architecture for a cross-domain transfer system. The design uses a reference monitor concept to mediate all access between security domains. During review, the ISSE must confirm the design satisfies the properties required of a reference monitor implementation. Which set of properties should the ISSE verify?

Accepted Answer

Complete mediation, tamper resistance, and small enough to be analyzed and verified.. A reference monitor must mediate every access, resist tampering, and be small enough to analyze and verify. Those properties are what allow an evaluator to trust that no information flow bypasses the enforcement mechanism. Objectives like confidentiality or authentication describe what the system should achieve, not the structural guarantees the reference monitor must provide.

Answer

Confidentiality, integrity, and availability of all data crossing the boundary.

Answer

Identification, authentication, and authorization of every user on the system.

Answer

Non-repudiation, auditability, and least common mechanism across all domains.

Question 11

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

Accepted Answer

POA&M (Plan of Action and Milestones).. The POA&M (Plan of Action and Milestones) is the document used to track security weaknesses and the progress of remediation efforts.

Answer

Risk Management Framework (RMF) Guide.

Answer

System Security Plan (SSP).

Answer

Security Assessment Report (SAR).

Question 12

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Accepted Answer

Its role in processing sensitive information. Security-critical components are those that enforce policy, handle sensitive data, or provide security functions.

Answer

Its location in the physical facility

Answer

Its cost of procurement

Question 13

An ISSEP is developing the security architecture for a new system that will be deployed in a cloud environment. The system must comply with the NIST RMF and leverage cloud-specific security features. Which TWO considerations should the ISSEP address when defining the security architecture? (Choose two.)

Accepted Answer

Define the shared responsibility model between the cloud service provider and the organization. When architecting a cloud-based system under the NIST RMF, the ISSEP must clearly define the shared responsibility model to understand which controls are the organization's responsibility and which are the provider's. Additionally, identifying and documenting inherited controls from the provider's FedRAMP authorization is essential to avoid duplicating assessments and to ensure the authorization package is complete. These two considerations are foundational for a compliant and efficient security architecture.

Answer

Require the cloud service provider to allow direct access to its hypervisor for security testing

Answer

Implement a bring-your-own-encryption-key (BYOK) solution to maintain control over data at rest

Answer

Ensure that the cloud service provider's infrastructure is within the authorization boundary

Question 14

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 15

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.