ISC Practice Test 24 — 15 Questions

Question 1

An ISSE supports a continuous integration pipeline where developers commit infrastructure-as-code that provisions security groups and logging agents. A recent audit found that a developer merged a change disabling flow logs in production without any independent review. Which control directly addresses this gap while preserving the pipeline's automated deployment model?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Require a second authorized reviewer to approve the merge request before the pipeline can deploy to production.. The audit finding is a separation-of-duties failure: one person changed a production security control without independent review. Requiring a second authorized approver on the merge request places a human control gate ahead of automated deployment, preserving pipeline speed while ensuring no individual can unilaterally weaken production security configuration.

Answer

Enable branch protection that prevents force pushes and requires signed commits from all contributors.

Answer

Grant developers read-only access to production and require operations staff to apply all infrastructure changes manually.

Answer

Configure the pipeline to run a static analysis scan on every commit and block deployment on high-severity findings.

Question 2

A systems security engineer is selecting controls for a new federal information system and must ensure the design meets the minimum security requirements defined in NIST SP 800-53. Which concept describes the set of controls determined to be necessary to protect the system based on its security categorization?

Accepted Answer

Security control baseline. The security control baseline is derived from NIST SP 800-53 based on the system's FIPS 199 categorization and represents the minimum controls necessary for protection. Engineers then tailor this baseline to the specific system, documenting implementation in the system security plan and managing gaps through a plan of action and milestones.

Answer

Plan of action and milestones

Answer

System security plan

Answer

Authority to operate

Question 3

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

Accepted Answer

Send a flood of requests exceeding the defined rate limit and verify that the API returns a 429 Too Many Requests status code.. The only way to verify that rate limiting actually prevents a DoS-style flood is to test it behaviorally: send requests exceeding the configured limit and confirm the gateway rejects excess traffic with HTTP 429 Too Many Requests. This validates the enforcement path end-to-end, including throttling thresholds, burst limits, and error responses. Configuration review alone cannot prove runtime behavior.

Answer

Use a vulnerability scanner to check for OWASP API vulnerabilities.

Answer

Review the API Gateway configuration files for the 'rate_limit' keyword.

Answer

Monitor the CPU usage of the backend server.

Question 4

A defense contractor is preparing to decommission a classified file server that used self-encrypting drives (SEDs). The drives must be reused in a lower-classification environment. Which action satisfies the media sanitization requirements while preserving the drives' usability?

Accepted Answer

Perform a cryptographic erase by regenerating the internal media encryption key.. Cryptographic erase is the correct sanitization method for self-encrypting drives because it invalidates the encryption key, making the data instantly unrecoverable while keeping the drive functional. Overwriting, degaussing, and physical destruction either fail to sanitize properly, render the drive unusable, or exceed the necessary assurance level for reuse.

Answer

Degauss the drive using a NSA-listed Type II degausser.

Answer

Overwrite the entire drive three times using a software-based pattern-write utility.

Answer

Remove the drive platters and physically shred them into particles smaller than 2 mm.

Question 5

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 6

An ISSE is reviewing the security architecture of a system that uses a layered defense strategy. The system includes firewalls, intrusion detection systems, and host-based antivirus. The ISSE wants to ensure that the compromise of a single component does not lead to a total system breach. Which principle is the ISSE applying?

Accepted Answer

Defense in depth. Defense in depth is the practice of using multiple, overlapping security controls so that the failure of one control does not compromise the entire system. The scenario's combination of firewalls, IDS, and antivirus represents independent layers that collectively reduce risk and provide redundancy against attacks.

Answer

Fail-safe defaults

Answer

Least privilege

Answer

Separation of duties

Question 7

An ISSEP is working on a system that must comply with the NIST Risk Management Framework (RMF). The system owner asks the ISSEP to explain the purpose of the 'Prepare' step in the RMF. Which statement best describes the goal of the Prepare step?

Accepted Answer

To achieve a state of readiness for managing security and privacy risks before executing the RMF process. The Prepare step in the NIST RMF is designed to help organizations achieve a state of readiness for managing security and privacy risks. It involves establishing a risk management strategy, identifying roles and responsibilities, and conducting organization-level risk assessments. This step ensures that the organization is prepared to execute the subsequent steps of the RMF. It does not involve assessing controls, authorizing systems, or selecting controls.

Answer

To authorize the system for operation based on the assessment results

Answer

To conduct a security assessment of the implemented controls

Answer

To select and tailor the security controls for the system

Question 8

A security engineer is validating the implementation of a public key infrastructure (PKI) that issues certificates to internal servers. The validation must confirm that certificate revocation is enforced correctly by relying parties. Which TWO verification activities provide direct evidence that revocation checking is functioning as intended? (Choose two.)

Accepted Answer

Revoke a test certificate and confirm that a relying party rejects a TLS connection presenting that certificate.. Direct evidence of revocation enforcement comes from observing relying-party behavior under adverse conditions. Revoking a live certificate and confirming connection rejection exercises the full path from CA publication through relying-party validation. Testing rejection of an OCSP response signed by an unauthorized responder proves the relying party validates responder authorization, closing a spoofing gap that would otherwise let revoked certificates appear valid.

Answer

Verify that the OCSP responder returns a 'good' status for a currently valid, unrevoked certificate.

Answer

Confirm that the certificate authority's CRL distribution point URLs are reachable from the relying party's network segment.

Answer

Inspect the relying party's configuration to confirm that revocation checking is enabled and set to hard-fail.

Question 9

During a risk assessment of a distributed system, the ISSEP identifies that a critical cryptographic module is nearing its end of support and the vendor will stop issuing firmware patches. The module cannot be replaced before the next authorization cycle, but the system must continue operating. Which risk response best fits the ISSEP's role at this stage?

Accepted Answer

Document the residual risk, propose compensating controls such as network isolation and enhanced monitoring, and present the options to the Authorizing Official for a risk decision.. The ISSEP supports risk-informed decisions rather than making them. With the module unable to be replaced before the next cycle, the appropriate action is to document the residual risk, propose compensating controls that constrain exposure, and present the trade-offs to the Authorizing Official. This keeps the system operating as required while ensuring the acceptance decision is made by the accountable authority with full awareness.

Answer

Immediately remove the module from the authorization boundary and accept the resulting loss of functionality as a necessary security trade-off.

Answer

Delay the risk assessment until the next authorization cycle so the module's replacement can be evaluated together with other system changes.

Answer

Accept the risk on behalf of the system owner because the module still meets its original certification and no exploit is currently known.

Question 10

A defense contractor maintains classified systems in a facility accredited under the NISP. A storage area network (SAN) array will be repurposed from a collateral Secret enclave to an unclassified R&D network. The ISSE must select the sanitization action that renders the array's magnetic disk media free of any residual data that could be recovered using laboratory techniques. Which action satisfies this requirement?

Accepted Answer

Disassemble the drives and physically shred the platters to particles no larger than the specified reduction size.. Repurposing media from a Secret enclave to an unclassified network requires assurance that no recoverable data remains. Physical destruction of the magnetic platters is the only method that eliminates remapped sectors, spare regions, and servo data without depending on drive firmware, encryption coverage, or degausser field adequacy. The other methods can leave remnants that laboratory techniques may recover.

Answer

Execute the array's built-in cryptographic erase and destroy all key material.

Answer

Perform a single-pass overwrite of every logical block address exposed by the SAN controllers.

Answer

Degauss each drive with a field strength rated for the media's coercivity.

Question 11

A defense contractor is decommissioning a system that processed classified information. The media sanitization records must demonstrate compliance with the Committee on National Security Systems policy for clearing, purging, and destroying media. Which action best satisfies the sanitization requirement for magnetic hard drives that will leave the controlled area?

Accepted Answer

Degauss the drives and document the model, serial number, and degausser field strength used.. For classified magnetic media leaving a controlled area, CNSS Policy No. 26 requires an approved purge method. Degaussing is an approved purge technique for magnetic media, and documenting the drive identifiers and degausser field strength provides the audit evidence needed to demonstrate compliance.

Answer

Overwrite each drive with a single pass of zeros using approved software and retain the software log.

Answer

Delete the partition table and format the drives, then store them in a locked cabinet until reuse.

Answer

Encrypt the drives with full-disk encryption and discard the keys before transferring the drives.

Question 12

You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?

Accepted Answer

Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.. When a proprietary protocol defeats DPI and signature-based monitoring, the most reliable risk reduction is to remove the attack path entirely via physical/network isolation using unidirectional gateways (data diodes). This enforces a hardware-level guarantee that data can only flow out of the control network, preventing inbound attacks, lateral movement, and remote exploitation regardless of protocol obscurity. It is the strongest control available when you cannot inspect the traffic.

Answer

Replace the proprietary protocol with OPC-UA to enable standard security monitoring.

Answer

Implement a host-based firewall on the SCADA master station.

Answer

Deploy an intrusion detection system (IDS) that uses behavioral pattern matching.

Question 13

An ISSEP is developing the security architecture for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to reuse an existing authorization package from a similar system to reduce costs. The ISSEP must ensure the reuse is valid under the NIST Risk Management Framework (RMF) and NIST SP 800-37 Rev. 2. Which action best supports this goal?

Accepted Answer

Conduct a gap analysis between the security controls of the existing system and the requirements for the new system, and update the security plan accordingly.. Reusing an authorization package under the NIST RMF requires a gap analysis to ensure the existing controls meet the new system's requirements. NIST SP 800-37 Rev. 2 emphasizes that the ISSEP must evaluate differences in environment, data sensitivity, and risk. Updating the security plan based on this analysis ensures that the authorization decision is based on accurate, system-specific information, maintaining compliance and security effectiveness.

Answer

Implement all security controls from the existing system verbatim in the new system and document them in the security plan.

Answer

Obtain a new authorization to operate (ATO) from the authorizing official without additional assessment, citing the existing ATO.

Answer

Perform a security control assessment of the existing system and document any differences in the security plan.

Question 14

What is the primary function of a Change Advisory Board (CAB) in an ITIL-based environment?

Accepted Answer

To authorize and prioritize changes. The CAB is responsible for assessing, prioritizing, and authorizing changes to prevent unauthorized or risky changes from impacting the environment.

Answer

To perform technical code reviews

Answer

To manage hardware procurement

Answer

To conduct system testing

Question 15

An ISSEP is performing a risk assessment for a new system that will process Controlled Unclassified Information (CUI). The system owner wants to use a cloud service provider (CSP) that stores data in multiple countries. The ISSEP must ensure compliance with applicable federal requirements. Which action should the ISSEP take FIRST?

Accepted Answer

Verify that the CSP has a FedRAMP authorization at the appropriate impact level and that the data residency aligns with federal requirements.. When selecting a CSP for federal CUI, the ISSEP must first confirm that the CSP holds a FedRAMP authorization at the correct impact level and that data residency complies with federal mandates. These are non-negotiable prerequisites. Only after these are verified should the ISSEP address contractual or technical controls like SLAs and encryption.

Answer

Require the CSP to encrypt all data at rest and in transit, then proceed with the selection.

Answer

Conduct a penetration test of the CSP's infrastructure to independently validate its security posture.

Answer

Negotiate a custom service-level agreement (SLA) with the CSP that includes penalties for data breaches.