ISC Practice Test 25 — 15 Questions

Question 1

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

Accepted Answer

Verifiability of security functions. The TCB is the set of all hardware, software, and firmware components that are critical to the security of the system; it must be verifiable and correct.

Answer

System performance metrics

Answer

User-friendliness of the interface

Answer

The versioning history of the software

Question 2

An ISSEP is conducting a risk assessment for a system that processes classified information. The system owner proposes using a single risk assessment for both the system and its hosting facility. Which of the following is the most significant risk of this approach?

Accepted Answer

It may overlook facility-specific threats such as physical intrusion or power failures.. Combining system and facility risk assessments can lead to inadequate coverage of physical and environmental threats that are unique to the facility. A system-level assessment typically focuses on logical and technical risks, while a facility assessment addresses physical security, utilities, and environmental controls. Merging them risks missing critical facility-specific vulnerabilities, which is the most significant concern for classified information processing.

Answer

It will eliminate the need for a business impact analysis (BIA).

Answer

It will violate the principle of least privilege.

Answer

It will require more resources than separate assessments.

Question 3

An ISSEP is reviewing the risk management strategy for an organization deploying a new cloud-based email service. The organization wants to transfer as much risk as possible to the cloud provider. Which action should the ISSEP recommend to clarify what risk can actually be transferred?

Accepted Answer

Review the cloud service provider's shared responsibility matrix and service level agreements to determine which controls the provider owns.. Risk transfer in cloud services depends on the shared responsibility model. The provider owns security of the cloud, while the customer owns security in the cloud. Reviewing the responsibility matrix and SLAs reveals which controls and risks the provider assumes and which remain with the organization. Only after that mapping can the ISSEP advise on insurance, contractual terms, or additional controls.

Answer

Require the cloud provider to accept unlimited liability for any breach involving the organization's data.

Answer

Assume that signing a cloud contract transfers all security risk to the provider because the provider operates the infrastructure.

Answer

Purchase cyber insurance to transfer all remaining risk after the cloud migration is complete.

Question 4

An ISSEP is leading the security engineering effort for a new Department of Defense information system that will process classified data at the Secret level. The system will be deployed on a shared enclave. The program manager asks which NIST publication should be used as the primary source for selecting and specifying security controls for this system.

Accepted Answer

NIST SP 800-53. The primary source for selecting and specifying security controls for a federal information system, including DoD systems processing classified data, is NIST SP 800-53. It provides the control catalog that supports the RMF Select step. SP 800-37 defines the process, SP 800-171 targets nonfederal CUI, and SP 800-160 offers systems security engineering guidance—none of which replace the control catalog.

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Answer

NIST SP 800-160

Question 5

A system is being disposed of, and the disposal plan includes sanitizing solid-state drives that contain sensitive but unclassified data. The drives will be reused within the same organization but in a different security domain with a lower sensitivity level. Which sanitization method is most appropriate?

Accepted Answer

Purge the drives using the manufacturer's approved sanitization command and verify the result before reuse.. Solid-state drives moving to a lower sensitivity domain require a purge because clearing is not sufficient for a domain change. Manufacturer-approved sanitization commands can purge the media, and verification confirms effectiveness before the drives are reused.

Answer

Physically destroy the drives and purchase new ones for the lower domain, documenting the destruction.

Answer

Clear the drives by overwriting all addressable locations with a single pass of random data.

Answer

Degauss the drives to remove all residual data before transferring them to the lower domain.

Question 6

An ISSEP supports a defense program using the Risk Management Framework (RMF). The system has an approved Authorization to Operate (ATO). During continuous monitoring, a new Common Vulnerabilities and Exposures (CVE) is published that affects a component in the production environment. The vulnerability has a CVSS base score of 8.1, but the component is not exposed to any untrusted network and no known exploit exists. The program manager asks the ISSEP to determine the immediate next step. Which action is MOST appropriate?

Accepted Answer

Evaluate the vulnerability against the system's security controls and assess the potential impact to the authorization, then document the results in the continuous monitoring record.. The RMF continuous monitoring step requires the ISSEP to assess new vulnerabilities in the context of the system's authorization boundary, existing controls, and mission impact. Because the affected component is not exposed and no exploit exists, the appropriate action is to evaluate and document the risk rather than take disruptive action or ignore it. This maintains the ATO while keeping risk management current.

Answer

Immediately revoke the ATO and require the system to undergo a full reauthorization by the Authorizing Official.

Answer

Immediately remove the component from the production environment and replace it with a different vendor's product.

Answer

Ignore the vulnerability because the CVSS score does not matter when the component is not network-exposed.

Question 7

An ISSE is reviewing a design that layers network segmentation, host-based firewalls, application input validation, and database encryption. A reviewer argues this duplication is wasteful and proposes collapsing to a single strong control. How should the ISSE justify the layered approach using established security engineering principles?

Accepted Answer

Layering increases the effort an adversary must expend and ensures no single control failure compromises the system. Defense in depth places multiple, ideally independent controls across the architecture so that no single failure or bypass results in compromise. Network segmentation, host firewalls, input validation, and encryption each address different attack surfaces, forcing an adversary to defeat several mechanisms. The principle reduces the probability and impact of compromise; it does not replace risk assessment, testing, authorization, or ongoing vulnerability management.

Answer

Layering guarantees the system will pass certification and accreditation without further testing

Answer

Layering allows the organization to skip patching lower layers because upper layers will compensate

Answer

Layering eliminates the need for a risk assessment because all plausible threats are already covered

Question 8

An ISSE is evaluating a proposed change to an accredited system that will introduce a new external interface. The change is classified as significant. According to the Risk Management Framework (RMF) process, which activity must the ISSE perform before the change can be approved?

Accepted Answer

Conduct a security impact analysis to determine the effect on the system's security posture.. A significant change under RMF triggers a security impact analysis to evaluate how the modification affects the system's risk posture. This analysis examines the new interface's threats, vulnerabilities, and potential control impacts. Only after this assessment can the authorizing official decide whether to approve the change, require additional controls, or initiate reauthorization. Simply updating documentation or assuming the old baseline suffices would not meet RMF requirements.

Answer

Immediately reauthorize the system with the existing security control baseline.

Answer

Update the system security plan without performing any additional assessment.

Answer

Remove the system from the authorization boundary until the change is complete.

Question 9

Which THREE items are required to verify the integrity of a downloaded software package?

Accepted Answer

The cryptographically signed hash (e.g., .asc or .sig file).. Option A is correct because the cryptographically signed hash (.asc or .sig file) contains the digital signature over the package's hash, which is the artifact you verify to confirm the download was not altered. Option C is correct because the software binary file is the actual downloaded package whose integrity is being checked; you compute its hash and compare it against the signed hash. Option D is correct because the author's public key is needed to verify the signature on the hash file, proving the hash genuinely came from the trusted author and was not forged. Option B is not required because the source repository URL only indicates where code originated and does not itself provide any cryptographic proof of integrity. Option E is not required because a developer's password is a secret credential for authentication, not a verification artifact, and integrity checking relies on public-key cryptography rather than shared secrets.

Answer

The original source code repository URL.

Answer

The developer's password.

Question 10

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

Accepted Answer

Implement constant-time cryptographic algorithms to eliminate timing signatures.. Side-channel attacks on HSMs exploit observable physical characteristics such as timing variations, power consumption, or electromagnetic emanations that correlate with secret key operations. Constant-time cryptographic algorithms execute in a fixed number of cycles regardless of input values, eliminating the timing signature that attackers use to infer key bits. This directly addresses the root cause of the timing side-channel rather than merely restricting access or increasing key size.

Answer

Implement a dual-factor authentication requirement for HSM access.

Answer

Increase the length of the RSA keys.

Answer

Use a larger number of HSMs in a cluster.

Question 11

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where information must be shared with partner nations. The system uses a cross-domain solution (CDS) to transfer data between security domains. Which TWO of the following are the most critical risk factors to evaluate regarding the CDS? (Choose two.)

Accepted Answer

The CDS's ability to enforce data flow policies based on content and context.. The most critical risk factors for a CDS are its ability to enforce data flow policies and its resistance to bypass or covert channel attacks. These directly affect whether data is transferred only as authorized and whether the CDS can be subverted. Other factors like cost, size, or user load are secondary and do not directly compromise the security of cross-domain information sharing.

Answer

The number of users who will access the CDS simultaneously.

Answer

The physical size and weight of the CDS hardware.

Answer

The cost of the CDS compared to other security controls.

Question 12

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

Accepted Answer

Enforcing short-lived, dynamically generated credentials.. Secrets management relies on strong access control, secure delivery, and the ability to rotate credentials to limit the window of opportunity for attackers.

Answer

Using a single, static password for all administrative access.

Answer

Hardcoding the master recovery key in the application source code.

Question 13

An ISSEP is evaluating a new Engineered System that will be deployed across three geographically separated sites. The program manager wants to reuse a risk assessment performed two years ago for a similar system at a single site to save schedule time. Which factor most directly determines whether the earlier assessment can be reused?

Accepted Answer

Whether the new system's architecture, operating environment, and threat landscape are sufficiently similar to those covered by the earlier assessment.. Prior risk assessments are reusable only to the extent that the system, its environment, and the threat landscape remain comparable. Expanding from one site to three changes connectivity, physical exposure, and potentially the threat profile, so the ISSEP must validate scope and assumptions before relying on earlier findings.

Answer

Whether the new program has budget available to commission a fresh assessment from an independent third party.

Answer

Whether the earlier assessment was signed by the same Authorizing Official who will accredit the new system.

Answer

Whether the earlier assessment used the same risk scoring scale, such as a five-by-five likelihood and impact matrix.

Question 14

An ISSE is evaluating a proposed architecture that uses a trusted computing base (TCB) to enforce security policy. The developer argues that because the TCB is small, it does not need to be evaluated against any protection profile. How should the ISSE respond?

Accepted Answer

Disagree, because the TCB must be evaluated against a protection profile to provide assurance that it meets its security requirements.. A TCB, regardless of size, must be evaluated against a protection profile or security target to provide assurance that it correctly enforces the security policy. Small size aids verification but does not replace the need for independent evaluation. Hardware implementation and classification level are not prerequisites for evaluation.

Answer

Agree, because a small TCB is inherently secure and does not require formal evaluation.

Answer

Disagree, because the TCB must always be implemented in hardware to be trusted.

Answer

Agree, because evaluation is only required for systems that process classified information.

Question 15

A security engineer is performing verification of a newly deployed intrusion prevention system (IPS) inline on the network perimeter. The goal is to confirm that the IPS is actively blocking malicious traffic rather than only alerting. Which action provides the most direct verification of blocking capability?

Accepted Answer

Send a controlled test exploit through the IPS toward a target host and confirm the traffic is dropped and the session fails.. Confirming prevention requires observing the device stop malicious traffic in the live path. Sending a controlled exploit and verifying it is dropped while the target remains unaffected tests signature matching and the blocking action together. Alerts, signature currency, and topology documentation each cover only part of the picture and cannot prove that attacks are actually prevented.

Answer

Review the IPS event dashboard to confirm that signature alerts are being generated for known attack patterns.

Answer

Confirm that the IPS is deployed inline rather than in tap or span mode by reviewing the network diagram.

Answer

Verify that the IPS signature database is current and that automatic updates are enabled.