ISC Practice Test 2 — 25 Questions

Question 1

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 2

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

Accepted Answer

Run an authenticated configuration scan against the live system and manually inspect the resulting service, audit, and file permission settings.. Verification and validation require objective evidence that controls are implemented as specified. Inspecting the live system through an authenticated configuration scan, supplemented by manual review of the output, directly measures the service state, audit configuration, and file permissions. Documentation, interviews, and image hashes reflect intent or artifact integrity rather than the actual operational configuration, so they cannot confirm the baseline is met on the running server.

Answer

Compare the server's build image hash against the hash recorded in the configuration management database.

Answer

Interview the system administrator who built the server and obtain a signed attestation of compliance.

Answer

Review the signed configuration management plan and the change advisory board approval records.

Question 3

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Accepted Answer

Graceful degradation. Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.

Answer

Maximal feature set

Answer

Hardware redundancy only

Answer

Complete system lockdown upon error

Question 4

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

Accepted Answer

Destroy the HSM root CA private keys using the HSM's secure zeroization function and record the destruction in the decommissioning log.. Proper disposal of a legacy identity system requires destroying the root CA private keys to prevent forgery while preserving public certificates and revocation information so existing credentials remain verifiable. Retaining private keys or leaving the directory database intact creates unnecessary risk and violates data lifecycle requirements. The two required actions balance security with the operational need for trust continuity during the transition period.

Answer

Migrate the directory user attributes to the new identity system and then leave the legacy database intact for historical reference.

Answer

Archive the root CA private keys in an offline vault so they can be used to re-sign certificates if validation issues arise later.

Answer

Delete the directory database by dropping all tables and removing the database files from the storage array without further sanitization.

Question 5

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption

Question 6

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Accepted Answer

To prevent data recovery after asset disposal. Sanitization is the process of removing data from storage media such that the data cannot be reconstructed by any forensic means.

Answer

To format the disk for reuse

Answer

To clean the hardware of dust

Answer

To update the operating system

Question 7

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is designed for confidentiality in multi-level security systems. Its no-write-down rule, known as the *-property, ensures that subjects at higher sensitivity levels cannot write to objects at lower sensitivity levels. This directly satisfies the scenario's requirement to prevent a Top Secret subject from writing to a Secret object. The other models address integrity or generic access control, not MLS confidentiality.

Answer

Clark-Wilson model

Answer

Graham-Denning model

Answer

Biba integrity model

Question 8

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Accepted Answer

The NIPS interface pair is configured in inline mode with fail-open or fail-closed settings and the policy action is set to block.. The primary reason an inline NIPS alerts but does not block is that the policy is set to alert-only or the interface is not truly inline. Verifying the interface pair mode and the policy action ensures the system is configured to enforce. Other items such as signature updates, SIEM alerts, and management VLANs affect detection or management, not the blocking capability.

Answer

The NIPS management interface is on a separate VLAN.

Answer

The NIPS signature database is updated to the latest version.

Answer

The NIPS is configured to send alerts to the SIEM.

Question 9

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

Accepted Answer

That no traffic is allowed unless explicitly permitted.. The implicit deny rule is the final catch-all rule that drops all traffic not explicitly allowed.

Answer

That the firewall is blocking all outgoing traffic.

Answer

That the firewall can handle high traffic volumes.

Answer

That the firewall is correctly logging denied packets.

Question 10

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

Accepted Answer

Adjust the baseline controls to address the specific system environment and mission.. Tailoring involves selecting, adapting, and supplementing controls to fit the specific mission and environment, rather than applying a blanket baseline.

Answer

Select all controls from the highest security baseline.

Answer

Exclude all controls that are difficult to implement.

Answer

Only apply controls that are mandated by law.

Question 11

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

Accepted Answer

Move to WORM media. WORM (Write Once Read Many) media ensures data cannot be altered or deleted for a defined retention period, satisfying both the 7-year retrievability requirement and the security need for tamper-evident, immutable storage. This is the standard approach for regulatory retention of decommissioned data because it prevents modification or premature deletion. It is the most secure option among those listed.

Answer

Copy to an unencrypted thumb drive

Answer

Delete the database server

Answer

Store on a public cloud share

Question 12

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

Accepted Answer

Protected Branches with Merge Request approvals. Protected Branches in GitLab restrict who can push and merge to a branch like master/main, and when combined with Merge Request approvals, they enforce that changes must go through an approved MR by authorized engineers before merging. This directly ensures only authorized personnel can merge security-critical changes. It is the native GitLab access-control mechanism for branch protection.

Answer

Global Runner tags

Answer

Pipeline schedules for automated auditing

Answer

Webhook integration with Jira

Question 13

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. SA-10 Developer Configuration Management is part of the System and Services Acquisition family in NIST SP 800-53. It specifically addresses managing security-critical configuration changes during development and acquisition, ensuring that configurations are maintained and controlled.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 14

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 15

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)

Accepted Answer

Testing the badge reader system to confirm that only authorized badges grant entry.. Testing the badge reader system and examining access logs are both hands-on verification activities that provide objective evidence of physical access control implementation. Testing confirms that the system enforces access restrictions, while examining logs confirms that entry events are recorded for auditing. These activities align with NIST SP 800-53 assessment procedures for physical access control, which require examining and testing controls. Policy review, employee interviews, and manufacturer specifications do not verify actual implementation and are therefore not appropriate for this validation.

Answer

Reviewing the manufacturer's specifications for the badge reader hardware.

Answer

Interviewing employees about their perception of the facility's security.

Answer

Reviewing the access control policy to ensure it defines authorized personnel.

Question 16

An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)

Accepted Answer

A defined process for analyzing monitoring data and escalating risk-relevant changes to the Authorizing Official.. Continuous risk monitoring requires both a reliable data feed and a governance loop. Automated collection mapped to the control baseline supplies objective, timely evidence about control effectiveness and system change, while a defined analysis and escalation process turns that data into decisions by the Authorizing Official. Together they keep the risk picture current between formal assessments. Periodic reauthorization, uniform exhaustive retesting, and standalone penetration tests are point-in-time activities that do not sustain ongoing awareness.

Answer

Periodic reauthorization of every subsystem by the Authorizing Official on a fixed annual schedule.

Answer

Replacing the system's security assessment with an annual penetration test performed by an external team.

Answer

Full re-testing of every security control in the baseline at the same frequency, regardless of risk or volatility.

Question 17

A security engineer is validating the implementation of a new security information and event management (SIEM) system that aggregates logs from multiple sources. The engineer must verify that the SIEM is correctly ingesting and correlating events according to the designed use cases. Which validation approach is most appropriate for confirming that correlation rules are functioning as intended?

Accepted Answer

Generate a controlled sequence of events that should trigger a specific correlation rule and confirm that the SIEM produces the expected alert.. The most appropriate validation for correlation rules is to generate a controlled event sequence that should trigger a specific rule and confirm the expected alert. This tests the complete correlation pipeline from event ingestion through rule evaluation to alert generation. Documentation review, connectivity checks, and capacity verification are supporting activities but do not prove that correlation logic functions correctly.

Answer

Check the SIEM's licensing and storage capacity to ensure it can handle the volume of events from all sources.

Answer

Verify that all log sources are configured to send events to the SIEM and that the SIEM is receiving events from each source.

Answer

Review the SIEM's correlation rule documentation and confirm that each rule maps to a documented use case.

Question 18

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

Accepted Answer

Conducting a packet capture or flow test across each approved and denied path to observe actual enforcement behavior. Verification of an implemented boundary control must produce evidence that the deployed mechanism enforces the approved policy, not merely that documentation or personnel claim it does. Exercising approved and denied traffic paths demonstrates the actual behavior of the rule set, exposing ordering defects and unintended permits. This dynamic testing is the strongest form of implementation verification for access control enforcement.

Answer

Comparing the device's running configuration against the vendor's recommended hardening benchmark

Answer

Interviewing the network administrators who performed the installation to confirm they followed the build guide

Answer

Reviewing the vendor's default rule set documentation to confirm it matches the approved flow matrix

Question 19

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Accepted Answer

Operational system disruption. In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Answer

Data leakage

Answer

Loss of audit logs

Answer

Unauthorized access

Question 20

A security engineer is validating the implementation of full disk encryption using BitLocker on Windows 11 laptops in an enterprise. The organization requires that BitLocker be enabled with TPM and PIN protector and that recovery keys be escrowed in Active Directory. Which validation activity provides the strongest evidence that the BitLocker configuration meets these requirements?

Accepted Answer

On a sample laptop, confirm that manage-bde -status shows TPM and PIN protectors and that the recovery password is present in Active Directory.. The strongest evidence combines checking the actual BitLocker configuration on a laptop with verifying that the recovery key is escrowed in Active Directory. The manage-bde -status output confirms the TPM and PIN protectors are active, while the Active Directory check confirms escrow. Together they validate both the local encryption configuration and the centralized recovery requirement.

Answer

Run manage-bde -status on a sample laptop and confirm that the protection status is On and the key protector includes TPM and PIN.

Answer

Review the Group Policy Object that configures BitLocker requirements and confirm that it specifies TPM and PIN and requires recovery key escrow.

Answer

Verify in Active Directory Users and Computers that the BitLocker recovery information attribute is populated for a sample of laptops.