ISC Practice Test 2 — 25 Questions

Question 1

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

Accepted Answer

Role-Based Access Control (RBAC).. Encryption (AES-256) and strong access controls (RBAC) are standard for high-impact data protection.

Answer

Storing data only in the local cache.

Answer

Disabling all audit logging.

Answer

Using cleartext storage for performance.

Question 2

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Accepted Answer

Add environmental sensors and hardened circuitry to detect and respond to fault injection attempts.. Fault injection (like voltage or clock glitching) targets the physical hardware during verification. Hardening the hardware against these physical disturbances (e.g., adding sensors to detect voltage spikes) is the appropriate defense.

Answer

Improve the software verification logic.

Answer

Increase the frequency of the RoT verification checks.

Answer

Implement a stronger hash algorithm for code signing.

Question 3

Which document outlines the specific security steps to be taken when a workstation reaches its end-of-life?

Accepted Answer

Data Sanitization Policy. The System Disposal Plan or Data Sanitization Policy outlines the specific requirements for decommissioning equipment to ensure no sensitive data remains.

Answer

Password Policy

Answer

Incident Response Plan

Answer

Acceptable Use Policy

Question 4

An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?

Accepted Answer

Risk of cross-tenant data leakage via side-channel attacks.. The 'noisy neighbor' or cross-tenant data leakage risk is inherent to multi-tenant architectures where shared hardware/hypervisor resources could potentially be exploited to access data from another tenant.

Answer

Risk of unauthorized access by the cloud provider's employees.

Answer

Difficulty in performing system backups.

Answer

Risk of data loss due to provider bankruptcy.

Question 5

You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?

Accepted Answer

Utilize a TEE (e.g., ARM TrustZone) to isolate keys and perform cryptographic operations.. In the absence of dedicated hardware, an obfuscated key store with a Trusted Execution Environment (TEE) or encrypted key wrapping utilizing a unique hardware-derived ID is the most secure software-centric approach.

Answer

Use a password-based derivation function (PBKDF2) to store the keys.

Answer

Store the keys in a hardcoded configuration file.

Answer

Store the keys in the system's non-volatile memory (NVM) with XOR masking.

Question 6

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 7

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 8

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 9

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 10

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Accepted Answer

Act as a centralized TLS termination and traffic inspection point.. A Load Balancer can serve as an SSL termination point, allowing the security team to inspect traffic for malware at a single, centralized ingress point.

Answer

Automatically patch all backend servers.

Answer

Remove the need for host-based firewalls.

Answer

Encrypt all backend data at rest.

Question 11

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 12

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 13

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 14

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption

Question 15

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 16

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

Accepted Answer

X-Frame-Options: DENY or SAMEORIGIN.. The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.

Answer

X-Content-Type-Options: nosniff.

Answer

Strict-Transport-Security: max-age=63072000.

Answer

X-XSS-Protection: 1; mode=block.

Question 17

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Accepted Answer

Designing effective security countermeasures.. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) requires identifying threats, mapping them to system components, and planning countermeasures.

Answer

Conducting a public relations campaign.

Answer

Automating the software build process.

Question 18

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the core document that details the security control selection, tailoring, and implementation status for a system under the RMF.

Answer

The Plan of Action and Milestones (POA&M).

Answer

The Authorization to Operate (ATO) letter.

Answer

The Risk Assessment Report (RAR).

Answer

The Security Assessment Plan (SAP).

Question 19

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

Accepted Answer

Automated security scanning and log aggregation.. ConMon requires both the technical capability to detect changes/vulnerabilities and the organizational capability to respond to those findings in a timely manner.

Answer

Manual inspection of every system component once per year.

Answer

A complete cessation of all system updates.

Answer

Limiting the scope of monitoring to only the primary web server.

Question 20

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

Accepted Answer

Select security and privacy controls.. The RMF sequence is: Categorize, Select, Implement, Assess, Authorize, Monitor. Selecting controls follows categorization.

Answer

Implement security and privacy controls.

Answer

Monitor security and privacy controls.

Answer

Assess security and privacy controls.