ISC Practice Test 4 — 25 Questions

Question 1

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Security requirements identified early can be allocated to system components and traced through design, reducing costly rework later.. Systems security engineering is most effective when it begins with concept and requirements definition, because security requirements can then be derived, allocated, and traced through the lifecycle. This early allocation lets designers build controls into the architecture instead of retrofitting them, which reduces cost and schedule risk. The other statements either overstate what early involvement guarantees or misdescribe the purpose of early security work.

Answer

Starting early guarantees that the system will be certified and accredited without any residual risk.

Answer

Early involvement allows the ISSE to defer all security control selection until the operations and maintenance phase.

Answer

Early security engineering eliminates the need for security testing because threats are addressed during requirements analysis.

Question 2

During the security architecture review of a new identity management system, the ISSEP must choose an authentication protocol that supports native single sign-on across organizational boundaries and carries signed assertions about the user so relying parties can make authorization decisions without contacting the identity provider on every request. Which protocol best meets these requirements?

Accepted Answer

SAML 2.0. SAML 2.0 was built for federated identity: the identity provider issues signed assertions that a service provider validates and uses locally. That lets relying parties make authorization decisions from the assertion content without a live call to the identity provider, and it works across organizational boundaries. Kerberos, RADIUS, and LDAP solve different authentication or directory problems.

Answer

RADIUS with EAP-TLS

Answer

LDAPv3 with StartTLS

Answer

Kerberos 5 with cross-realm trusts

Question 3

An ISSEP is reviewing the supply chain risk for a system that will embed a commercial off-the-shelf cryptographic module. The program requires assurance that the module's cryptographic functions were independently tested against a published standard and that the module's security features are documented against a recognized protection profile. Which artifact should the ISSEP require from the vendor?

Accepted Answer

A Common Criteria certificate with a validated Protection Profile for the module. Common Criteria evaluation by an accredited laboratory against a validated Protection Profile provides the independent, standard-based assurance the program requires. The certificate confirms the module's security functions were tested and its features documented against recognized criteria. Vendor self-attestation, ISO/IEC 27001, and SOC 2 reports address the vendor or its management system, not the module's evaluated security functionality.

Answer

An ISO/IEC 27001 certificate covering the vendor's development facility

Answer

A vendor self-attestation letter confirming FIPS 140-3 compliance

Answer

A SOC 2 Type II report on the vendor's production environment

Question 4

A financial services firm runs a three-tier web application on-premises. The security team must apply an emergency patch to the TLS library on all web servers because of an actively exploited vulnerability. The change management policy requires an emergency change process, but the firm's regulator mandates that production changes be traceable and approved by someone other than the implementer. Which sequence best satisfies both the emergency response need and the regulatory requirement?

Accepted Answer

Convene the Emergency Change Advisory Board (ECAB), obtain approval from a designated approver who is not the implementer, apply the patch, and document the outcome.. An emergency change still requires independent approval to meet the regulator's separation-of-duties mandate. The ECAB provides a fast-track approval path, and having a different person authorize the patch preserves the control while enabling rapid response. Applying the patch first or combining roles would violate the regulatory requirement, and waiting for the regular CAB would leave the exploited vulnerability unmitigated. Documenting the outcome completes the traceability chain.

Answer

Apply the patch immediately to all servers, then document the change and obtain retroactive approval from the change manager within 24 hours.

Answer

Have the security team lead both approve and apply the patch to shorten the response time, then notify the change manager afterward.

Answer

Wait for the next scheduled Change Advisory Board meeting to obtain approval, then apply the patch during the standard maintenance window.

Question 5

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

Accepted Answer

Bell-LaPadula model. The requirement is a mandatory confidentiality flow control across sensitivity labels, which is the defining purpose of the Bell-LaPadula model. Its simple security property blocks reading above one's clearance, and its star property blocks writing below the object's classification. Together they ensure TOP SECRET data cannot reach UNCLASSIFIED subjects, satisfying the command-and-control system's multilevel security mandate.

Answer

Brewer-Nash (Chinese Wall) model

Answer

Clark-Wilson integrity model

Answer

Biba integrity model

Question 6

An ISSEP is planning the security architecture for a system that will be operated in a facility shared with other tenants. The design must protect against an attacker who gains physical access to the shared space and attempts to capture electromagnetic emanations from the system's displays and cables. Which countermeasure should the ISSEP specify?

Accepted Answer

Deploy the system inside a TEMPEST-approved shielded enclosure with filtered power and signal lines. Compromising emanations are a physical-layer threat, so the countermeasure must operate at that layer. A TEMPEST-approved shielded enclosure with filtered power and signal lines contains emissions and keeps them out of the shared space. Encryption, mandatory access control, and network monitoring address different layers and cannot stop an attacker from capturing radiated signals.

Answer

Install an intrusion detection system monitoring the shared facility network segment

Answer

Enforce mandatory access control with SELinux on all system hosts

Answer

Encrypt all data at rest using AES-256 with keys stored in a hardware security module

Question 7

An ISSE is defining the protection profile for a new multi-level secure system that must enforce the Bell-LaPadula model. The design team asks which rules must be enforced to prevent unauthorized disclosure of classified information. (Choose two.)

Accepted Answer

The simple security property: a subject at a given security level may not read an object at a higher security level.. Bell-LaPadula is a confidentiality model whose two mandatory rules are the simple security property, which forbids reading up, and the star property, which forbids writing down. Together these rules prevent a subject from accessing higher-classified data and from leaking it to lower levels. The other options describe supporting concepts or a different model entirely, so they do not satisfy the requirement to prevent unauthorized disclosure.

Answer

The tranquility principle: security labels may not be changed while the system is processing data.

Answer

The weak tranquility principle: subjects may change their security level only after re-authentication.

Answer

The Biba integrity property: a subject may not read an object at a lower integrity level.

Question 8

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

Accepted Answer

Run an automated configuration compliance scan against the baseline on a recurring schedule and review deviations.. Ongoing configuration verification depends on repeated, objective comparison of actual settings against the approved baseline. Scheduled automated compliance scans detect drift promptly, produce auditable evidence, and trigger remediation. This approach satisfies the continuous monitoring intent of configuration management controls and is far more reliable than snapshots, attestations, or ticket reviews for confirming sustained adherence.

Answer

Require administrators to sign an attestation stating that they have not modified any server settings since implementation.

Answer

Review the change management ticketing system to confirm that every modification has an approved change request.

Answer

Capture a one-time snapshot of each server's configuration files and archive it with the acceptance documentation.

Question 9

An ISSEP is designing a cross-domain solution (CDS) to allow a high-assurance system to transfer data to a low-assurance system. The CDS must enforce data flow policies and prevent leakage of sensitive information. Which security engineering approach should the ISSEP implement to meet these requirements?

Accepted Answer

Use a guard that enforces a predefined security policy and performs data sanitization and format checking. A guard is a specialized component in a cross-domain solution that enforces security policies, performs data sanitization, and validates formats to ensure that only authorized data crosses the domain boundary. It operates on a trusted path and can implement rules based on classification, releasability, and content. This approach directly addresses the need to enforce data flow policies and prevent leakage of sensitive information.

Answer

Deploy a one-way data diode that physically prevents any data from flowing back to the high-assurance system

Answer

Implement a content filter that inspects data for malicious code and sensitive keywords before transfer

Answer

Establish a virtual private network (VPN) tunnel between the two systems to encrypt data in transit

Question 10

During a security architecture review, the ISSE must evaluate the system's ability to enforce the *-property (no write down) as defined in the Bell-LaPadula model. The system currently allows a process at the Secret level to write to an object at the Unclassified level. Which design change should the ISSE recommend to satisfy the *-property?

Accepted Answer

Enforce a mandatory access control policy that prevents subjects from writing to objects at a lower sensitivity level.. The *-property, or no-write-down rule, is a core Bell-LaPadula requirement that prevents subjects at a higher sensitivity level from writing to objects at a lower level. Enforcing mandatory access control that blocks such writes directly satisfies this property. This protects confidentiality by preventing high-level information from leaking to lower levels, even if the subject is malicious.

Answer

Apply the simple security property by restricting read access to objects at the same or lower level.

Answer

Implement the Biba integrity model to prevent unauthorized modification of low-integrity data.

Answer

Implement a trusted process that can temporarily downgrade the classification of the object.

Question 11

During early requirements definition for a new mission system, stakeholders agree that the system must remain effective even if several individual components are compromised. The ISSE must select a design principle that best supports this objective while keeping the architecture affordable. Which principle should be applied?

Accepted Answer

Defense in depth, layering independent protective mechanisms across the architecture.. Defense in depth layers independent controls so no single compromise yields full access, directly supporting the requirement that the system remain effective when multiple components are lost. It also permits incremental investment, which helps with affordability. The other principles either centralize risk, depend on secrecy, or trade away protection for availability.

Answer

Single point of enforcement, where all security decisions are made by one hardened component.

Answer

Security through obscurity, hiding internal design details from potential adversaries.

Answer

Fail-open behavior, ensuring availability by bypassing controls when components fail.

Question 12

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

Accepted Answer

Security through obscurity. Security through obscurity is the flawed practice of relying on secrecy of design or implementation as the main protection. In this scenario, the system assumes attackers will not discover the proprietary protocol, so the security would collapse if that assumption fails. Sound systems security engineering instead demands that security be based on robust, verifiable mechanisms that do not depend on adversary ignorance.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 13

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

Accepted Answer

Document the finding as a non-compliance and initiate the risk management process to assess the impact and determine remediation options.. When validation reveals a cryptographic module lacks FIPS 140-3 validation, the immediate step is to document the non-compliance and initiate risk management. This aligns with ISSEP principles of traceability and structured risk handling. Replacement or acceptance without assessment bypasses governance, while penetration testing addresses a different concern. The correct approach ensures the deviation is formally recorded and evaluated for impact and remediation.

Answer

Immediately replace the database encryption module with a FIPS 140-3 validated alternative without further analysis.

Answer

Accept the risk because AES-256 is cryptographically strong regardless of FIPS validation status.

Answer

Conduct a penetration test to see if the non-validated module can be exploited before taking any other action.

Question 14

A retail company is replacing its point-of-sale (POS) terminals with new models that support tokenization. The old terminals store encrypted card data locally and are leased from a payment processor. The security policy requires that all storage media be sanitized before leaving the company's control. Which action should the security engineer take before returning the leased terminals?

Accepted Answer

Sanitize the local storage in each terminal according to the payment processor's approved method, then obtain a certificate of sanitization before returning the devices.. Leased POS terminals containing encrypted card data must be sanitized using the lessor's approved method before they leave the company's control. A certificate of sanitization provides the evidence needed for both the lease agreement and the security policy. Factory resets, media removal, or additional encryption do not reliably eliminate the stored data, so they fail to satisfy the disposal requirement.

Answer

Remove the storage media from each terminal and retain them in the company's evidence locker for future investigations.

Answer

Encrypt the local storage with a new key and return the terminals, relying on the encryption to protect the old card data.

Answer

Perform a factory reset on each terminal and confirm that the device prompts for setup on the next boot before returning it.

Question 15

During a security architecture review, an ISSE observes that the design separates the trusted computing base into distinct, isolated modules with explicit interfaces, and that no module can access another's internal data structures directly. Which design principle is primarily being applied to limit the propagation of a compromise?

Accepted Answer

Encapsulation and modularity. Encapsulation and modularity partition the trusted computing base into isolated components that interact only through explicit interfaces. This structure limits the blast radius of a compromise because a faulty or subverted module cannot directly manipulate another module's internal state, which is exactly the propagation-limiting property the ISSE observed.

Answer

Least common mechanism

Answer

Complete mediation

Answer

Fail-safe defaults

Question 16

An ISSE is leading the security design for a system that will process Controlled Unclassified Information (CUI). The system must comply with NIST SP 800-171. The ISSE needs to ensure that the design includes mechanisms to protect the confidentiality of CUI at rest and in transit. Which set of controls from SP 800-171 should the ISSE prioritize?

Accepted Answer

System and Communications Protection (SC) and Media Protection (MP). To protect CUI confidentiality at rest and in transit under SP 800-171, the ISSE should prioritize System and Communications Protection (SC) for encryption and secure communications, and Media Protection (MP) for safeguarding media that store CUI. These families provide the technical and physical safeguards that directly address the stated requirement.

Answer

Awareness and Training (AT) and Personnel Security (PS)

Answer

Media Protection (MP) and Physical Protection (PE)

Answer

Access Control (AC) and Identification and Authentication (IA)

Question 17

An ISSEP is designing a secure network architecture for a Department of Defense (DoD) system that must comply with the NIST Risk Management Framework (RMF) and DoD Instruction 8510.01. The system will use a demilitarized zone (DMZ) to host a public-facing web server. The ISSEP must ensure that the DMZ design follows the principle of least privilege and prevents direct access to the internal network. Which design approach best meets these requirements?

Accepted Answer

Segment the DMZ from the internal network using a firewall that allows only specific, necessary traffic from the DMZ to the internal network.. A DMZ must be isolated from the internal network by a firewall that enforces least privilege. Only specific, necessary traffic should be allowed from the DMZ to the internal network. This limits the impact of a compromised public-facing server. Other options either place the server in the internal network, allow routing between networks, or rely solely on VLANs, which are insufficient for a secure DMZ.

Answer

Use a dual-homed host with two network interfaces: one connected to the DMZ and one to the internal network, with routing enabled.

Answer

Place the web server in the internal network and use a reverse proxy in the DMZ to forward requests.

Answer

Connect the DMZ and internal network to the same VLAN but use VLAN access control lists (VACLs) to filter traffic.

Question 18

An ISSE is defining the security requirements for a new system that will be developed using a systems security engineering approach. The ISSE must ensure that the requirements address the system's ability to protect against, detect, and respond to security incidents. Which TWO activities should the ISSE perform to derive these requirements? (Choose two.)

Accepted Answer

Conduct a threat modeling exercise to identify potential attack vectors and adversary capabilities.. Threat modeling and defining security functional requirements from the security categorization are both direct requirements elicitation activities. Threat modeling identifies what the system must protect against, while functional requirements translate controls into specific capabilities for protection, detection, and response. Together, they ensure the system's security requirements are comprehensive and risk-based.

Answer

Develop a configuration management plan to track changes to the system throughout its lifecycle.

Answer

Perform a business impact analysis to determine the criticality of system assets and processes.

Answer

Create a continuous monitoring strategy to track the effectiveness of security controls over time.

Question 19

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

Accepted Answer

Revoke a test certificate, attempt authentication with the corresponding smart card, and confirm that authentication is denied with a revocation-related error.. The strongest assurance that revoked certificates are rejected comes from an end-to-end test: revoke a certificate, attempt authentication, and confirm denial. This validates the relying party's revocation checking behavior, which is the actual security control. CA-side checks and CRL signature verification confirm that revocation data exists and is trustworthy but do not prove that authentication systems enforce it.

Answer

Confirm that the Certification Authority has a valid CRL Distribution Point extension in issued certificates and that the CRL is published on schedule.

Answer

Verify that the CA's certificate revocation list is signed with the CA's private key and that the signature validates using the CA's public key.

Answer

Review the CA's audit logs to confirm that the revocation request was processed and that the certificate serial number was added to the CRL.

Question 20

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

Accepted Answer

Compare the raw log output from a critical server with the events received by the SIEM for the same time period.. The most effective technique is to compare raw logs from the source with events in the SIEM. This end-to-end verification pinpoints where in the pipeline events are lost, whether at generation, forwarding, or ingestion. Other options address only parts of the system and do not provide definitive evidence of the root cause. This method aligns with ISSEP validation principles of tracing data flow and verifying each component.

Answer

Run a vulnerability scan on the critical servers to check for logging-related CVEs.

Answer

Check the SIEM's storage capacity to ensure it is not dropping events due to full disks.

Answer

Review the SIEM's correlation rules to ensure they include all authentication event IDs.