ISC Practice Test 5 — 25 Questions

Question 1

A security engineer is planning verification and validation activities for a new command-and-control system and must decide which techniques constitute dynamic verification rather than static analysis. Which two of the following are dynamic verification techniques? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Fuzz testing of network protocol parsers. Dynamic verification requires executing the system and observing real behavior, while static techniques inspect artifacts without running them. Penetration testing and fuzz testing both drive the live system with adversarial or malformed input and record actual outcomes, so they are dynamic. Manual code review, SAST, and software composition analysis all examine source, binaries, or dependency metadata without execution, so they are static. A balanced verification program uses both categories because each finds defect classes the other misses.

Answer

Manual source code review against secure coding standards

Answer

Static application security testing (SAST) scanning

Answer

Software composition analysis of third-party libraries

Question 2

A security engineer is validating the implementation of a secure software development lifecycle (SDLC) for a critical application. The requirement is that all code must undergo static analysis before deployment. During validation, the engineer finds that the static analysis tool is configured to ignore certain classes of vulnerabilities. Which action should the engineer take to ensure the validation is effective?

Accepted Answer

Review the tool's configuration and compare the ignored vulnerability classes against the organization's secure coding standards to determine if the exclusions are justified.. The effective action is to review the exclusions against secure coding standards to determine if they are justified. This ensures that the static analysis remains aligned with policy and that any unjustified exclusions are corrected. Disabling all exclusions or switching tools bypasses proper validation, while accepting without review ignores potential risks. This approach maintains the integrity of the SDLC validation.

Answer

Run a dynamic analysis tool instead, since static analysis is clearly not reliable.

Answer

Document the exclusions as a risk and accept them without further action, since the tool is still performing some analysis.

Answer

Immediately disable all exclusions in the static analysis tool to ensure no vulnerabilities are missed.

Question 3

A security engineer is validating the implementation of a public key infrastructure (PKI) used for internal TLS. The validation must confirm that certificate issuance and revocation controls are working as designed. Which TWO of the following verification activities provide direct evidence that these controls are effective? (Choose two.)

Accepted Answer

Revoke a test certificate and confirm that a relying party rejects a connection using that certificate.. Direct evidence of issuance and revocation control effectiveness comes from exercising the controls. Rejecting a non-compliant certificate request proves the issuance policy is enforced, and rejecting a connection after revocation proves the revocation information is published and checked. Documentation, asset tracking, and time synchronization are supporting activities that do not demonstrate the controls actually function.

Answer

Review the certificate practice statement to confirm it documents the issuance and revocation procedures.

Answer

Verify that the CA server's clock is synchronized with an authoritative time source.

Answer

Confirm that the root certificate is stored in the organization's configuration management database with a current owner.

Question 4

An ISSE is leading a design review of a new identity management subsystem that must support separation of duties for administrative functions. The review board asks which design characteristics directly enforce separation of duties within the subsystem. (Choose two.)

Accepted Answer

Role definitions that prevent a single account from holding both request-initiating and request-approving privileges. Separation of duties is enforced structurally by making conflicting privileges mutually exclusive across roles, and operationally by requiring two distinct authorized individuals for designated high-risk actions. Those two characteristics directly prevent a single identity from completing a sensitive transaction alone. Credential rotation, centralized logging, and session encryption strengthen authentication, accountability, and confidentiality, but none of them divide privileged functions among separate identities.

Answer

Centralized logging of all administrative actions to a remote write-once audit repository

Answer

Password complexity requirements that force administrators to rotate credentials every thirty days

Answer

Encryption of administrative session traffic using approved transport layer cryptography

Question 5

A security engineer is verifying the implementation of a public key infrastructure (PKI) for a government agency. The agency requires that all digital certificates comply with FIPS 140-2 and are issued by a trusted certificate authority. During validation, the engineer needs to confirm that a server's certificate is valid and has not been revoked. Which mechanism should the engineer use to check the certificate's revocation status in real time?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP is designed for real-time certificate revocation checking. It allows a client to send a request to an OCSP responder, which returns the current revocation status of the certificate. This meets the requirement for real-time validation. CRLs are updated periodically and may not reflect recent revocations. CT logs and SCEP serve different purposes in PKI. Using OCSP ensures that the server's certificate is checked against the latest revocation information, which is critical for maintaining trust in the PKI.

Answer

Certificate Revocation List (CRL)

Answer

Certificate Transparency (CT) logs

Answer

Simple Certificate Enrollment Protocol (SCEP)

Question 6

When disposing of SSDs that contain PII, why is traditional degaussing ineffective?

Accepted Answer

SSDs are not magnetic media. Degaussing works by applying a strong magnetic field to erase data on magnetic media such as HDDs and tapes. SSDs store data in NAND flash cells using electrical charge, not magnetic domains, so a degausser has no effect on the stored data. This makes degaussing fundamentally inapplicable to SSDs.

Answer

SSDs have internal encryption

Answer

SSDs are too thin

Answer

SSDs have wear leveling algorithms

Question 7

Which TWO of the following are key inputs for a quantitative risk analysis?

Accepted Answer

The Single Loss Expectancy (SLE) of the asset.. Quantitative risk analysis requires numerical data, specifically the value of the asset (Single Loss Expectancy) and the likelihood of the event (Annualized Rate of Occurrence).

Answer

The qualitative ranking of threats (e.g., High, Medium, Low).

Answer

A list of all potential security control vendors.

Answer

The subjective opinion of the IT staff.

Question 8

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 9

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Accepted Answer

Verification confirms the system meets specifications; Validation confirms it meets mission goals. Verification ensures the system is built correctly (conformance to requirements), while validation ensures the correct system is built (meeting user needs).

Answer

Verification is for security; Validation is for performance

Answer

Verification is done by vendors, Validation by end-users

Answer

Verification is for software, Validation is for hardware

Question 10

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Answer

User access manual

Answer

Help desk FAQ

Answer

Network topology diagram

Question 11

An ISSEP must secure a server-to-server connection that currently uses plaintext LDAP. What is the recommended secure alternative?

Accepted Answer

Migrate to LDAPS (LDAP over TLS) on port 636.. LDAPS (LDAP over TLS/SSL) on port 636 is the industry-standard way to encrypt LDAP traffic.

Answer

Use LDAP with Kerberos binding only.

Answer

Use IPsec to encrypt traffic between servers.

Answer

Use a VPN tunnel.

Question 12

In a cloud environment, you must ensure that VM snapshots are encrypted. What is the most effective approach?

Accepted Answer

Enable the provider-level setting to enforce encryption for all new snapshots.. Configuring the account-level setting to enforce encryption on all new snapshots ensures that no unencrypted snapshots can be created by users.

Answer

Run a script to encrypt snapshots after they are created.

Answer

Train users to check the 'encrypt' box when taking snapshots.

Answer

Use an external scanner to identify and delete unencrypted snapshots.

Question 13

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Accepted Answer

Add environmental sensors and hardened circuitry to detect and respond to fault injection attempts.. Fault injection (like voltage or clock glitching) targets the physical hardware during verification. Hardening the hardware against these physical disturbances (e.g., adding sensors to detect voltage spikes) is the appropriate defense.

Answer

Improve the software verification logic.

Answer

Increase the frequency of the RoT verification checks.

Answer

Implement a stronger hash algorithm for code signing.

Question 14

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Accepted Answer

Act as a centralized TLS termination and traffic inspection point.. A Load Balancer can serve as an SSL termination point, allowing the security team to inspect traffic for malware at a single, centralized ingress point.

Answer

Automatically patch all backend servers.

Answer

Remove the need for host-based firewalls.

Answer

Encrypt all backend data at rest.

Question 15

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the core document that details the security control selection, tailoring, and implementation status for a system under the RMF.

Answer

The Plan of Action and Milestones (POA&M).

Answer

The Authorization to Operate (ATO) letter.

Answer

The Risk Assessment Report (RAR).

Answer

The Security Assessment Plan (SAP).

Question 16

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

Accepted Answer

Integrity. Tampering threats target the Integrity aspect of the CIA triad by attempting to modify data or system configurations.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 17

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Accepted Answer

nmap -p 80 <target_ip>. Nmap is a standard network scanning tool used to verify that specific ports are blocked or filtered.

Answer

nslookup <target_ip>

Answer

netstat -an

Answer

ipconfig /all

Question 18

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

Accepted Answer

Configure API Gateway rate limiting policies per user or per IP.. Implementing API rate limiting at the API Gateway level prevents single clients from overwhelming the backend services.

Answer

Require an API key for every request.

Answer

Load balance the API across more servers.

Answer

Use a custom header to validate the request source.

Question 19

Which type of change is typically excluded from a formal Change Advisory Board review process?

Accepted Answer

Standard changes. Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

Answer

Emergency changes

Answer

Security patches

Answer

Significant changes

Question 20

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

Accepted Answer

It serves as the contract between the vendor and the evaluator. The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.

Answer

It replaces the need for a threat model

Answer

It is a marketing document for end users

Answer

It defines the operating system kernel