ISC Practice Test 3 — 10 Questions

Question 1

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 2

An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)

Accepted Answer

Implement network segmentation with industrial firewalls to isolate the PLCs from the corporate network and the internet.. For unpatched legacy PLCs, the most effective compensating controls are network segmentation with industrial firewalls and strict physical access controls. These measures reduce the attack surface and prevent unauthorized access, which are critical when patching is not an option. Other options are either infeasible or do not directly address the vulnerabilities of the PLCs.

Answer

Replace all legacy PLCs with new models that support patching.

Answer

Deploy host-based antivirus software directly on the PLCs.

Answer

Require all operators to use multi-factor authentication (MFA) when logging into the PLCs.

Question 3

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

Accepted Answer

Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.. Configuring specific SQL Injection (SQLi) and Cross-Site Scripting (XSS) rules that inspect request bodies and query parameters is the primary method for blocking injection attacks at the WAF.

Answer

Enable 'TLS Termination' to offload encryption.

Answer

Enable 'Geo-blocking' to restrict access to local users only.

Answer

Enable 'Rate Limiting' on all incoming traffic.

Question 4

An ISSEP is designing a secure network architecture for a system that must support remote users accessing sensitive data. The system owner has mandated the use of a VPN to protect data in transit. The ISSEP must select a VPN protocol that provides confidentiality, integrity, and mutual authentication. Which protocol should the ISSEP choose?

Accepted Answer

IPsec in tunnel mode with IKEv2. IPsec in tunnel mode with IKEv2 is the only option that provides all three required security services: confidentiality, integrity, and mutual authentication. IKEv2 supports strong authentication methods, including certificates and EAP, enabling mutual authentication. PPTP, L2TP without IPsec, and SSL/TLS VPN with only server-side certificates either lack encryption, integrity, or mutual authentication. Therefore, IPsec with IKEv2 is the correct protocol for this scenario.

Answer

L2TP without IPsec

Answer

PPTP with MS-CHAPv2

Answer

SSL/TLS VPN using only server-side certificates

Question 5

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

Accepted Answer

They provide insights into potential system threats. Misuse cases define what a malicious actor might try to do to the system, helping to derive security requirements.

Answer

They automate the generation of firewall rules

Answer

They replace the need for unit testing

Answer

They track the progress of development sprints

Question 6

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 7

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

Accepted Answer

Run an authenticated configuration scan against the live system and manually inspect the resulting service, audit, and file permission settings.. Verification and validation require objective evidence that controls are implemented as specified. Inspecting the live system through an authenticated configuration scan, supplemented by manual review of the output, directly measures the service state, audit configuration, and file permissions. Documentation, interviews, and image hashes reflect intent or artifact integrity rather than the actual operational configuration, so they cannot confirm the baseline is met on the running server.

Answer

Compare the server's build image hash against the hash recorded in the configuration management database.

Answer

Interview the system administrator who built the server and obtain a signed attestation of compliance.

Answer

Review the signed configuration management plan and the change advisory board approval records.

Question 8

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Accepted Answer

Graceful degradation. Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.

Answer

Maximal feature set

Answer

Hardware redundancy only

Answer

Complete system lockdown upon error

Question 9

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

Accepted Answer

Destroy the HSM root CA private keys using the HSM's secure zeroization function and record the destruction in the decommissioning log.. Proper disposal of a legacy identity system requires destroying the root CA private keys to prevent forgery while preserving public certificates and revocation information so existing credentials remain verifiable. Retaining private keys or leaving the directory database intact creates unnecessary risk and violates data lifecycle requirements. The two required actions balance security with the operational need for trust continuity during the transition period.

Answer

Migrate the directory user attributes to the new identity system and then leave the legacy database intact for historical reference.

Answer

Archive the root CA private keys in an offline vault so they can be used to re-sign certificates if validation issues arise later.

Answer

Delete the directory database by dropping all tables and removing the database files from the storage array without further sanitization.

Question 10

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption