ISC Practice Test 2 — 30 Questions

Question 1

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 2

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 3

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 4

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 5

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Accepted Answer

Act as a centralized TLS termination and traffic inspection point.. A Load Balancer can serve as an SSL termination point, allowing the security team to inspect traffic for malware at a single, centralized ingress point.

Answer

Automatically patch all backend servers.

Answer

Remove the need for host-based firewalls.

Answer

Encrypt all backend data at rest.

Question 6

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 7

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 8

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 9

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption

Question 10

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 11

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

Accepted Answer

X-Frame-Options: DENY or SAMEORIGIN.. The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.

Answer

X-Content-Type-Options: nosniff.

Answer

Strict-Transport-Security: max-age=63072000.

Answer

X-XSS-Protection: 1; mode=block.

Question 12

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Accepted Answer

Designing effective security countermeasures.. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) requires identifying threats, mapping them to system components, and planning countermeasures.

Answer

Conducting a public relations campaign.

Answer

Automating the software build process.

Question 13

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the core document that details the security control selection, tailoring, and implementation status for a system under the RMF.

Answer

The Plan of Action and Milestones (POA&M).

Answer

The Authorization to Operate (ATO) letter.

Answer

The Risk Assessment Report (RAR).

Answer

The Security Assessment Plan (SAP).

Question 14

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

Accepted Answer

Automated security scanning and log aggregation.. ConMon requires both the technical capability to detect changes/vulnerabilities and the organizational capability to respond to those findings in a timely manner.

Answer

Manual inspection of every system component once per year.

Answer

A complete cessation of all system updates.

Answer

Limiting the scope of monitoring to only the primary web server.

Question 15

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

Accepted Answer

Select security and privacy controls.. The RMF sequence is: Categorize, Select, Implement, Assess, Authorize, Monitor. Selecting controls follows categorization.

Answer

Implement security and privacy controls.

Answer

Monitor security and privacy controls.

Answer

Assess security and privacy controls.

Question 16

What is the primary objective of the 'Assessment' phase in the NIST RMF?

Accepted Answer

Verify that security controls are implemented correctly and operating as intended.. The Assessment phase is dedicated to determining if the selected security controls are correctly implemented and operating as intended.

Answer

Document the risk acceptance by the authorizing official.

Answer

Define the system's security impact level.

Answer

Deploy security software to endpoints.

Question 17

An ISSEP is conducting a gap analysis between a legacy system and ISO/IEC 27001 requirements. The system lacks automated audit logging. Which control implementation is most effective for meeting the 'Logging and Monitoring' requirements?

Accepted Answer

Implement centralized log aggregation using a SIEM solution with automated alerting.. Centralized log management (like a SIEM) allows for aggregation, alerting, and forensic analysis, which is fundamental to ISO 27001 compliance.

Answer

Redirect all logs to a local write-only file system on each server.

Answer

Disable unnecessary services to reduce the attack surface.

Answer

Require manual review of system event logs by administrators weekly.

Question 18

What is the first step when preparing a system for secure disposal?

Accepted Answer

Inventory the assets. Creating an inventory ensures that all components, including peripherals and secondary storage, are accounted for prior to sanitization.

Answer

Run a virus scan

Answer

Physically destroy the hardware

Answer

Send it to recycling

Question 19

Which TWO of the following are common pitfalls when tailoring security controls in an RMF implementation?

Accepted Answer

Tailoring controls without documenting the security justification.. Tailoring must be justified and documented. Pitfalls include excessive tailoring (reducing security too much) or lack of justification, which both undermine the compliance posture.

Answer

Using the NIST 800-53 catalog to select controls.

Answer

Consulting with the System Owner during the tailoring process.

Answer

Including too many controls, which is always acceptable.

Question 20

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

Accepted Answer

Enforcing short-lived, dynamically generated credentials.. Secrets management relies on strong access control, secure delivery, and the ability to rotate credentials to limit the window of opportunity for attackers.

Answer

Using a single, static password for all administrative access.

Answer

Hardcoding the master recovery key in the application source code.