ISC Practice Test 4 — 10 Questions

Question 1

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 2

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 3

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 4

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 5

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Accepted Answer

Act as a centralized TLS termination and traffic inspection point.. A Load Balancer can serve as an SSL termination point, allowing the security team to inspect traffic for malware at a single, centralized ingress point.

Answer

Automatically patch all backend servers.

Answer

Remove the need for host-based firewalls.

Answer

Encrypt all backend data at rest.

Question 6

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 7

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 8

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 9

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption

Question 10

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.