ISC Practice Test 4 — 10 Questions

Question 1

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Accepted Answer

To prevent data recovery after asset disposal. Sanitization is the process of removing data from storage media such that the data cannot be reconstructed by any forensic means.

Answer

To format the disk for reuse

Answer

To clean the hardware of dust

Answer

To update the operating system

Question 2

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is designed for confidentiality in multi-level security systems. Its no-write-down rule, known as the *-property, ensures that subjects at higher sensitivity levels cannot write to objects at lower sensitivity levels. This directly satisfies the scenario's requirement to prevent a Top Secret subject from writing to a Secret object. The other models address integrity or generic access control, not MLS confidentiality.

Answer

Clark-Wilson model

Answer

Graham-Denning model

Answer

Biba integrity model

Question 3

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Accepted Answer

The NIPS interface pair is configured in inline mode with fail-open or fail-closed settings and the policy action is set to block.. The primary reason an inline NIPS alerts but does not block is that the policy is set to alert-only or the interface is not truly inline. Verifying the interface pair mode and the policy action ensures the system is configured to enforce. Other items such as signature updates, SIEM alerts, and management VLANs affect detection or management, not the blocking capability.

Answer

The NIPS management interface is on a separate VLAN.

Answer

The NIPS signature database is updated to the latest version.

Answer

The NIPS is configured to send alerts to the SIEM.

Question 4

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

Accepted Answer

That no traffic is allowed unless explicitly permitted.. The implicit deny rule is the final catch-all rule that drops all traffic not explicitly allowed.

Answer

That the firewall is blocking all outgoing traffic.

Answer

That the firewall can handle high traffic volumes.

Answer

That the firewall is correctly logging denied packets.

Question 5

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

Accepted Answer

Adjust the baseline controls to address the specific system environment and mission.. Tailoring involves selecting, adapting, and supplementing controls to fit the specific mission and environment, rather than applying a blanket baseline.

Answer

Select all controls from the highest security baseline.

Answer

Exclude all controls that are difficult to implement.

Answer

Only apply controls that are mandated by law.

Question 6

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

Accepted Answer

Move to WORM media. WORM (Write Once Read Many) media ensures data cannot be altered or deleted for a defined retention period, satisfying both the 7-year retrievability requirement and the security need for tamper-evident, immutable storage. This is the standard approach for regulatory retention of decommissioned data because it prevents modification or premature deletion. It is the most secure option among those listed.

Answer

Copy to an unencrypted thumb drive

Answer

Delete the database server

Answer

Store on a public cloud share

Question 7

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

Accepted Answer

Protected Branches with Merge Request approvals. Protected Branches in GitLab restrict who can push and merge to a branch like master/main, and when combined with Merge Request approvals, they enforce that changes must go through an approved MR by authorized engineers before merging. This directly ensures only authorized personnel can merge security-critical changes. It is the native GitLab access-control mechanism for branch protection.

Answer

Global Runner tags

Answer

Pipeline schedules for automated auditing

Answer

Webhook integration with Jira

Question 8

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. SA-10 Developer Configuration Management is part of the System and Services Acquisition family in NIST SP 800-53. It specifically addresses managing security-critical configuration changes during development and acquisition, ensuring that configurations are maintained and controlled.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 9

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 10

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)

Accepted Answer

Testing the badge reader system to confirm that only authorized badges grant entry.. Testing the badge reader system and examining access logs are both hands-on verification activities that provide objective evidence of physical access control implementation. Testing confirms that the system enforces access restrictions, while examining logs confirms that entry events are recorded for auditing. These activities align with NIST SP 800-53 assessment procedures for physical access control, which require examining and testing controls. Policy review, employee interviews, and manufacturer specifications do not verify actual implementation and are therefore not appropriate for this validation.

Answer

Reviewing the manufacturer's specifications for the badge reader hardware.

Answer

Interviewing employees about their perception of the facility's security.

Answer

Reviewing the access control policy to ensure it defines authorized personnel.