ISC Practice Test 5 — 10 Questions

Question 1

An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A defined process for analyzing monitoring data and escalating risk-relevant changes to the Authorizing Official.. Continuous risk monitoring requires both a reliable data feed and a governance loop. Automated collection mapped to the control baseline supplies objective, timely evidence about control effectiveness and system change, while a defined analysis and escalation process turns that data into decisions by the Authorizing Official. Together they keep the risk picture current between formal assessments. Periodic reauthorization, uniform exhaustive retesting, and standalone penetration tests are point-in-time activities that do not sustain ongoing awareness.

Answer

Periodic reauthorization of every subsystem by the Authorizing Official on a fixed annual schedule.

Answer

Replacing the system's security assessment with an annual penetration test performed by an external team.

Answer

Full re-testing of every security control in the baseline at the same frequency, regardless of risk or volatility.

Question 2

A security engineer is validating the implementation of a new security information and event management (SIEM) system that aggregates logs from multiple sources. The engineer must verify that the SIEM is correctly ingesting and correlating events according to the designed use cases. Which validation approach is most appropriate for confirming that correlation rules are functioning as intended?

Accepted Answer

Generate a controlled sequence of events that should trigger a specific correlation rule and confirm that the SIEM produces the expected alert.. The most appropriate validation for correlation rules is to generate a controlled event sequence that should trigger a specific rule and confirm the expected alert. This tests the complete correlation pipeline from event ingestion through rule evaluation to alert generation. Documentation review, connectivity checks, and capacity verification are supporting activities but do not prove that correlation logic functions correctly.

Answer

Check the SIEM's licensing and storage capacity to ensure it can handle the volume of events from all sources.

Answer

Verify that all log sources are configured to send events to the SIEM and that the SIEM is receiving events from each source.

Answer

Review the SIEM's correlation rule documentation and confirm that each rule maps to a documented use case.

Question 3

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

Accepted Answer

Conducting a packet capture or flow test across each approved and denied path to observe actual enforcement behavior. Verification of an implemented boundary control must produce evidence that the deployed mechanism enforces the approved policy, not merely that documentation or personnel claim it does. Exercising approved and denied traffic paths demonstrates the actual behavior of the rule set, exposing ordering defects and unintended permits. This dynamic testing is the strongest form of implementation verification for access control enforcement.

Answer

Comparing the device's running configuration against the vendor's recommended hardening benchmark

Answer

Interviewing the network administrators who performed the installation to confirm they followed the build guide

Answer

Reviewing the vendor's default rule set documentation to confirm it matches the approved flow matrix

Question 4

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Accepted Answer

Operational system disruption. In ICS/SCADA environments, system availability is paramount; uncoordinated changes can cause catastrophic operational failure.

Answer

Data leakage

Answer

Loss of audit logs

Answer

Unauthorized access

Question 5

A security engineer is validating the implementation of full disk encryption using BitLocker on Windows 11 laptops in an enterprise. The organization requires that BitLocker be enabled with TPM and PIN protector and that recovery keys be escrowed in Active Directory. Which validation activity provides the strongest evidence that the BitLocker configuration meets these requirements?

Accepted Answer

On a sample laptop, confirm that manage-bde -status shows TPM and PIN protectors and that the recovery password is present in Active Directory.. The strongest evidence combines checking the actual BitLocker configuration on a laptop with verifying that the recovery key is escrowed in Active Directory. The manage-bde -status output confirms the TPM and PIN protectors are active, while the Active Directory check confirms escrow. Together they validate both the local encryption configuration and the centralized recovery requirement.

Answer

Run manage-bde -status on a sample laptop and confirm that the protection status is On and the key protector includes TPM and PIN.

Answer

Review the Group Policy Object that configures BitLocker requirements and confirm that it specifies TPM and PIN and requires recovery key escrow.

Answer

Verify in Active Directory Users and Computers that the BitLocker recovery information attribute is populated for a sample of laptops.

Question 6

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Accepted Answer

Verify that 'Secure Boot' is set to 'Enabled' and the 'Platform Key' (PK) is installed.. Secure Boot validation requires confirming that the UEFI setting is Enabled and that a Platform Key (PK) is installed, because the PK anchors the trust chain that validates bootloader signatures. Without a PK, Secure Boot cannot enforce signature verification even if the toggle appears enabled. TPM version, Legacy Boot status, and NTP synchronization are related security controls but are not the components that prove Secure Boot is functioning.

Answer

Validate the TPM version is 2.0.

Answer

Check that 'Legacy Boot' is set to 'Disabled'.

Answer

Ensure the system clock is synchronized with a secure NTP server.

Question 7

An ISSE is developing a security architecture for a new system that must support multiple independent levels of security. The ISSE needs to ensure that the architecture enforces the principles of isolation and non-interference. Which two design techniques should the ISSE require? (Choose two.)

Accepted Answer

Enforce a mandatory access control policy that prevents information flow from higher to lower security levels.. Isolation and non-interference in a multiple independent levels of security architecture are achieved through a separation kernel that partitions resources and a mandatory access control policy that prevents high-to-low information flow. Shared memory, discretionary access control, and a single shared OS instance all undermine these properties by creating paths for interference or unauthorized data flow.

Answer

Rely on discretionary access control lists managed by each domain to control cross-domain access.

Answer

Use a single shared operating system instance with role-based access control to separate domains.

Answer

Use a shared memory segment for inter-domain communication to improve performance and reduce complexity.

Question 8

A program office is planning a new logistics system and the ISSE must determine which security engineering activities belong in the concept stage versus later stages. The chief engineer asks which activity should occur earliest, before any system requirements baseline is established. Which activity is most appropriate at that point?

Accepted Answer

Performing a preliminary risk assessment and defining security objectives from stakeholder needs. The concept stage precedes requirements baselining, so the security engineering work there is to understand stakeholder needs, mission risk, and the environment, and to derive security objectives and initial protection needs. That preliminary risk assessment drives all downstream requirements and design. Assessment, functional testing, and as-built baselining all presuppose an implemented system and therefore belong to later lifecycle stages.

Answer

Establishing the configuration control board and baselining the system's as-built configuration

Answer

Executing a functional security test of the allocated controls in a representative environment

Answer

Conducting a security assessment of the implemented system against its authorization package

Question 9

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

Accepted Answer

An automated configuration baseline monitor that checks servers on a scheduled interval and alerts on drift. The requirement is about detection latency for unauthorized configuration changes. Only an automated baseline monitor running at least hourly compares live settings to the approved baseline and raises alerts, producing evidence that deviations are caught inside the one-hour window. Quarterly audits and weekly ticket reviews are too infrequent and inspect process records rather than server state. Narrowly scoped file integrity monitoring lacks the coverage of security-relevant settings, so it cannot satisfy the requirement either.

Answer

Reviewing the change management ticketing system for approved change requests each week

Answer

A quarterly manual configuration audit performed by the security team

Answer

File integrity monitoring configured to watch only the operating system kernel binaries

Question 10

An ISSEP is performing a risk assessment on a system that depends on a commercial cloud provider for infrastructure. The provider's shared responsibility model places physical security and hypervisor patching with the provider, while the ISSEP's organization retains responsibility for data classification, identity management, and application security. The Authorizing Official asks the ISSEP to formally capture which controls are inherited, shared, or customer-owned so that residual risk is not double-counted or overlooked. Which risk management activity best addresses this need?

Accepted Answer

Conducting a control inheritance and shared responsibility mapping as part of the system security plan. Control inheritance mapping is the risk management activity that documents which controls the cloud provider implements and assesses, which are shared, and which remain the customer's responsibility. This prevents double-counting of provider-assessed controls and ensures customer-owned controls receive full assessment. It is the artifact the Authorizing Official needs to judge residual risk accurately.

Answer

Performing an independent penetration test of the provider's hypervisor layer

Answer

Re-categorizing the system at a higher FIPS 199 impact level to reflect cloud exposure

Answer

Requesting a new Authority to Operate directly from the cloud provider's authorizing official