ISC Practice Questions 1 — 50 Questions

Question 1

Which TWO of the following are key inputs for a quantitative risk analysis?

Accepted Answer

The Single Loss Expectancy (SLE) of the asset.. Quantitative risk analysis requires numerical data, specifically the value of the asset (Single Loss Expectancy) and the likelihood of the event (Annualized Rate of Occurrence).

Answer

The qualitative ranking of threats (e.g., High, Medium, Low).

Answer

A list of all potential security control vendors.

Answer

The subjective opinion of the IT staff.

Question 2

Which of the following is the most appropriate action when an ISSEP identifies a high-risk vulnerability in a system that is currently in production?

Accepted Answer

Document the vulnerability in the POA&M and coordinate a remediation plan with the system owner.. The ISSEP must report the vulnerability to the system owner and the authorization official, then document it in the POA&M to track its remediation while managing the risk in the interim.

Answer

Ignore the vulnerability until the next scheduled maintenance window.

Answer

Immediately shut down the system.

Answer

Fix the vulnerability immediately without informing anyone.

Question 3

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

Accepted Answer

Perform a firmware update using the manufacturer's signed secure update process.. Firmware vulnerabilities involving the TPM and secure boot chain represent a fundamental compromise of the root of trust. Remediation must prioritize the update of the firmware to restore the integrity of the secure boot sequence.

Answer

Update the security policy to include manual verification of boot logs.

Answer

Configure an IDS to block unauthorized firmware update attempts.

Answer

Disable TPM-based secure boot until the vendor releases a patch.

Question 4

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.

Question 5

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.

Question 6

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Accepted Answer

To prevent data recovery after asset disposal. Sanitization is the process of removing data from storage media such that the data cannot be reconstructed by any forensic means.

Answer

To format the disk for reuse

Answer

To clean the hardware of dust

Answer

To update the operating system

Question 7

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

Accepted Answer

Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.. In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.

Answer

Accept the risk because the API is internal-facing.

Answer

Disable the API entirely.

Answer

Monitor API logs for suspicious activity.

Question 8

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 9

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 10

What is the primary goal of the 'Authorization' phase in the NIST RMF?

Accepted Answer

For the Authorizing Official to formally accept the system's risk.. The authorization phase is where the Authorizing Official (AO) reviews the security documentation and decides whether to accept the risk associated with operating the system.

Answer

To patch all identified vulnerabilities.

Answer

To define the system's security controls.

Answer

To set up the monitoring tools.

Question 11

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

Accepted Answer

The security control is bypassed, allowing unauthorized access.. A 'fail-open' configuration means that when a security control (MFA) is unavailable, the system grants access anyway, effectively bypassing the security requirement and creating a critical vulnerability.

Answer

The system's performance will decrease.

Answer

The MFA provider will charge extra fees.

Answer

The system will be inaccessible to users.

Question 12

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the authoritative document describing a system's security controls; removing a system requires updating this document to reflect the change in boundary.

Answer

User access manual

Answer

Help desk FAQ

Answer

Network topology diagram

Question 13

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

Accepted Answer

Update the System Security Plan (SSP) to include the missing controls and implement the baseline via Infrastructure-as-Code (IaC) templates.. The RMF requires that security controls be implemented and documented. Identifying a missing baseline during the assessment phase necessitates updating the System Security Plan (SSP) and verifying the implementation of baseline controls before proceeding to the 'Authorize' step.

Answer

Modify the Security Assessment Plan (SAP) to exclude the container layer from the current assessment scope.

Answer

Proceed to authorization and defer the container baseline to the next Continuous Monitoring cycle.

Answer

Request a waiver from the Chief Information Security Officer (CISO) for container orchestration security.

Question 14

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 15

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 16

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Accepted Answer

Verification confirms the system meets specifications; Validation confirms it meets mission goals. Verification ensures the system is built correctly (conformance to requirements), while validation ensures the correct system is built (meeting user needs).

Answer

Verification is for security; Validation is for performance

Answer

Verification is done by vendors, Validation by end-users

Answer

Verification is for software, Validation is for hardware

Question 17

An ISSEP is evaluating the risk of an API that uses basic authentication over HTTP. What is the most significant risk, and how should it be mitigated?

Accepted Answer

Credential interception; mitigate by upgrading to HTTPS/TLS.. Basic authentication sends credentials in cleartext; HTTP does not provide encryption. The risk is credential interception, and it must be mitigated by upgrading to HTTPS (TLS).

Answer

Denial of Service (DoS); mitigate by using a WAF.

Answer

API rate limiting; mitigate by adding a rate limiter.

Answer

Unauthorized data access; mitigate by using OAuth 2.0.

Question 18

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 19

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 20

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

Answer

Formatting the partition

Answer

Degaussing