ISC Practice Questions 2 — 50 Questions

Question 1

An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Determining the potential adverse impacts to organizational operations, assets, and individuals. A system-level risk assessment must identify relevant threat sources and events and determine the potential adverse impacts on organizational operations, assets, and individuals. These two activities establish the likelihood and consequence dimensions the Authorizing Official needs. Product selection, exhaustive quantitative loss calculations, and premature authorization signatures are not essential components of the assessment itself.

Answer

Calculating the annualized loss expectancy for every asset in the enterprise enclave

Answer

Selecting the specific commercial product that will implement the cross-domain guard

Answer

Obtaining the Authorizing Official's signature on the Authority to Operate before beginning analysis

Question 2

An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?

Accepted Answer

The integrity of data before it is written to the blockchain may be compromised.. The most significant residual risk is that data integrity can be compromised before it is written to the blockchain. Blockchain provides immutability and tamper-evidence for data after it is recorded, but it cannot verify the truthfulness of the input. If an attacker can manipulate the logging source, false entries become permanently stored. Thus, the ISSEP should emphasize controls at the data origin.

Answer

The blockchain's cryptographic hash functions may be broken in the future.

Answer

The audit logs may become too large to store on the blockchain.

Answer

The blockchain's consensus algorithm may be vulnerable to a 51% attack.

Question 3

An ISSEP is integrating a commercial off-the-shelf (COTS) component into a system that will process Controlled Unclassified Information (CUI). The vendor provides a self-signed statement of conformity but no independent assessment. The program needs to characterize the supply chain risk before the component enters the authorization boundary. Which approach best supports an informed supply chain risk determination?

Accepted Answer

Obtain independent third-party assessment artifacts and software bill of materials (SBOM) data, then analyze them against the program's supply chain risk criteria.. A self-signed statement of conformity is an unverified assertion, so the program needs objective evidence. Independent third-party assessment artifacts plus SBOM data expose provenance, dependencies, and known weaknesses, allowing the ISSEP to evaluate the component against defined supply chain criteria. This produces a defensible risk characterization before the component crosses the authorization boundary, which is the point at which the decision must be informed.

Answer

Defer the supply chain risk assessment until after authorization, relying on continuous monitoring to detect component issues in production.

Answer

Require the vendor to complete a security questionnaire and map the responses to the organization's supply chain risk controls.

Answer

Accept the vendor's statement of conformity at face value because COTS products are outside the program's configuration control.

Question 4

You are the ISSE reviewing a change management process for a system that supports a continuous authorization approach. The process must ensure that security-relevant changes are identified and handled appropriately. Which TWO activities are required to maintain the authorization when a security-relevant change occurs? (Choose two.)

Accepted Answer

Perform a security impact analysis to determine whether the change affects the security posture or the controls in the authorization package.. Maintaining an authorization during security-relevant change requires a security impact analysis to evaluate the effect on controls and risk, followed by updates to the system security plan and related documentation. These two activities keep the authorization package accurate and support the continuous authorization decision.

Answer

Notify all users of the change and obtain their written acknowledgment before implementing the change.

Answer

Submit the change to the Change Advisory Board and wait for a unanimous vote before proceeding.

Answer

Reauthorize the system from scratch by conducting a full security assessment of all controls regardless of the change scope.

Question 5

You are the ISSE for a system that processes Controlled Unclassified Information. An engineer submits a change request to upgrade the operating system, and the change will alter the cryptographic module boundary described in the system security plan. Before the change is approved, what must occur?

Accepted Answer

Perform a security impact analysis and update the system security plan and associated security documentation before the change is approved.. When a change alters a security-relevant boundary such as the cryptographic module, the ISSE must ensure a security impact analysis is performed and the system security plan and related documentation are updated before approval. This maintains the accuracy and validity of the authorization package and ensures controls remain appropriate for the modified system.

Answer

Submit the change to the Change Advisory Board for a vote without performing a security impact analysis, since the CAB represents all stakeholders.

Answer

Approve the change immediately because operating system upgrades are routine maintenance and fall under the existing authorization.

Answer

Defer the change until the next annual security assessment so the impact can be evaluated together with other findings.

Question 6

An ISSEP is facilitating a risk assessment workshop for an Engineered System that controls a regional electrical substation. The system owner insists that the design is safe because every identified threat has an assigned countermeasure, and the residual risk register shows no entries above the organization's risk tolerance. Before the system can be accredited, the ISSEP must confirm that the risk management process has accounted for which of the following?

Accepted Answer

The aggregate effect of multiple low-severity residual risks interacting within the same trust boundary.. Residual risks that each fall below the stated tolerance can still produce unacceptable exposure when they share a trust boundary, a communication path, or a common failure mode. The ISSEP's duty in the risk management domain is to ensure the assessment addresses aggregate and cumulative risk before accreditation, not merely per-threat compliance or framework alignment.

Answer

That the Annualized Loss Expectancy for each threat has been recalculated using a Single Loss Expectancy derived from the replacement cost of the substation.

Answer

Whether each countermeasure was selected from a Common Criteria Protection Profile listed on the NIAP product compliant list.

Answer

That the system has been certified against the NIST Cybersecurity Framework version 2.0 before the Authorizing Official signs the accreditation decision.

Question 7

You are an ISSE at a financial institution. A critical security patch for a web application firewall (WAF) must be deployed to production. The change management policy requires that a rollback plan be documented and tested. The WAF configuration is managed via infrastructure-as-code (IaC) in a Git repository. Which approach best satisfies the rollback requirement while maintaining security?

Accepted Answer

Use Git to revert to the previous commit of the IaC repository and redeploy the WAF configuration.. The change management policy requires a documented and tested rollback plan. Using Git to revert to a previous commit of the IaC repository and redeploying provides an automated, repeatable, and tested rollback. This method ensures the exact previous configuration is restored, maintains an audit trail, and aligns with security best practices. It also allows the rollback to be rehearsed in a staging environment, satisfying the testing requirement.

Answer

Schedule the patch during a maintenance window and rely on the WAF vendor's support to revert if needed.

Answer

Apply the patch and monitor for issues; if problems arise, manually edit the WAF rules to fix them.

Answer

Store a backup of the WAF configuration file on a secure file share before applying the patch, and document the restore procedure.

Question 8

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where multiple nations will share data. The system owner asks which risk factors are MOST important to evaluate during the assessment. (Choose two.)

Accepted Answer

Differing national data protection and export control regulations that govern how shared data may be stored and transmitted.. Coalition environments introduce risk from divergent legal and regulatory frameworks as well as from inconsistent incident response capabilities. Data protection and export control laws determine lawful handling of shared information, while incident response variations affect how quickly and effectively a breach can be contained across partners. Both factors directly influence likelihood and impact of security events. UI branding, documentation translation, and typing speed are usability or ergonomic concerns that do not materially change the system's security risk profile.

Answer

The average keyboard typing speed of operators in each participating nation.

Answer

The physical color scheme and branding of the user interface used by each coalition partner.

Answer

The number of languages into which the system's help documentation has been translated.

Question 9

An organization is retiring a legacy application that stores personal data. The decommissioning plan must address data retention, media sanitization, and the removal of the application from the authorization boundary. Which activity must be completed before the system is removed from the authorization boundary?

Accepted Answer

Verify that all data has been migrated or retained according to the records retention schedule and that media sanitization is documented.. Removing a system from the authorization boundary requires assurance that data has been handled per the records retention schedule and that media sanitization is complete and documented. These steps protect personal data and satisfy compliance obligations before the boundary is formally changed.

Answer

Notify the user community that the application will be unavailable and provide a rollback plan in case the decommissioning fails.

Answer

Archive the application source code and database schema in the configuration management system for future reference.

Answer

Obtain a new authorization to operate for the remaining systems that shared the same network segment.

Question 10

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

Accepted Answer

Confirming the module holds a current FIPS 140-3 validation certificate at the required security level and reviewing the associated test evidence. The requirement has two parts: independent testing and tamper-resistant key protection. A FIPS 140-3 validation certificate from an accredited laboratory, matched to the correct module version and security level, is the standard evidence for both. Vendor documentation is self-attested, organization-run tests are not independent and do not assess physical security, and algorithm selection alone ignores key protection entirely. Reviewing the certificate and validation report therefore yields the most defensible verification result.

Answer

Running the organization's own known-answer tests and entropy assessments against the module

Answer

Verifying that the module uses only NIST-approved algorithms such as AES-256 and SHA-384

Answer

Reviewing the vendor's internal cryptographic design specification and algorithm test results

Question 11

An ISSEP is evaluating a proposed change to a system that will introduce a new external interface for partner data exchange. The change is scheduled for next week, and the program manager wants to skip a formal risk assessment to meet the deadline. Which action should the ISSEP take?

Accepted Answer

Perform an abbreviated risk assessment focused on the new interface, document the findings, and present them to the authorizing official for a decision.. When a change introduces a new external interface, a focused risk assessment of that change is appropriate and can be completed quickly. Documenting the findings and presenting them to the authorizing official preserves the decision-making process and provides an auditable record. This approach respects both the schedule and the need to manage risk, rather than skipping assessment or blocking the change entirely.

Answer

Approve the change without assessment because the schedule is tight and the interface is with a trusted partner.

Answer

Reject the change outright because no changes are permitted without a full system-level reassessment.

Answer

Defer the risk assessment until after the interface is deployed and operating, then assess based on real traffic.

Question 12

An ISSEP is reviewing the risk management framework for a defense program. The program uses a continuous monitoring strategy that includes automated vulnerability scanning and configuration compliance checks. A recent audit found that findings are being generated but not consistently reviewed or remediated within the program's defined timelines. Which action should the ISSEP recommend to address the ROOT cause?

Accepted Answer

Establish and enforce a formal risk management process with defined roles, review cadences, and escalation paths for continuous monitoring findings.. The audit finding describes a process failure: findings are generated but not consistently reviewed or remediated. The root cause is the absence of defined accountability, review cadence, and escalation. Increasing scan frequency, changing tools, or reducing scope all address symptoms or workload rather than the governance gap. Establishing a formal risk management process with clear roles, scheduled reviews, and escalation paths creates the structure needed to ensure findings are acted upon within the program's timelines.

Answer

Reduce the scope of continuous monitoring to only critical vulnerabilities so that fewer findings require review.

Answer

Increase the frequency of automated vulnerability scans from weekly to daily to generate more complete data.

Answer

Replace the automated scanning tools with a different vendor's product that has better reporting dashboards.

Question 13

You are an ISSE for a healthcare provider. A legacy server that stored electronic protected health information (ePHI) is being decommissioned. The server's hard drives are encrypted with AES-256, and the encryption keys are managed by a hardware security module (HSM). The drives will be repurposed within the organization for non-sensitive data. According to NIST SP 800-88 Rev. 1, which sanitization method is most appropriate to render the ePHI unrecoverable while allowing drive reuse?

Accepted Answer

Purge the drives by performing a cryptographic erase (crypto-erase) using the HSM to destroy the encryption keys.. Cryptographic erase is the most appropriate method because the drives are already encrypted and the keys can be securely destroyed via the HSM. This renders the ePHI unrecoverable while allowing the drives to be reused. NIST SP 800-88 Rev. 1 recognizes cryptographic erase as a Purge method, which is suitable for media that will be reused within the organization. It is efficient and meets the assurance level required for ePHI.

Answer

Physically destroy the drives by shredding them into 2 mm particles.

Answer

Clear the drives by overwriting with a single pass of zeros.

Answer

Degauss the drives to remove all data and then reuse them.

Question 14

An ISSEP is establishing a risk management process for a new Engineered System that will process controlled unclassified information. The program office wants to ensure that risk decisions are defensible and repeatable across the system lifecycle. Which TWO activities are essential to achieving that outcome? (Choose two.)

Accepted Answer

Defining explicit risk acceptance criteria and the authority levels empowered to accept each category of risk.. Defensible and repeatable risk management depends on pre-established acceptance criteria with clear authority, and on a risk register that is actively maintained as the system and its environment evolve. Together these provide consistency across decisions and traceability over time, which are the properties oversight bodies expect from a lifecycle risk process.

Answer

Using only qualitative risk ratings so that numeric precision cannot be challenged during oversight reviews.

Answer

Requiring every risk to be mitigated to zero before the system receives an Authority to Operate.

Answer

Delegating all risk decisions to the system owner to accelerate the accreditation timeline.

Question 15

An ISSEP is reviewing the risk analysis for an Engineered System that relies on a commercial cloud provider for data storage. The analysis lists provider-side outages as the only supply chain risk. The ISSEP knows the provider uses subcontractors for data center operations and hardware maintenance. Which deficiency in the analysis should the ISSEP address first?

Accepted Answer

The analysis fails to consider dependencies introduced by the provider's subcontractors and the associated visibility and control gaps.. Supply chain risk in cloud environments includes subcontractors and their access to systems, facilities, and data. An analysis that stops at prime provider outages misses fourth-party dependencies, so the ISSEP should first expand the scope to identify and evaluate those relationships, their visibility constraints, and the controls that apply to them.

Answer

The analysis needs to add a business impact analysis that maps outage duration to revenue loss for each business unit.

Answer

The analysis should replace qualitative outage ratings with quantitative availability metrics from the provider's service level agreement.

Answer

The analysis should be recalculated using the provider's annual certification reports as evidence that supply chain risk is managed.

Question 16

An ISSEP is drafting the security architecture for a new federal financial system. The system will process moderate-impact data and must follow the NIST Risk Management Framework (RMF). The system owner asks which document provides the initial allocation of security controls to the system based on the security categorization. Which document should the ISSEP reference?

Accepted Answer

Control baseline from NIST SP 800-53B. The RMF Select step begins with a control baseline from NIST SP 800-53B based on the system's security categorization. For a moderate-impact system, the moderate baseline is the starting point. The ISSEP then tailors the baseline by applying scoping guidance, compensating controls, and organization-defined parameters. The SSP, SAR, and POA&M are later artifacts that document implementation, assessment, and remediation, not the initial allocation.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Question 17

An ISSEP is leading the security engineering effort for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to ensure that the system's security requirements are derived from a formal threat model and that the design mitigates identified threats before development begins. Which activity should the ISSEP perform FIRST to integrate security into the early stages of the system development life cycle?

Accepted Answer

Perform a threat modeling exercise using a methodology such as STRIDE.. Threat modeling is a proactive security engineering activity that identifies threats and informs security requirements early in the SDLC. By using a methodology like STRIDE, the ISSEP can analyze data flows and trust boundaries, then derive specific mitigations. This ensures the system's design addresses threats before development, which is more effective and cost-efficient than retrofitting controls later.

Answer

Conduct a vulnerability assessment on the proposed system architecture.

Answer

Implement a continuous monitoring strategy using automated tools.

Answer

Develop a security assessment plan for the system's authorization package.

Question 18

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

Accepted Answer

Implementing a cloud security posture management (CSPM) tool that continuously monitors for configuration drift.. CSPM tools are designed to continuously monitor cloud environments for configuration drift and compliance with security baselines. They automatically assess resources against policies and provide alerts, enabling real-time verification. This is essential for maintaining a secure cloud posture, especially in dynamic environments where changes occur frequently. Manual reviews, vulnerability scans, and penetration tests are point-in-time activities that do not provide continuous assurance, making CSPM the best choice for this scenario.

Answer

Conducting a penetration test after each deployment.

Answer

Periodic vulnerability scans of the cloud environment.

Answer

Manual review of the IaC templates before deployment.

Question 19

An ISSEP is designing a secure network architecture for a defense contractor that must comply with NIST SP 800-171. The system will handle CUI and requires protection against advanced persistent threats (APTs). The ISSEP proposes using a demilitarized zone (DMZ) with firewalls and intrusion detection systems. Which additional architectural control is most critical to satisfy the NIST SP 800-171 requirement for boundary protection?

Accepted Answer

Establish controlled interfaces at all external and internal boundaries, including subnetworks for publicly accessible components.. NIST SP 800-171 requirement 3.13.1 mandates monitoring, controlling, and protecting communications at external and key internal boundaries. It also requires subnetworks for publicly accessible components. Establishing controlled interfaces at all boundaries directly satisfies this by filtering and inspecting traffic, limiting connections to essential services, and segmenting public-facing components from internal networks. This is the most critical architectural control for boundary protection.

Answer

Deploy a web application firewall (WAF) at the internet boundary to inspect HTTP traffic.

Answer

Implement a screened subnet with stateful firewalls and a proxy for all outbound traffic.

Answer

Encrypt all data in transit using TLS 1.3 between all internal and external endpoints.

Question 20

An ISSEP is drafting the initial security documentation for a new federal payroll system before any controls have been implemented. The authorizing official wants a document that records the system boundary, the security categorization, and the security controls selected from NIST SP 800-53 Rev. 5, and that will serve as the primary artifact supporting the authorization decision throughout the RMF. Which document should the ISSEP produce?

Accepted Answer

System Security Plan (SSP). The System Security Plan is the central RMF artifact that describes the system boundary, the FIPS 199 security categorization, the tailored NIST SP 800-53 Rev. 5 control baseline, and the implementation status of each control. The authorizing official relies on it together with the SAR and POA&M to accept risk, and it must be maintained current across the system lifecycle.

Answer

Security Assessment Report (SAR)

Answer

Information System Contingency Plan (ISCP)

Answer

Plan of Action and Milestones (POA&M)