ISC Practice Test 6 — 10 Questions

Question 1

An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Determining the potential adverse impacts to organizational operations, assets, and individuals. A system-level risk assessment must identify relevant threat sources and events and determine the potential adverse impacts on organizational operations, assets, and individuals. These two activities establish the likelihood and consequence dimensions the Authorizing Official needs. Product selection, exhaustive quantitative loss calculations, and premature authorization signatures are not essential components of the assessment itself.

Answer

Calculating the annualized loss expectancy for every asset in the enterprise enclave

Answer

Selecting the specific commercial product that will implement the cross-domain guard

Answer

Obtaining the Authorizing Official's signature on the Authority to Operate before beginning analysis

Question 2

An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?

Accepted Answer

The integrity of data before it is written to the blockchain may be compromised.. The most significant residual risk is that data integrity can be compromised before it is written to the blockchain. Blockchain provides immutability and tamper-evidence for data after it is recorded, but it cannot verify the truthfulness of the input. If an attacker can manipulate the logging source, false entries become permanently stored. Thus, the ISSEP should emphasize controls at the data origin.

Answer

The blockchain's cryptographic hash functions may be broken in the future.

Answer

The audit logs may become too large to store on the blockchain.

Answer

The blockchain's consensus algorithm may be vulnerable to a 51% attack.

Question 3

An ISSEP is integrating a commercial off-the-shelf (COTS) component into a system that will process Controlled Unclassified Information (CUI). The vendor provides a self-signed statement of conformity but no independent assessment. The program needs to characterize the supply chain risk before the component enters the authorization boundary. Which approach best supports an informed supply chain risk determination?

Accepted Answer

Obtain independent third-party assessment artifacts and software bill of materials (SBOM) data, then analyze them against the program's supply chain risk criteria.. A self-signed statement of conformity is an unverified assertion, so the program needs objective evidence. Independent third-party assessment artifacts plus SBOM data expose provenance, dependencies, and known weaknesses, allowing the ISSEP to evaluate the component against defined supply chain criteria. This produces a defensible risk characterization before the component crosses the authorization boundary, which is the point at which the decision must be informed.

Answer

Defer the supply chain risk assessment until after authorization, relying on continuous monitoring to detect component issues in production.

Answer

Require the vendor to complete a security questionnaire and map the responses to the organization's supply chain risk controls.

Answer

Accept the vendor's statement of conformity at face value because COTS products are outside the program's configuration control.

Question 4

You are the ISSE reviewing a change management process for a system that supports a continuous authorization approach. The process must ensure that security-relevant changes are identified and handled appropriately. Which TWO activities are required to maintain the authorization when a security-relevant change occurs? (Choose two.)

Accepted Answer

Perform a security impact analysis to determine whether the change affects the security posture or the controls in the authorization package.. Maintaining an authorization during security-relevant change requires a security impact analysis to evaluate the effect on controls and risk, followed by updates to the system security plan and related documentation. These two activities keep the authorization package accurate and support the continuous authorization decision.

Answer

Notify all users of the change and obtain their written acknowledgment before implementing the change.

Answer

Submit the change to the Change Advisory Board and wait for a unanimous vote before proceeding.

Answer

Reauthorize the system from scratch by conducting a full security assessment of all controls regardless of the change scope.

Question 5

You are the ISSE for a system that processes Controlled Unclassified Information. An engineer submits a change request to upgrade the operating system, and the change will alter the cryptographic module boundary described in the system security plan. Before the change is approved, what must occur?

Accepted Answer

Perform a security impact analysis and update the system security plan and associated security documentation before the change is approved.. When a change alters a security-relevant boundary such as the cryptographic module, the ISSE must ensure a security impact analysis is performed and the system security plan and related documentation are updated before approval. This maintains the accuracy and validity of the authorization package and ensures controls remain appropriate for the modified system.

Answer

Submit the change to the Change Advisory Board for a vote without performing a security impact analysis, since the CAB represents all stakeholders.

Answer

Approve the change immediately because operating system upgrades are routine maintenance and fall under the existing authorization.

Answer

Defer the change until the next annual security assessment so the impact can be evaluated together with other findings.

Question 6

An ISSEP is facilitating a risk assessment workshop for an Engineered System that controls a regional electrical substation. The system owner insists that the design is safe because every identified threat has an assigned countermeasure, and the residual risk register shows no entries above the organization's risk tolerance. Before the system can be accredited, the ISSEP must confirm that the risk management process has accounted for which of the following?

Accepted Answer

The aggregate effect of multiple low-severity residual risks interacting within the same trust boundary.. Residual risks that each fall below the stated tolerance can still produce unacceptable exposure when they share a trust boundary, a communication path, or a common failure mode. The ISSEP's duty in the risk management domain is to ensure the assessment addresses aggregate and cumulative risk before accreditation, not merely per-threat compliance or framework alignment.

Answer

That the Annualized Loss Expectancy for each threat has been recalculated using a Single Loss Expectancy derived from the replacement cost of the substation.

Answer

Whether each countermeasure was selected from a Common Criteria Protection Profile listed on the NIAP product compliant list.

Answer

That the system has been certified against the NIST Cybersecurity Framework version 2.0 before the Authorizing Official signs the accreditation decision.

Question 7

You are an ISSE at a financial institution. A critical security patch for a web application firewall (WAF) must be deployed to production. The change management policy requires that a rollback plan be documented and tested. The WAF configuration is managed via infrastructure-as-code (IaC) in a Git repository. Which approach best satisfies the rollback requirement while maintaining security?

Accepted Answer

Use Git to revert to the previous commit of the IaC repository and redeploy the WAF configuration.. The change management policy requires a documented and tested rollback plan. Using Git to revert to a previous commit of the IaC repository and redeploying provides an automated, repeatable, and tested rollback. This method ensures the exact previous configuration is restored, maintains an audit trail, and aligns with security best practices. It also allows the rollback to be rehearsed in a staging environment, satisfying the testing requirement.

Answer

Schedule the patch during a maintenance window and rely on the WAF vendor's support to revert if needed.

Answer

Apply the patch and monitor for issues; if problems arise, manually edit the WAF rules to fix them.

Answer

Store a backup of the WAF configuration file on a secure file share before applying the patch, and document the restore procedure.

Question 8

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where multiple nations will share data. The system owner asks which risk factors are MOST important to evaluate during the assessment. (Choose two.)

Accepted Answer

Differing national data protection and export control regulations that govern how shared data may be stored and transmitted.. Coalition environments introduce risk from divergent legal and regulatory frameworks as well as from inconsistent incident response capabilities. Data protection and export control laws determine lawful handling of shared information, while incident response variations affect how quickly and effectively a breach can be contained across partners. Both factors directly influence likelihood and impact of security events. UI branding, documentation translation, and typing speed are usability or ergonomic concerns that do not materially change the system's security risk profile.

Answer

The average keyboard typing speed of operators in each participating nation.

Answer

The physical color scheme and branding of the user interface used by each coalition partner.

Answer

The number of languages into which the system's help documentation has been translated.

Question 9

An organization is retiring a legacy application that stores personal data. The decommissioning plan must address data retention, media sanitization, and the removal of the application from the authorization boundary. Which activity must be completed before the system is removed from the authorization boundary?

Accepted Answer

Verify that all data has been migrated or retained according to the records retention schedule and that media sanitization is documented.. Removing a system from the authorization boundary requires assurance that data has been handled per the records retention schedule and that media sanitization is complete and documented. These steps protect personal data and satisfy compliance obligations before the boundary is formally changed.

Answer

Notify the user community that the application will be unavailable and provide a rollback plan in case the decommissioning fails.

Answer

Archive the application source code and database schema in the configuration management system for future reference.

Answer

Obtain a new authorization to operate for the remaining systems that shared the same network segment.

Question 10

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

Accepted Answer

Confirming the module holds a current FIPS 140-3 validation certificate at the required security level and reviewing the associated test evidence. The requirement has two parts: independent testing and tamper-resistant key protection. A FIPS 140-3 validation certificate from an accredited laboratory, matched to the correct module version and security level, is the standard evidence for both. Vendor documentation is self-attested, organization-run tests are not independent and do not assess physical security, and algorithm selection alone ignores key protection entirely. Reviewing the certificate and validation report therefore yields the most defensible verification result.

Answer

Running the organization's own known-answer tests and entropy assessments against the module

Answer

Verifying that the module uses only NIST-approved algorithms such as AES-256 and SHA-384

Answer

Reviewing the vendor's internal cryptographic design specification and algorithm test results