ISC Practice Test 6 — 10 Questions

Question 1

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.. Referencing the Security Group ID of the web tier within the inbound rules of the application tier's Security Group ensures only traffic from authorized instances is accepted, regardless of IP changes.

Answer

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Answer

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Answer

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.

Question 2

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 3

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Accepted Answer

nmap -p 80 <target_ip>. Nmap is a standard network scanning tool used to verify that specific ports are blocked or filtered.

Answer

nslookup <target_ip>

Answer

netstat -an

Answer

ipconfig /all

Question 4

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

Accepted Answer

Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.. Configuring specific SQL Injection (SQLi) and Cross-Site Scripting (XSS) rules that inspect request bodies and query parameters is the primary method for blocking injection attacks at the WAF.

Answer

Enable 'TLS Termination' to offload encryption.

Answer

Enable 'Geo-blocking' to restrict access to local users only.

Answer

Enable 'Rate Limiting' on all incoming traffic.

Question 5

What is the correct order of operations when handling a vulnerability in a production system according to the RMF?

Accepted Answer

Identify, Assess Risk, Remediate, Verify.. Identify (scan), analyze (risk), remediate, and verify (scan again).

Answer

Remediate, Identify, Assess Risk, Verify.

Answer

Identify, Remediate, Assess Risk, Authorize.

Answer

Authorize, Identify, Remediate, Verify.

Question 6

Which THREE of the following are recognized categories of security controls in NIST SP 800-53?

Accepted Answer

Operational.. The three control categories are Management, Operational, and Technical.

Answer

Physical.

Answer

Financial.

Question 7

Which THREE methods can be used to ensure high availability for a database in a secure architecture?

Accepted Answer

Multi-region deployment.. Active-passive failover, replication (read replicas), and multi-region deployment are the standard HA methods for databases.

Answer

Ignoring error logs.

Answer

Running the database on a single server.

Question 8

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

Accepted Answer

Integrity. Tampering threats target the Integrity aspect of the CIA triad by attempting to modify data or system configurations.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 9

Which type of change is typically excluded from a formal Change Advisory Board review process?

Accepted Answer

Standard changes. Standard changes are pre-authorized, low-risk, and routine, allowing them to bypass the full CAB review for efficiency.

Answer

Emergency changes

Answer

Security patches

Answer

Significant changes

Question 10

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

Accepted Answer

Authorization Code Flow with PKCE.. The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the industry-standard security best practice for mobile applications to prevent authorization code interception.

Answer

Client Credentials Flow.

Answer

Resource Owner Password Credentials Flow.

Answer

Implicit Flow.