ISC Practice Test 7 — 10 Questions

Question 1

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

Accepted Answer

Verify the module is on the NIST CMVP validated list.. The cryptographic module must be explicitly listed on the CMVP (Cryptographic Module Validation Program) validated list, not just 'based on' an algorithm.

Answer

Ensure the vendor claims the product is FIPS compliant.

Answer

Ensure the product is open source.

Answer

Verify the algorithms are AES-256.

Question 2

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

Accepted Answer

Configure API Gateway rate limiting policies per user or per IP.. Implementing API rate limiting at the API Gateway level prevents single clients from overwhelming the backend services.

Answer

Require an API key for every request.

Answer

Load balance the API across more servers.

Answer

Use a custom header to validate the request source.

Question 3

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

Accepted Answer

It serves as the contract between the vendor and the evaluator. The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.

Answer

It replaces the need for a threat model

Answer

It is a marketing document for end users

Answer

It defines the operating system kernel

Question 4

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

Accepted Answer

Use Cloud HSM to store keys and keep raw PII in an on-premises database.. Data at rest is kept on-premises in a sovereign zone, while ephemeral processing is performed in the cloud, utilizing encryption with customer-managed keys (CMK) stored on-premises to ensure control.

Answer

Implement a full database mirror in the cloud without encryption.

Answer

Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.

Answer

Use public cloud object storage and rely on IP whitelisting.

Question 5

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Accepted Answer

Statement of Applicability (SoA).. The Statement of Applicability (SoA) is the required document in ISO 27001 that outlines which controls are applicable and provides justifications for those that are excluded.

Answer

Risk Assessment Report (RAR).

Answer

System Security Plan (SSP).

Answer

Business Impact Analysis (BIA).

Question 6

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

Accepted Answer

The IdP must digitally sign the SAML assertion.. SAML assertions must be digitally signed by the Identity Provider (IdP) to ensure integrity and authenticity.

Answer

Use a shared secret between the IdP and SP.

Answer

Use HTTPS with TLS 1.3 for transport.

Answer

The Service Provider must encrypt the assertion.

Question 7

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

Accepted Answer

POA&M (Plan of Action and Milestones).. The POA&M (Plan of Action and Milestones) is the document used to track security weaknesses and the progress of remediation efforts.

Answer

Risk Management Framework (RMF) Guide.

Answer

System Security Plan (SSP).

Answer

Security Assessment Report (SAR).

Question 8

Which TWO of the following are considered critical components of a Secure Software Development Life Cycle (SDLC)?

Accepted Answer

Threat Modeling.. Security requirements analysis and threat modeling are fundamental proactive steps in an SDLC.

Answer

Patching the OS of the build server.

Answer

Using a dark theme for the IDE.

Answer

Final penetration testing before release.

Question 9

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 10

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

Accepted Answer

PermitRootLogin. PermitRootLogin no is a standard hardening requirement for SSH.

Answer

PubkeyAuthentication

Answer

X11Forwarding

Answer

PasswordAuthentication