ISC Practice Test 8 — 10 Questions

Question 1

An ISSEP is designing a cross-domain solution (CDS) to allow data transfer between a high-assurance network and a low-assurance network. The solution must enforce a strict one-way flow of data and prevent any possibility of a covert channel back to the high side. Which architectural approach BEST satisfies this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A data diode that physically enforces unidirectional data flow.. A data diode provides a hardware-enforced one-way data path, making it impossible for data to flow from the low side back to the high side. This eliminates covert channels through the transfer mechanism itself. Other solutions like firewalls, VPNs, or proxies are software- or configuration-based and remain bidirectional in principle, so they cannot guarantee the strict unidirectional requirement for a high-assurance CDS.

Answer

A VPN tunnel with IPsec in transport mode between the two networks.

Answer

A dual-homed firewall with stateful inspection and strict ACLs.

Answer

A proxy server that inspects and filters application-layer data.

Question 2

An ISSE is reviewing a system architecture where the design team plans to mitigate a spoofing threat to an external interface by adding a digital signature to each message. During the design review, the ISSE notes that the signing key is stored in plaintext in the same configuration file as the application. Which security engineering principle is most directly violated by this design decision?

Accepted Answer

Cryptographic key management. Digital signatures only provide authenticity and integrity if the private signing key remains secret. Placing that key in plaintext in a configuration file exposes it to anyone with file read access, allowing message forgery and defeating the control. Proper cryptographic key management demands that keys be stored in protected locations such as hardware security modules or encrypted keystores, separate from application code and configuration.

Answer

Separation of duties

Answer

Least common mechanism

Answer

Defense in depth

Question 3

An ISSEP is leading the security engineering effort for a new cloud-based system that will process sensitive but unclassified information. The system must comply with FedRAMP Moderate baseline. The ISSEP is selecting security controls from NIST SP 800-53 Rev. 5. Which TWO controls are most appropriate to address the risk of unauthorized access to data at rest in the cloud environment? (Choose two.)

Accepted Answer

SC-28 Protection of Information at Rest. SC-28 and SC-13 are the most appropriate controls because they directly address the protection of data at rest through cryptographic means. SC-28 mandates protection of information at rest, while SC-13 ensures the use of validated cryptographic modules. Together, they provide confidentiality and integrity for stored data in a cloud environment, meeting FedRAMP Moderate requirements. Other controls like account management, logging, and configuration settings are supportive but do not directly protect data at rest.

Answer

AC-2 Account Management

Answer

CM-6 Configuration Settings

Answer

AU-2 Event Logging

Question 4

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

Accepted Answer

Execute test traffic that attempts each authorized and unauthorized flow across the boundary and observe the device's mediation decisions.. Verification of information flow enforcement requires observing the mechanism in action. Crafted test traffic exercises both permitted and denied paths, exposing rule ordering errors, shadowed rules, and protocol-based bypasses that a documentation review would miss. This dynamic evidence directly ties observed mediation decisions to the approved policy, making it the most defensible proof of correct implementation.

Answer

Confirm that the device firmware is at the vendor-recommended baseline version and that administrative access uses multifactor authentication.

Answer

Collect and review the device's audit logs for the previous 90 days to identify any anomalous traffic patterns.

Answer

Review the device's rule set against the approved information flow policy and confirm that every rule maps to an authorized flow.

Question 5

An ISSEP is designing a secure architecture for a system that will use a cloud-based service. The system must comply with the NIST Risk Management Framework (RMF) and the organization's security policy. The ISSEP must ensure that the cloud provider's security controls are assessed and that the organization retains the ability to authorize the system. Which approach best meets these requirements?

Accepted Answer

Use the cloud provider's FedRAMP authorization package to inherit controls, and then assess and authorize the organization's system using the RMF process.. The organization should use the cloud provider's FedRAMP authorization to inherit controls, then assess the controls it implements and authorize its own system. This leverages existing assessments, avoids duplication, and ensures the organization retains authorization authority. Relying solely on FedRAMP, conducting a redundant assessment, or transferring all responsibilities are incorrect because they either miss organizational responsibilities or duplicate efforts.

Answer

Transfer all security responsibilities to the cloud provider and rely on their continuous monitoring.

Answer

Rely solely on the cloud provider's FedRAMP authorization and accept the system as is.

Answer

Conduct a separate assessment of the cloud provider's controls and issue a new authorization to operate (ATO) for the system.

Question 6

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

Accepted Answer

Security requirements identified early can be allocated to system components and traced through design, reducing costly rework later.. Systems security engineering is most effective when it begins with concept and requirements definition, because security requirements can then be derived, allocated, and traced through the lifecycle. This early allocation lets designers build controls into the architecture instead of retrofitting them, which reduces cost and schedule risk. The other statements either overstate what early involvement guarantees or misdescribe the purpose of early security work.

Answer

Starting early guarantees that the system will be certified and accredited without any residual risk.

Answer

Early involvement allows the ISSE to defer all security control selection until the operations and maintenance phase.

Answer

Early security engineering eliminates the need for security testing because threats are addressed during requirements analysis.

Question 7

During the security architecture review of a new identity management system, the ISSEP must choose an authentication protocol that supports native single sign-on across organizational boundaries and carries signed assertions about the user so relying parties can make authorization decisions without contacting the identity provider on every request. Which protocol best meets these requirements?

Accepted Answer

SAML 2.0. SAML 2.0 was built for federated identity: the identity provider issues signed assertions that a service provider validates and uses locally. That lets relying parties make authorization decisions from the assertion content without a live call to the identity provider, and it works across organizational boundaries. Kerberos, RADIUS, and LDAP solve different authentication or directory problems.

Answer

RADIUS with EAP-TLS

Answer

LDAPv3 with StartTLS

Answer

Kerberos 5 with cross-realm trusts

Question 8

An ISSEP is reviewing the supply chain risk for a system that will embed a commercial off-the-shelf cryptographic module. The program requires assurance that the module's cryptographic functions were independently tested against a published standard and that the module's security features are documented against a recognized protection profile. Which artifact should the ISSEP require from the vendor?

Accepted Answer

A Common Criteria certificate with a validated Protection Profile for the module. Common Criteria evaluation by an accredited laboratory against a validated Protection Profile provides the independent, standard-based assurance the program requires. The certificate confirms the module's security functions were tested and its features documented against recognized criteria. Vendor self-attestation, ISO/IEC 27001, and SOC 2 reports address the vendor or its management system, not the module's evaluated security functionality.

Answer

An ISO/IEC 27001 certificate covering the vendor's development facility

Answer

A vendor self-attestation letter confirming FIPS 140-3 compliance

Answer

A SOC 2 Type II report on the vendor's production environment

Question 9

A financial services firm runs a three-tier web application on-premises. The security team must apply an emergency patch to the TLS library on all web servers because of an actively exploited vulnerability. The change management policy requires an emergency change process, but the firm's regulator mandates that production changes be traceable and approved by someone other than the implementer. Which sequence best satisfies both the emergency response need and the regulatory requirement?

Accepted Answer

Convene the Emergency Change Advisory Board (ECAB), obtain approval from a designated approver who is not the implementer, apply the patch, and document the outcome.. An emergency change still requires independent approval to meet the regulator's separation-of-duties mandate. The ECAB provides a fast-track approval path, and having a different person authorize the patch preserves the control while enabling rapid response. Applying the patch first or combining roles would violate the regulatory requirement, and waiting for the regular CAB would leave the exploited vulnerability unmitigated. Documenting the outcome completes the traceability chain.

Answer

Apply the patch immediately to all servers, then document the change and obtain retroactive approval from the change manager within 24 hours.

Answer

Have the security team lead both approve and apply the patch to shorten the response time, then notify the change manager afterward.

Answer

Wait for the next scheduled Change Advisory Board meeting to obtain approval, then apply the patch during the standard maintenance window.

Question 10

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

Accepted Answer

Bell-LaPadula model. The requirement is a mandatory confidentiality flow control across sensitivity labels, which is the defining purpose of the Bell-LaPadula model. Its simple security property blocks reading above one's clearance, and its star property blocks writing below the object's classification. Together they ensure TOP SECRET data cannot reach UNCLASSIFIED subjects, satisfying the command-and-control system's multilevel security mandate.

Answer

Brewer-Nash (Chinese Wall) model

Answer

Clark-Wilson integrity model

Answer

Biba integrity model