ISC Practice Test 9 — 10 Questions

Question 1

An ISSEP is planning the security architecture for a system that will be operated in a facility shared with other tenants. The design must protect against an attacker who gains physical access to the shared space and attempts to capture electromagnetic emanations from the system's displays and cables. Which countermeasure should the ISSEP specify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the system inside a TEMPEST-approved shielded enclosure with filtered power and signal lines. Compromising emanations are a physical-layer threat, so the countermeasure must operate at that layer. A TEMPEST-approved shielded enclosure with filtered power and signal lines contains emissions and keeps them out of the shared space. Encryption, mandatory access control, and network monitoring address different layers and cannot stop an attacker from capturing radiated signals.

Answer

Install an intrusion detection system monitoring the shared facility network segment

Answer

Enforce mandatory access control with SELinux on all system hosts

Answer

Encrypt all data at rest using AES-256 with keys stored in a hardware security module

Question 2

An ISSE is defining the protection profile for a new multi-level secure system that must enforce the Bell-LaPadula model. The design team asks which rules must be enforced to prevent unauthorized disclosure of classified information. (Choose two.)

Accepted Answer

The simple security property: a subject at a given security level may not read an object at a higher security level.. Bell-LaPadula is a confidentiality model whose two mandatory rules are the simple security property, which forbids reading up, and the star property, which forbids writing down. Together these rules prevent a subject from accessing higher-classified data and from leaking it to lower levels. The other options describe supporting concepts or a different model entirely, so they do not satisfy the requirement to prevent unauthorized disclosure.

Answer

The tranquility principle: security labels may not be changed while the system is processing data.

Answer

The weak tranquility principle: subjects may change their security level only after re-authentication.

Answer

The Biba integrity property: a subject may not read an object at a lower integrity level.

Question 3

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

Accepted Answer

Run an automated configuration compliance scan against the baseline on a recurring schedule and review deviations.. Ongoing configuration verification depends on repeated, objective comparison of actual settings against the approved baseline. Scheduled automated compliance scans detect drift promptly, produce auditable evidence, and trigger remediation. This approach satisfies the continuous monitoring intent of configuration management controls and is far more reliable than snapshots, attestations, or ticket reviews for confirming sustained adherence.

Answer

Require administrators to sign an attestation stating that they have not modified any server settings since implementation.

Answer

Review the change management ticketing system to confirm that every modification has an approved change request.

Answer

Capture a one-time snapshot of each server's configuration files and archive it with the acceptance documentation.

Question 4

An ISSEP is designing a cross-domain solution (CDS) to allow a high-assurance system to transfer data to a low-assurance system. The CDS must enforce data flow policies and prevent leakage of sensitive information. Which security engineering approach should the ISSEP implement to meet these requirements?

Accepted Answer

Use a guard that enforces a predefined security policy and performs data sanitization and format checking. A guard is a specialized component in a cross-domain solution that enforces security policies, performs data sanitization, and validates formats to ensure that only authorized data crosses the domain boundary. It operates on a trusted path and can implement rules based on classification, releasability, and content. This approach directly addresses the need to enforce data flow policies and prevent leakage of sensitive information.

Answer

Deploy a one-way data diode that physically prevents any data from flowing back to the high-assurance system

Answer

Implement a content filter that inspects data for malicious code and sensitive keywords before transfer

Answer

Establish a virtual private network (VPN) tunnel between the two systems to encrypt data in transit

Question 5

During a security architecture review, the ISSE must evaluate the system's ability to enforce the *-property (no write down) as defined in the Bell-LaPadula model. The system currently allows a process at the Secret level to write to an object at the Unclassified level. Which design change should the ISSE recommend to satisfy the *-property?

Accepted Answer

Enforce a mandatory access control policy that prevents subjects from writing to objects at a lower sensitivity level.. The *-property, or no-write-down rule, is a core Bell-LaPadula requirement that prevents subjects at a higher sensitivity level from writing to objects at a lower level. Enforcing mandatory access control that blocks such writes directly satisfies this property. This protects confidentiality by preventing high-level information from leaking to lower levels, even if the subject is malicious.

Answer

Apply the simple security property by restricting read access to objects at the same or lower level.

Answer

Implement the Biba integrity model to prevent unauthorized modification of low-integrity data.

Answer

Implement a trusted process that can temporarily downgrade the classification of the object.

Question 6

During early requirements definition for a new mission system, stakeholders agree that the system must remain effective even if several individual components are compromised. The ISSE must select a design principle that best supports this objective while keeping the architecture affordable. Which principle should be applied?

Accepted Answer

Defense in depth, layering independent protective mechanisms across the architecture.. Defense in depth layers independent controls so no single compromise yields full access, directly supporting the requirement that the system remain effective when multiple components are lost. It also permits incremental investment, which helps with affordability. The other principles either centralize risk, depend on secrecy, or trade away protection for availability.

Answer

Single point of enforcement, where all security decisions are made by one hardened component.

Answer

Security through obscurity, hiding internal design details from potential adversaries.

Answer

Fail-open behavior, ensuring availability by bypassing controls when components fail.

Question 7

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

Accepted Answer

Security through obscurity. Security through obscurity is the flawed practice of relying on secrecy of design or implementation as the main protection. In this scenario, the system assumes attackers will not discover the proprietary protocol, so the security would collapse if that assumption fails. Sound systems security engineering instead demands that security be based on robust, verifiable mechanisms that do not depend on adversary ignorance.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 8

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

Accepted Answer

Document the finding as a non-compliance and initiate the risk management process to assess the impact and determine remediation options.. When validation reveals a cryptographic module lacks FIPS 140-3 validation, the immediate step is to document the non-compliance and initiate risk management. This aligns with ISSEP principles of traceability and structured risk handling. Replacement or acceptance without assessment bypasses governance, while penetration testing addresses a different concern. The correct approach ensures the deviation is formally recorded and evaluated for impact and remediation.

Answer

Immediately replace the database encryption module with a FIPS 140-3 validated alternative without further analysis.

Answer

Accept the risk because AES-256 is cryptographically strong regardless of FIPS validation status.

Answer

Conduct a penetration test to see if the non-validated module can be exploited before taking any other action.

Question 9

A retail company is replacing its point-of-sale (POS) terminals with new models that support tokenization. The old terminals store encrypted card data locally and are leased from a payment processor. The security policy requires that all storage media be sanitized before leaving the company's control. Which action should the security engineer take before returning the leased terminals?

Accepted Answer

Sanitize the local storage in each terminal according to the payment processor's approved method, then obtain a certificate of sanitization before returning the devices.. Leased POS terminals containing encrypted card data must be sanitized using the lessor's approved method before they leave the company's control. A certificate of sanitization provides the evidence needed for both the lease agreement and the security policy. Factory resets, media removal, or additional encryption do not reliably eliminate the stored data, so they fail to satisfy the disposal requirement.

Answer

Remove the storage media from each terminal and retain them in the company's evidence locker for future investigations.

Answer

Encrypt the local storage with a new key and return the terminals, relying on the encryption to protect the old card data.

Answer

Perform a factory reset on each terminal and confirm that the device prompts for setup on the next boot before returning it.

Question 10

During a security architecture review, an ISSE observes that the design separates the trusted computing base into distinct, isolated modules with explicit interfaces, and that no module can access another's internal data structures directly. Which design principle is primarily being applied to limit the propagation of a compromise?

Accepted Answer

Encapsulation and modularity. Encapsulation and modularity partition the trusted computing base into isolated components that interact only through explicit interfaces. This structure limits the blast radius of a compromise because a faulty or subverted module cannot directly manipulate another module's internal state, which is exactly the propagation-limiting property the ISSE observed.

Answer

Least common mechanism

Answer

Complete mediation

Answer

Fail-safe defaults