ISC Exam Simulation — 125 Questions

Question 1

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 2

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized PII database creates a single aggregation point: one successful compromise (SQL injection, credential theft, misconfigured access) exposes the entire PII dataset at once. This violates the principle of minimizing blast radius and is the primary architectural risk, which is why regulations like GDPR and CCPA push for data minimization, segmentation, and encryption. The other options describe operational concerns, not the core security risk of centralization.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 3

An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?

Accepted Answer

Implement the change under emergency change procedures with the security impact documented and a post-implementation review scheduled.. An emergency change to audit logging must proceed quickly but cannot bypass accountability. Using the emergency change procedure with documented security impact and a scheduled post-implementation review lets the change take effect within the four-hour window while ensuring the reduced logging is evaluated, compensated, and formally accepted or rolled back.

Answer

Deny the change because audit logging modifications always require full board approval.

Answer

Reduce log volume by filtering events at the collection tier instead of changing the source configuration.

Answer

Implement the change immediately and document it after the peak period ends.

Question 4

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.

Question 5

What is the primary risk of a 'Privileged User' who lacks proper oversight?

Accepted Answer

They can bypass security controls and abuse access. Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.

Answer

They will slow down system performance

Answer

They cannot do their job

Answer

They will always be hackers

Question 6

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Accepted Answer

Connect as an authorized user, inspect the assigned routes and the negotiated cipher, and confirm no local network access is permitted.. Validating policy enforcement requires observing real session behavior against each requirement. Establishing an authorized session and inspecting the routes, negotiated cipher, and local network reachability confirms group enforcement, absence of split tunneling, and AES-256 encryption simultaneously. Configuration review, authentication logs, and a single negative test each cover only part of the policy and cannot demonstrate full enforcement.

Answer

Check the concentrator's authentication logs to confirm that only 'Remote Users' group members have connected recently.

Answer

Review the VPN concentrator's configuration file to confirm the group, split tunneling, and encryption settings are present.

Answer

Attempt to connect as a user who is not in the 'Remote Users' group and confirm the connection is rejected.

Question 7

An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?

Accepted Answer

False Acceptance Rate (FAR). The risk of an unauthorized individual being granted access is quantified by the False Acceptance Rate (FAR). FAR directly measures the likelihood of a biometric false positive, which is a security concern. The ISSEP should use FAR to assess the risk and then determine if additional controls are needed. Other metrics like FRR and EER address different aspects and do not isolate the false acceptance risk.

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Question 8

An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?

Accepted Answer

System Security Plan (SSP). The System Security Plan is the RMF artifact that describes the system's authorization boundary, the selected security controls, and how each control is implemented. It accompanies the system through assessment and authorization and is the foundational document the Authorizing Official reviews. The SAR, POA&M, and ATO each serve distinct roles later in the process but do not substitute for the SSP.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

Authority to Operate (ATO) memorandum

Question 9

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

Accepted Answer

SCAP Compliance Checker (SCC). SCAP Compliance Checker (SCC) is specifically designed to automate the assessment of systems against Security Content Automation Protocol (SCAP) benchmarks, including DISA STIGs. It efficiently scans OS configurations, compares them to the STIG requirements, and generates detailed compliance reports. Unlike general-purpose tools, SCC directly consumes SCAP content, which is the standardized format for expressing STIG rules, making it the most efficient and accurate tool for this task.

Answer

Wireshark

Answer

Microsoft Baseline Security Analyzer (MBSA)

Answer

Nmap

Question 10

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

Accepted Answer

To prevent unauthorized code injection. Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

Answer

To simplify the audit process

Answer

To reduce operational costs

Answer

To increase server performance

Question 11

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 12

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

Accepted Answer

Revoke all certificates and credentials associated with the system.. Secure decommissioning requires sanitizing storage media to prevent data remanence and revoking credentials to eliminate access. These actions address the two primary risks: residual data and lingering trust. Updating disaster recovery plans, scanning for vulnerabilities, or archiving data are not essential for secure disposal and may even conflict with the objective.

Answer

Update the disaster recovery plan to remove the system.

Answer

Conduct a vulnerability scan of the system before decommissioning.

Answer

Back up all data to a long-term archive for potential future use.

Question 13

An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?

Accepted Answer

Escalate the finding to the Authorizing Official with an assessment of the risk and recommended alternatives, since risk acceptance authority rests with that official.. Accepting risk to an accredited system is the Authorizing Official's prerogative. The ISSEP's proper contribution is a clear risk analysis and escalation with alternatives, preserving both the technical record and the formal accountability chain. Unilateral action or informal acceptance would bypass the authorization framework that governs classified systems.

Answer

Direct the operations team to encrypt the tapes immediately and update the security plan, since the ISSEP has authority over security configuration of accredited systems.

Answer

Document the risk acceptance in the plan of action and milestones and allow the system owner to proceed without further action.

Answer

Perform a new quantitative risk assessment to calculate the Annualized Loss Expectancy of tape loss and let the resulting dollar value determine whether the risk is acceptable.

Question 14

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

Accepted Answer

X-Frame-Options: DENY or SAMEORIGIN.. The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.

Answer

X-Content-Type-Options: nosniff.

Answer

Strict-Transport-Security: max-age=63072000.

Answer

X-XSS-Protection: 1; mode=block.

Question 15

An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?

Accepted Answer

Continuously monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official.. Continuous monitoring under RMF is an ongoing process of monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official. This enables timely risk-based decisions and maintains the authorization. Periodic activities like full assessments or penetration tests are supporting elements, not the primary focus.

Answer

Performing an annual penetration test to identify new vulnerabilities.

Answer

Updating the system security plan (SSP) only when a major change occurs.

Answer

Conducting a full security assessment every three years to renew the ATO.

Question 16

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

Accepted Answer

Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.. In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.

Answer

Accept the risk because the API is internal-facing.

Answer

Disable the API entirely.

Answer

Monitor API logs for suspicious activity.

Question 17

An ISSEP is tasked with ensuring that a new information system complies with the organization's security requirements. The system will be deployed in a cloud environment and will process sensitive but unclassified data. The ISSEP must select an appropriate set of security controls and tailor them to the cloud deployment. Which NIST publication provides the security control catalog and guidance for tailoring controls?

Accepted Answer

NIST SP 800-53. NIST SP 800-53 is the authoritative catalog of security and privacy controls, and it includes detailed guidance on tailoring controls to specific environments, including cloud deployments. It allows the ISSEP to select controls based on the system's categorization and apply scoping and parameterization. Other publications like SP 800-37 describe the RMF process but do not contain the control catalog itself.

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Answer

NIST SP 800-145

Question 18

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

Accepted Answer

Requirements Analysis. In the Systems Engineering V-Model, the left side represents decomposition and definition phases. Requirements Analysis is the stage where stakeholder needs are translated into system-level requirements, including security functional requirements. Defining security requirements here ensures they are allocated to the system architecture and can be traced through design, implementation, and testing. This early definition is critical for traceability and for avoiding costly rework later.

Answer

Detailed Design

Answer

System Integration and Testing

Answer

Operational Maintenance

Question 19

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

Accepted Answer

The sensor firmware is not signed.. Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.

Answer

The sensor housing is not tamper-evident.

Answer

The sensors use an older version of Bluetooth.

Answer

The vendor does not provide a Service Level Agreement (SLA).

Question 20

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

Accepted Answer

Real-time incident detection. Option A (Real-time incident detection) is correct because ConMon depends on continuous telemetry and alerting (e.g., SIEM correlation, IDS/IPS, EDR) to identify threats as they occur rather than at a point-in-time assessment. Option D (Established incident response procedures) is correct because detection has value only when paired with documented, tested IR playbooks that define triage, escalation, containment, eradication, and recovery actions. Option E (Automated security control status monitoring) is correct because ConMon, per NIST SP 800-137, requires ongoing automated assessment of control effectiveness (e.g., SCAP, continuous diagnostics and mitigation) to maintain an accurate, near-real-time authorization posture. Option B (Quarterly hardware refresh) is not a ConMon factor—hardware lifecycle management is a separate asset management concern and does not provide continuous visibility into security control status or incidents. Option C (Manual annual log review) is not appropriate because annual, manual review is periodic and retrospective, contradicting the continuous, automated nature of an effective ConMon program.

Answer

Quarterly hardware refresh

Answer

Manual annual log review