ISC Hard Questions — 25 Difficult Questions

Question 1

During a validation exercise, you need to confirm that an application's logging mechanism is compliant with NIST SP 800-92. Which element must be verified?

Accepted Answer

Ensure every log entry contains a user ID, timestamp, and event outcome.. NIST SP 800-92 emphasizes that logs must include user IDs, timestamps, and success/failure status.

Answer

Check if logs are printed to the console.

Answer

Confirm that the logging level is set to 'DEBUG'.

Answer

Verify that all logs are stored in a database.

Question 2

An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?

Accepted Answer

Implement the change under emergency change procedures with the security impact documented and a post-implementation review scheduled.. An emergency change to audit logging must proceed quickly but cannot bypass accountability. Using the emergency change procedure with documented security impact and a scheduled post-implementation review lets the change take effect within the four-hour window while ensuring the reduced logging is evaluated, compensated, and formally accepted or rolled back.

Answer

Deny the change because audit logging modifications always require full board approval.

Answer

Reduce log volume by filtering events at the collection tier instead of changing the source configuration.

Answer

Implement the change immediately and document it after the peak period ends.

Question 3

An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?

Accepted Answer

False Acceptance Rate (FAR). The risk of an unauthorized individual being granted access is quantified by the False Acceptance Rate (FAR). FAR directly measures the likelihood of a biometric false positive, which is a security concern. The ISSEP should use FAR to assess the risk and then determine if additional controls are needed. Other metrics like FRR and EER address different aspects and do not isolate the false acceptance risk.

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Question 4

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

Accepted Answer

To prevent unauthorized code injection. Separation of duties prevents a single individual from introducing malicious code and deploying it into production, a critical control for integrity.

Answer

To simplify the audit process

Answer

To reduce operational costs

Answer

To increase server performance

Question 5

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 6

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

Accepted Answer

Revoke all certificates and credentials associated with the system.. Secure decommissioning requires sanitizing storage media to prevent data remanence and revoking credentials to eliminate access. These actions address the two primary risks: residual data and lingering trust. Updating disaster recovery plans, scanning for vulnerabilities, or archiving data are not essential for secure disposal and may even conflict with the objective.

Answer

Update the disaster recovery plan to remove the system.

Answer

Conduct a vulnerability scan of the system before decommissioning.

Answer

Back up all data to a long-term archive for potential future use.

Question 7

An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?

Accepted Answer

Escalate the finding to the Authorizing Official with an assessment of the risk and recommended alternatives, since risk acceptance authority rests with that official.. Accepting risk to an accredited system is the Authorizing Official's prerogative. The ISSEP's proper contribution is a clear risk analysis and escalation with alternatives, preserving both the technical record and the formal accountability chain. Unilateral action or informal acceptance would bypass the authorization framework that governs classified systems.

Answer

Direct the operations team to encrypt the tapes immediately and update the security plan, since the ISSEP has authority over security configuration of accredited systems.

Answer

Document the risk acceptance in the plan of action and milestones and allow the system owner to proceed without further action.

Answer

Perform a new quantitative risk assessment to calculate the Annualized Loss Expectancy of tape loss and let the resulting dollar value determine whether the risk is acceptable.

Question 8

An ISSEP is designing a secure network architecture for a system that must support remote users accessing sensitive data. The system owner has mandated the use of a VPN to protect data in transit. The ISSEP must select a VPN protocol that provides confidentiality, integrity, and mutual authentication. Which protocol should the ISSEP choose?

Accepted Answer

IPsec in tunnel mode with IKEv2. IPsec in tunnel mode with IKEv2 is the only option that provides all three required security services: confidentiality, integrity, and mutual authentication. IKEv2 supports strong authentication methods, including certificates and EAP, enabling mutual authentication. PPTP, L2TP without IPsec, and SSL/TLS VPN with only server-side certificates either lack encryption, integrity, or mutual authentication. Therefore, IPsec with IKEv2 is the correct protocol for this scenario.

Answer

L2TP without IPsec

Answer

PPTP with MS-CHAPv2

Answer

SSL/TLS VPN using only server-side certificates

Question 9

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 10

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Accepted Answer

Graceful degradation. Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.

Answer

Maximal feature set

Answer

Hardware redundancy only

Answer

Complete system lockdown upon error

Question 11

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

Accepted Answer

Destroy the HSM root CA private keys using the HSM's secure zeroization function and record the destruction in the decommissioning log.. Proper disposal of a legacy identity system requires destroying the root CA private keys to prevent forgery while preserving public certificates and revocation information so existing credentials remain verifiable. Retaining private keys or leaving the directory database intact creates unnecessary risk and violates data lifecycle requirements. The two required actions balance security with the operational need for trust continuity during the transition period.

Answer

Migrate the directory user attributes to the new identity system and then leave the legacy database intact for historical reference.

Answer

Archive the root CA private keys in an offline vault so they can be used to re-sign certificates if validation issues arise later.

Answer

Delete the directory database by dropping all tables and removing the database files from the storage array without further sanitization.

Question 12

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is designed for confidentiality in multi-level security systems. Its no-write-down rule, known as the *-property, ensures that subjects at higher sensitivity levels cannot write to objects at lower sensitivity levels. This directly satisfies the scenario's requirement to prevent a Top Secret subject from writing to a Secret object. The other models address integrity or generic access control, not MLS confidentiality.

Answer

Clark-Wilson model

Answer

Graham-Denning model

Answer

Biba integrity model

Question 13

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

Accepted Answer

SA-10 Developer Configuration Management. SA-10 Developer Configuration Management is part of the System and Services Acquisition family in NIST SP 800-53. It specifically addresses managing security-critical configuration changes during development and acquisition, ensuring that configurations are maintained and controlled.

Answer

AU-2 Audit Events

Answer

SC-8 Transmission Confidentiality

Answer

AC-3 Access Enforcement

Question 14

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 15

An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)

Accepted Answer

A defined process for analyzing monitoring data and escalating risk-relevant changes to the Authorizing Official.. Continuous risk monitoring requires both a reliable data feed and a governance loop. Automated collection mapped to the control baseline supplies objective, timely evidence about control effectiveness and system change, while a defined analysis and escalation process turns that data into decisions by the Authorizing Official. Together they keep the risk picture current between formal assessments. Periodic reauthorization, uniform exhaustive retesting, and standalone penetration tests are point-in-time activities that do not sustain ongoing awareness.

Answer

Periodic reauthorization of every subsystem by the Authorizing Official on a fixed annual schedule.

Answer

Replacing the system's security assessment with an annual penetration test performed by an external team.

Answer

Full re-testing of every security control in the baseline at the same frequency, regardless of risk or volatility.

Question 16

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Accepted Answer

Verify that 'Secure Boot' is set to 'Enabled' and the 'Platform Key' (PK) is installed.. Secure Boot validation requires confirming that the UEFI setting is Enabled and that a Platform Key (PK) is installed, because the PK anchors the trust chain that validates bootloader signatures. Without a PK, Secure Boot cannot enforce signature verification even if the toggle appears enabled. TPM version, Legacy Boot status, and NTP synchronization are related security controls but are not the components that prove Secure Boot is functioning.

Answer

Validate the TPM version is 2.0.

Answer

Check that 'Legacy Boot' is set to 'Disabled'.

Answer

Ensure the system clock is synchronized with a secure NTP server.

Question 17

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

Accepted Answer

An automated configuration baseline monitor that checks servers on a scheduled interval and alerts on drift. The requirement is about detection latency for unauthorized configuration changes. Only an automated baseline monitor running at least hourly compares live settings to the approved baseline and raises alerts, producing evidence that deviations are caught inside the one-hour window. Quarterly audits and weekly ticket reviews are too infrequent and inspect process records rather than server state. Narrowly scoped file integrity monitoring lacks the coverage of security-relevant settings, so it cannot satisfy the requirement either.

Answer

Reviewing the change management ticketing system for approved change requests each week

Answer

A quarterly manual configuration audit performed by the security team

Answer

File integrity monitoring configured to watch only the operating system kernel binaries

Question 18

An ISSEP is performing a risk assessment on a system that depends on a commercial cloud provider for infrastructure. The provider's shared responsibility model places physical security and hypervisor patching with the provider, while the ISSEP's organization retains responsibility for data classification, identity management, and application security. The Authorizing Official asks the ISSEP to formally capture which controls are inherited, shared, or customer-owned so that residual risk is not double-counted or overlooked. Which risk management activity best addresses this need?

Accepted Answer

Conducting a control inheritance and shared responsibility mapping as part of the system security plan. Control inheritance mapping is the risk management activity that documents which controls the cloud provider implements and assesses, which are shared, and which remain the customer's responsibility. This prevents double-counting of provider-assessed controls and ensures customer-owned controls receive full assessment. It is the artifact the Authorizing Official needs to judge residual risk accurately.

Answer

Performing an independent penetration test of the provider's hypervisor layer

Answer

Re-categorizing the system at a higher FIPS 199 impact level to reflect cloud exposure

Answer

Requesting a new Authority to Operate directly from the cloud provider's authorizing official

Question 19

An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)

Accepted Answer

Determining the potential adverse impacts to organizational operations, assets, and individuals. A system-level risk assessment must identify relevant threat sources and events and determine the potential adverse impacts on organizational operations, assets, and individuals. These two activities establish the likelihood and consequence dimensions the Authorizing Official needs. Product selection, exhaustive quantitative loss calculations, and premature authorization signatures are not essential components of the assessment itself.

Answer

Calculating the annualized loss expectancy for every asset in the enterprise enclave

Answer

Selecting the specific commercial product that will implement the cross-domain guard

Answer

Obtaining the Authorizing Official's signature on the Authority to Operate before beginning analysis

Question 20

An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?

Accepted Answer

The integrity of data before it is written to the blockchain may be compromised.. The most significant residual risk is that data integrity can be compromised before it is written to the blockchain. Blockchain provides immutability and tamper-evidence for data after it is recorded, but it cannot verify the truthfulness of the input. If an attacker can manipulate the logging source, false entries become permanently stored. Thus, the ISSEP should emphasize controls at the data origin.

Answer

The blockchain's cryptographic hash functions may be broken in the future.

Answer

The audit logs may become too large to store on the blockchain.

Answer

The blockchain's consensus algorithm may be vulnerable to a 51% attack.