ISC Hard Questions — 25 Difficult Questions

Question 1

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Perform a firmware update using the manufacturer's signed secure update process.. Firmware vulnerabilities involving the TPM and secure boot chain represent a fundamental compromise of the root of trust. Remediation must prioritize the update of the firmware to restore the integrity of the secure boot sequence.

Answer

Update the security policy to include manual verification of boot logs.

Answer

Configure an IDS to block unauthorized firmware update attempts.

Answer

Disable TPM-based secure boot until the vendor releases a patch.

Question 2

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.

Question 3

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 4

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 5

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 6

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 7

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Accepted Answer

Verification confirms the system meets specifications; Validation confirms it meets mission goals. Verification ensures the system is built correctly (conformance to requirements), while validation ensures the correct system is built (meeting user needs).

Answer

Verification is for security; Validation is for performance

Answer

Verification is done by vendors, Validation by end-users

Answer

Verification is for software, Validation is for hardware

Question 8

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 9

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

Answer

Formatting the partition

Answer

Degaussing

Question 10

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

Accepted Answer

Confirmation that no new vulnerabilities were introduced. A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

Answer

The total budget spent on the project

Answer

List of employees who didn't like the change

Question 11

In a cloud environment, you must ensure that VM snapshots are encrypted. What is the most effective approach?

Accepted Answer

Enable the provider-level setting to enforce encryption for all new snapshots.. Configuring the account-level setting to enforce encryption on all new snapshots ensures that no unencrypted snapshots can be created by users.

Answer

Run a script to encrypt snapshots after they are created.

Answer

Train users to check the 'encrypt' box when taking snapshots.

Answer

Use an external scanner to identify and delete unencrypted snapshots.

Question 12

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Accepted Answer

Add environmental sensors and hardened circuitry to detect and respond to fault injection attempts.. Fault injection (like voltage or clock glitching) targets the physical hardware during verification. Hardening the hardware against these physical disturbances (e.g., adding sensors to detect voltage spikes) is the appropriate defense.

Answer

Improve the software verification logic.

Answer

Increase the frequency of the RoT verification checks.

Answer

Implement a stronger hash algorithm for code signing.

Question 13

You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?

Accepted Answer

Utilize a TEE (e.g., ARM TrustZone) to isolate keys and perform cryptographic operations.. In the absence of dedicated hardware, an obfuscated key store with a Trusted Execution Environment (TEE) or encrypted key wrapping utilizing a unique hardware-derived ID is the most secure software-centric approach.

Answer

Use a password-based derivation function (PBKDF2) to store the keys.

Answer

Store the keys in a hardcoded configuration file.

Answer

Store the keys in the system's non-volatile memory (NVM) with XOR masking.

Question 14

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 15

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 16

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 17

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 18

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Accepted Answer

Designing effective security countermeasures.. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) requires identifying threats, mapping them to system components, and planning countermeasures.

Answer

Conducting a public relations campaign.

Answer

Automating the software build process.

Question 19

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

Accepted Answer

Enforcing short-lived, dynamically generated credentials.. Secrets management relies on strong access control, secure delivery, and the ability to rotate credentials to limit the window of opportunity for attackers.

Answer

Using a single, static password for all administrative access.

Answer

Hardcoding the master recovery key in the application source code.

Question 20

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

Accepted Answer

Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.. Referencing the Security Group ID of the web tier within the inbound rules of the application tier's Security Group ensures only traffic from authorized instances is accepted, regardless of IP changes.

Answer

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Answer

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Answer

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.