ISC Multiple Select — 10 Questions

Question 1

Which TWO of the following are key inputs for a quantitative risk analysis?

Accepted Answer

The Single Loss Expectancy (SLE) of the asset.. Quantitative risk analysis requires numerical data, specifically the value of the asset (Single Loss Expectancy) and the likelihood of the event (Annualized Rate of Occurrence).

Answer

The qualitative ranking of threats (e.g., High, Medium, Low).

Answer

A list of all potential security control vendors.

Answer

The subjective opinion of the IT staff.

Question 2

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.

Question 3

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 4

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 5

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 6

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

Answer

Formatting the partition

Answer

Degaussing

Question 7

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

Accepted Answer

Confirmation that no new vulnerabilities were introduced. A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

Answer

The total budget spent on the project

Answer

List of employees who didn't like the change

Question 8

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

Accepted Answer

Role-Based Access Control (RBAC).. Encryption (AES-256) and strong access controls (RBAC) are standard for high-impact data protection.

Answer

Storing data only in the local cache.

Answer

Disabling all audit logging.

Answer

Using cleartext storage for performance.

Question 9

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 10

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software