ISC Multiple Select — 10 Questions

Question 1

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 2

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

Accepted Answer

Revoke all certificates and credentials associated with the system.. Secure decommissioning requires sanitizing storage media to prevent data remanence and revoking credentials to eliminate access. These actions address the two primary risks: residual data and lingering trust. Updating disaster recovery plans, scanning for vulnerabilities, or archiving data are not essential for secure disposal and may even conflict with the objective.

Answer

Update the disaster recovery plan to remove the system.

Answer

Conduct a vulnerability scan of the system before decommissioning.

Answer

Back up all data to a long-term archive for potential future use.

Question 3

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

Accepted Answer

Real-time incident detection. Option A (Real-time incident detection) is correct because ConMon depends on continuous telemetry and alerting (e.g., SIEM correlation, IDS/IPS, EDR) to identify threats as they occur rather than at a point-in-time assessment. Option D (Established incident response procedures) is correct because detection has value only when paired with documented, tested IR playbooks that define triage, escalation, containment, eradication, and recovery actions. Option E (Automated security control status monitoring) is correct because ConMon, per NIST SP 800-137, requires ongoing automated assessment of control effectiveness (e.g., SCAP, continuous diagnostics and mitigation) to maintain an accurate, near-real-time authorization posture. Option B (Quarterly hardware refresh) is not a ConMon factor—hardware lifecycle management is a separate asset management concern and does not provide continuous visibility into security control status or incidents. Option C (Manual annual log review) is not appropriate because annual, manual review is periodic and retrospective, contradicting the continuous, automated nature of an effective ConMon program.

Answer

Quarterly hardware refresh

Answer

Manual annual log review

Question 4

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 5

An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)

Accepted Answer

Implement network segmentation with industrial firewalls to isolate the PLCs from the corporate network and the internet.. For unpatched legacy PLCs, the most effective compensating controls are network segmentation with industrial firewalls and strict physical access controls. These measures reduce the attack surface and prevent unauthorized access, which are critical when patching is not an option. Other options are either infeasible or do not directly address the vulnerabilities of the PLCs.

Answer

Replace all legacy PLCs with new models that support patching.

Answer

Deploy host-based antivirus software directly on the PLCs.

Answer

Require all operators to use multi-factor authentication (MFA) when logging into the PLCs.

Question 6

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Accepted Answer

Remove the system from the network and inventory.. Clearing or purging the storage media, destroying the media if necessary, and auditing the decommissioning logs are key steps.

Answer

Archive all data to a public cloud bucket.

Answer

Format the hard drive as a quick process.

Question 7

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

Accepted Answer

Destroy the HSM root CA private keys using the HSM's secure zeroization function and record the destruction in the decommissioning log.. Proper disposal of a legacy identity system requires destroying the root CA private keys to prevent forgery while preserving public certificates and revocation information so existing credentials remain verifiable. Retaining private keys or leaving the directory database intact creates unnecessary risk and violates data lifecycle requirements. The two required actions balance security with the operational need for trust continuity during the transition period.

Answer

Migrate the directory user attributes to the new identity system and then leave the legacy database intact for historical reference.

Answer

Archive the root CA private keys in an offline vault so they can be used to re-sign certificates if validation issues arise later.

Answer

Delete the directory database by dropping all tables and removing the database files from the storage array without further sanitization.

Question 8

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)

Accepted Answer

Testing the badge reader system to confirm that only authorized badges grant entry.. Testing the badge reader system and examining access logs are both hands-on verification activities that provide objective evidence of physical access control implementation. Testing confirms that the system enforces access restrictions, while examining logs confirms that entry events are recorded for auditing. These activities align with NIST SP 800-53 assessment procedures for physical access control, which require examining and testing controls. Policy review, employee interviews, and manufacturer specifications do not verify actual implementation and are therefore not appropriate for this validation.

Answer

Reviewing the manufacturer's specifications for the badge reader hardware.

Answer

Interviewing employees about their perception of the facility's security.

Answer

Reviewing the access control policy to ensure it defines authorized personnel.

Question 9

An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)

Accepted Answer

A defined process for analyzing monitoring data and escalating risk-relevant changes to the Authorizing Official.. Continuous risk monitoring requires both a reliable data feed and a governance loop. Automated collection mapped to the control baseline supplies objective, timely evidence about control effectiveness and system change, while a defined analysis and escalation process turns that data into decisions by the Authorizing Official. Together they keep the risk picture current between formal assessments. Periodic reauthorization, uniform exhaustive retesting, and standalone penetration tests are point-in-time activities that do not sustain ongoing awareness.

Answer

Periodic reauthorization of every subsystem by the Authorizing Official on a fixed annual schedule.

Answer

Replacing the system's security assessment with an annual penetration test performed by an external team.

Answer

Full re-testing of every security control in the baseline at the same frequency, regardless of risk or volatility.

Question 10

An ISSE is developing a security architecture for a new system that must support multiple independent levels of security. The ISSE needs to ensure that the architecture enforces the principles of isolation and non-interference. Which two design techniques should the ISSE require? (Choose two.)

Accepted Answer

Enforce a mandatory access control policy that prevents information flow from higher to lower security levels.. Isolation and non-interference in a multiple independent levels of security architecture are achieved through a separation kernel that partitions resources and a mandatory access control policy that prevents high-to-low information flow. Shared memory, discretionary access control, and a single shared OS instance all undermine these properties by creating paths for interference or unauthorized data flow.

Answer

Rely on discretionary access control lists managed by each domain to control cross-domain access.

Answer

Use a single shared operating system instance with role-based access control to separate domains.

Answer

Use a shared memory segment for inter-domain communication to improve performance and reduce complexity.