ISC Multiple Select — 50 Questions

Question 1

Which TWO of the following are key inputs for a quantitative risk analysis?

Accepted Answer

The Single Loss Expectancy (SLE) of the asset.. Quantitative risk analysis requires numerical data, specifically the value of the asset (Single Loss Expectancy) and the likelihood of the event (Annualized Rate of Occurrence).

Answer

The qualitative ranking of threats (e.g., High, Medium, Low).

Answer

A list of all potential security control vendors.

Answer

The subjective opinion of the IT staff.

Question 2

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.

Question 3

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 4

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 5

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 6

Which THREE technologies are acceptable for the secure disposal of solid-state drives (SSDs)?

Accepted Answer

Physical shredding. NIST 800-88 suggests physical destruction, degaussing (if permitted, though not for SSDs), or cryptographic erasure for SSDs, though physical destruction is most definitive.

Answer

Formatting the partition

Answer

Degaussing

Question 7

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

Accepted Answer

Confirmation that no new vulnerabilities were introduced. A PIR ensures the change achieved its goal, did not introduce new vulnerabilities, and met compliance requirements.

Answer

The total budget spent on the project

Answer

List of employees who didn't like the change

Question 8

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

Accepted Answer

Role-Based Access Control (RBAC).. Encryption (AES-256) and strong access controls (RBAC) are standard for high-impact data protection.

Answer

Storing data only in the local cache.

Answer

Disabling all audit logging.

Answer

Using cleartext storage for performance.

Question 9

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Accepted Answer

ISO/IEC 27001.. PCI DSS is the mandatory standard for payment processing, and ISO 27001 is a foundational security management framework.

Answer

HIPAA.

Answer

GDPR.

Answer

OSHA.

Question 10

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

Accepted Answer

Pre-authorization status of the change procedure. Emergency changes are driven by urgent threats or failures, while standard changes follow a pre-approved, well-understood process.

Answer

The cost of the hardware

Answer

The number of users affected

Answer

The vendor of the software

Question 11

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 12

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 13

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Accepted Answer

Reviewing existing security controls for degradation. Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.

Answer

Replacing all hardware in the data center

Answer

Renaming the system server hostname

Question 14

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

Accepted Answer

Designing effective security countermeasures.. STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) requires identifying threats, mapping them to system components, and planning countermeasures.

Answer

Conducting a public relations campaign.

Answer

Automating the software build process.

Question 15

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

Accepted Answer

Automated security scanning and log aggregation.. ConMon requires both the technical capability to detect changes/vulnerabilities and the organizational capability to respond to those findings in a timely manner.

Answer

Manual inspection of every system component once per year.

Answer

A complete cessation of all system updates.

Answer

Limiting the scope of monitoring to only the primary web server.

Question 16

Which TWO of the following are common pitfalls when tailoring security controls in an RMF implementation?

Accepted Answer

Tailoring controls without documenting the security justification.. Tailoring must be justified and documented. Pitfalls include excessive tailoring (reducing security too much) or lack of justification, which both undermine the compliance posture.

Answer

Using the NIST 800-53 catalog to select controls.

Answer

Consulting with the System Owner during the tailoring process.

Answer

Including too many controls, which is always acceptable.

Question 17

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

Accepted Answer

Enforcing short-lived, dynamically generated credentials.. Secrets management relies on strong access control, secure delivery, and the ability to rotate credentials to limit the window of opportunity for attackers.

Answer

Using a single, static password for all administrative access.

Answer

Hardcoding the master recovery key in the application source code.

Question 18

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 19

Which THREE of the following are recognized categories of security controls in NIST SP 800-53?

Accepted Answer

Operational.. The three control categories are Management, Operational, and Technical.

Answer

Physical.

Answer

Financial.

Question 20

Which THREE methods can be used to ensure high availability for a database in a secure architecture?

Accepted Answer

Multi-region deployment.. Active-passive failover, replication (read replicas), and multi-region deployment are the standard HA methods for databases.

Answer

Ignoring error logs.

Answer

Running the database on a single server.