ISC Risk Management — 20 Questions

Question 1

An ISSEP needs to ensure that the development process follows secure coding standards. Which standard should the team adopt?

Accepted Answer

SEI CERT C Coding Standard.. The OWASP Application Security Verification Standard (ASVS) or the SEI CERT C/C++ Coding Standards are the industry-standard frameworks for implementing secure coding practices.

Answer

NIST SP 800-53.

Answer

ISO/IEC 27001.

Answer

ITIL v4.

Question 2

An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. The ALE is calculated by multiplying the SLE by the ARO (100,000 * 0.5 = 50,000).

Answer

$200,000

Answer

$500,000

Answer

$100,000

Question 3

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

Accepted Answer

The sensor firmware is not signed.. Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.

Answer

The sensor housing is not tamper-evident.

Answer

The sensors use an older version of Bluetooth.

Answer

The vendor does not provide a Service Level Agreement (SLA).

Question 4

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

Accepted Answer

Perform a firmware update using the manufacturer's signed secure update process.. Firmware vulnerabilities involving the TPM and secure boot chain represent a fundamental compromise of the root of trust. Remediation must prioritize the update of the firmware to restore the integrity of the secure boot sequence.

Answer

Update the security policy to include manual verification of boot logs.

Answer

Configure an IDS to block unauthorized firmware update attempts.

Answer

Disable TPM-based secure boot until the vendor releases a patch.

Question 5

An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?

Accepted Answer

That all cryptographic modules utilized by the system are FIPS 140-3 validated.. FIPS 140-3 certification is specific to the cryptographic modules used within the system. The ISSEP must ensure that all cryptographic operations are handled by modules validated to this standard.

Answer

That the system uses TLS 1.3 for data in transit.

Answer

That the cloud management console uses Multi-Factor Authentication (MFA).

Answer

That the cloud provider's storage is encrypted at rest.

Question 6

You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?

Accepted Answer

Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.. When protocol-specific inspection is impossible, network segmentation and the implementation of unidirectional security gateways (data diodes) provide the highest assurance of protecting critical control systems from external threat vectors.

Answer

Replace the proprietary protocol with OPC-UA to enable standard security monitoring.

Answer

Implement a host-based firewall on the SCADA master station.

Answer

Deploy an intrusion detection system (IDS) that uses behavioral pattern matching.

Question 7

You are evaluating the risk of an Artificial Intelligence (AI) model deployment. The model is susceptible to 'model inversion' attacks, where an attacker can reconstruct sensitive training data. What is the most effective engineering control to prevent this?

Accepted Answer

Apply differential privacy techniques to the training process.. Differential privacy adds statistical noise to the training data or the model's output, preventing the reconstruction of individual training samples while maintaining the model's overall utility.

Answer

Encrypt the model weights at rest.

Answer

Implement rate limiting on the model's API.

Answer

Retrain the model on a smaller, obfuscated dataset.

Question 8

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

Accepted Answer

Update the System Security Plan (SSP) to include the missing controls and implement the baseline via Infrastructure-as-Code (IaC) templates.. The RMF requires that security controls be implemented and documented. Identifying a missing baseline during the assessment phase necessitates updating the System Security Plan (SSP) and verifying the implementation of baseline controls before proceeding to the 'Authorize' step.

Answer

Modify the Security Assessment Plan (SAP) to exclude the container layer from the current assessment scope.

Answer

Proceed to authorization and defer the container baseline to the next Continuous Monitoring cycle.

Answer

Request a waiver from the Chief Information Security Officer (CISO) for container orchestration security.

Question 9

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

Accepted Answer

Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.. In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.

Answer

Accept the risk because the API is internal-facing.

Answer

Disable the API entirely.

Answer

Monitor API logs for suspicious activity.

Question 10

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 11

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized database creates a 'single point of failure' (or 'single point of compromise'), where an attacker gaining access to the database potentially compromises all stored PII at once.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 12

An ISSEP is reviewing the 'Maintain' phase of the RMF for a system that has undergone a significant software update. What is the most critical activity to ensure that the system's security posture remains intact?

Accepted Answer

Conduct a Security Impact Analysis (SIA) to determine the extent of the changes.. Following a significant change, a re-assessment (or targeted assessment) is required to ensure that the security controls remain effective and that new vulnerabilities have not been introduced.

Answer

Perform a full system penetration test.

Answer

Notify the system users of the update.

Answer

Update the system backup schedule.

Question 13

An organization is deploying a serverless architecture (AWS Lambda). How does the risk of patch management change compared to a traditional IaaS model?

Accepted Answer

Patch management of the underlying host OS is handled by the cloud provider.. In serverless, the provider manages the underlying operating system and runtime patches, shifting the responsibility of patch management from the user to the provider, though the user still remains responsible for their code and configuration.

Answer

Patch management complexity increases due to the number of functions.

Answer

The user must now use a specialized patching tool for the serverless platform.

Answer

The user is no longer responsible for any patching.

Question 14

An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?

Accepted Answer

Risk of cross-tenant data leakage via side-channel attacks.. The 'noisy neighbor' or cross-tenant data leakage risk is inherent to multi-tenant architectures where shared hardware/hypervisor resources could potentially be exploited to access data from another tenant.

Answer

Risk of unauthorized access by the cloud provider's employees.

Answer

Difficulty in performing system backups.

Answer

Risk of data loss due to provider bankruptcy.

Question 15

You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?

Accepted Answer

Utilize a TEE (e.g., ARM TrustZone) to isolate keys and perform cryptographic operations.. In the absence of dedicated hardware, an obfuscated key store with a Trusted Execution Environment (TEE) or encrypted key wrapping utilizing a unique hardware-derived ID is the most secure software-centric approach.

Answer

Use a password-based derivation function (PBKDF2) to store the keys.

Answer

Store the keys in a hardcoded configuration file.

Answer

Store the keys in the system's non-volatile memory (NVM) with XOR masking.

Question 16

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

Accepted Answer

Implement constant-time cryptographic algorithms to eliminate timing signatures.. Side-channel attacks often rely on power consumption or timing differences during cryptographic operations. Implementing constant-time algorithms and power-smoothing circuits within the HSM environment helps mask these signals.

Answer

Implement a dual-factor authentication requirement for HSM access.

Answer

Increase the length of the RSA keys.

Answer

Use a larger number of HSMs in a cluster.

Question 17

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

Accepted Answer

The System Security Plan (SSP).. The System Requirements Specification (SRS) or the System Security Plan (SSP) (if in progress) captures the functional and non-functional requirements, including those for security, providing the foundation for the assessment.

Answer

The vendor's marketing materials.

Answer

The project budget.

Answer

The organizational chart.

Question 18

An ISSEP is reviewing the risk of data residency for a system. Why is data residency a significant factor in a cloud-based risk assessment?

Accepted Answer

Legal and regulatory frameworks may mandate that sensitive data be stored within specific jurisdictions.. Data residency requirements often dictate that data must remain within specific geographic boundaries to comply with legal/regulatory obligations (e.g., GDPR, local laws), making it a significant compliance risk.

Answer

Cloud storage is inherently slower in some regions.

Answer

Cloud providers do not allow the choice of storage location.

Answer

Data residency is only applicable to on-premises systems.

Question 19

You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?

Accepted Answer

Zero-trust network policies that enforce default-deny communication between containers.. Micro-segmentation uses policies to restrict communication between workloads, typically at the application or service level. Deny-all by default policies between containers would prevent reconnaissance.

Answer

Enabling flow logging on the network switches.

Answer

Host-based IPS (HIPS).

Answer

Implementing a web application firewall (WAF) at the edge.

Question 20

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.