An ISSEP is reviewing the 'Maintain' phase of the RMF for a system that has undergone a significant software update. What is the most critical activity to ensure that the system's security posture remains intact?
An organization is deploying a serverless architecture (AWS Lambda). How does the risk of patch management change compared to a traditional IaaS model?
You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?
You are assessing a system that uses 'Homomorphic Encryption' for data processing. What is the primary operational trade-off the system designer must consider?
An ISSEP is assessing the risk of a supply chain attack on a system that uses commercial off-the-shelf (COTS) hardware with embedded firmware. The vendor provides a software bill of materials (SBOM) but does not allow independent firmware inspection. Which risk management strategy is MOST appropriate?
An ISSEP is helping a program manager interpret the results of a system-level risk assessment. The assessment identified a vulnerability with a likelihood of 4 and an impact of 5 on a 1-5 scale. Which statement BEST describes how this risk should be communicated to the program manager?
An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?
An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?
You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?
An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?
You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?
You are evaluating the risk of an Artificial Intelligence (AI) model deployment. The model is susceptible to 'model inversion' attacks, where an attacker can reconstruct sensitive training data. What is the most effective engineering control to prevent this?
An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?
During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?
During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?
An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?
An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?
You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?
Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?
You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?
You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?
A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?
An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?
An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?
An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?
An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?
An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?
You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?
Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?
You are assessing an Engineered System that uses 'Hardware Security Modules' (HSM). Which THREE of the following are the most critical administrative risks to address in an HSM policy?
An ISSEP is performing a system-level risk assessment for a new payroll system. The team decides to use a qualitative approach because quantitative data is scarce. Which of the following best describes a key limitation of qualitative risk assessment that the ISSEP should communicate to stakeholders?
An ISSEP is conducting a risk assessment for a system that processes classified information. The system owner proposes using a single risk assessment for both the system and its hosting facility. Which of the following is the most significant risk of this approach?
An ISSEP is leading a risk assessment for a new cloud-based system that will store sensitive customer data. The organization must comply with GDPR and other privacy regulations. Which TWO of the following are the most critical factors to consider when assessing data residency risks? (Choose two.)
An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?
During a system security engineering review, an ISSEP discovers that a critical supplier's component firmware is updated automatically over the internet without cryptographic signature verification. The component is embedded in a system that processes Controlled Unclassified Information (CUI). Which risk treatment strategy should the ISSEP recommend FIRST?
An ISSEP is performing a risk assessment on a system that depends on a commercial cloud provider for infrastructure. The provider's shared responsibility model places physical security and hypervisor patching with the provider, while the ISSEP's organization retains responsibility for data classification, identity management, and application security. The Authorizing Official asks the ISSEP to formally capture which controls are inherited, shared, or customer-owned so that residual risk is not double-counted or overlooked. Which risk management activity best addresses this need?
An ISSEP is briefing a program manager on the purpose of the Risk Management Framework (RMF) as defined in NIST SP 800-37. The program manager asks which statement best describes the fundamental goal of applying RMF to a new information system. Which response should the ISSEP give?
An ISSEP supports a defense program using the Risk Management Framework (RMF). The system has an approved Authorization to Operate (ATO). During continuous monitoring, a new Common Vulnerabilities and Exposures (CVE) is published that affects a component in the production environment. The vulnerability has a CVSS base score of 8.1, but the component is not exposed to any untrusted network and no known exploit exists. The program manager asks the ISSEP to determine the immediate next step. Which action is MOST appropriate?
An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?
An ISSEP is reviewing the security architecture of a system that will be accredited under the DoD Information Assurance Certification and Accreditation Process successor, the RMF. The system owner proposes to accept a known configuration weakness because compensating controls reduce the exploit likelihood. Before endorsing the risk acceptance, which action must the ISSEP take to ensure the decision is defensible?
An ISSEP is performing a risk assessment for a new system that will process Controlled Unclassified Information (CUI). The system owner wants to use a cloud service provider (CSP) that stores data in multiple countries. The ISSEP must ensure compliance with applicable federal requirements. Which action should the ISSEP take FIRST?
An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where information must be shared with partner nations. The system uses a cross-domain solution (CDS) to transfer data between security domains. Which TWO of the following are the most critical risk factors to evaluate regarding the CDS? (Choose two.)
An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)
An ISSEP is performing a system-level risk assessment for a new payroll application that will process employee bank account details. The system owner insists on using a proprietary, unpublished encryption algorithm because it is 'faster than AES.' Which risk response is MOST appropriate according to ISSEP risk management principles?
An ISSEP is reviewing a system's risk management plan. The plan states that risk will be assessed using a qualitative approach. Which of the following best describes a qualitative risk assessment?
An ISSEP is conducting a risk assessment for a new system that will process Controlled Unclassified Information (CUI) on a government contract. The system owner proposes a purely qualitative risk assessment using a 5x5 likelihood-impact matrix because it is faster and cheaper. The contract requires compliance with NIST SP 800-171 and a defensible risk determination. Which action should the ISSEP recommend?
An ISSEP is assessing a border control system that uses biometric facial recognition for traveler verification. The system's FAR is 0.001 and FRR is 0.05 at the current threshold. The mission owner wants to reduce the chance of a false match to near zero. Which action should the ISSEP recommend FIRST?
An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?
An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)
An ISSEP is performing a system-level risk assessment for a new payroll processing system that will operate in a shared datacenter. The system owner insists on using a qualitative risk matrix because the organization lacks reliable historical incident data. During validation, the ISSEP notes that two different assessors assigned the same threat scenario to different likelihood categories, and the risk scores diverged significantly. Which action best addresses this inconsistency while preserving the qualitative approach?
An ISSEP is leading a system-level risk assessment for a new command-and-control (C2) system that will operate on a classified network. The program manager asks which activities are required to ensure the assessment supports a defensible authorization decision. (Choose two.)
An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?
An ISSEP is facilitating a risk assessment workshop for an Engineered System that controls a regional electrical substation. The system owner insists that the design is safe because every identified threat has an assigned countermeasure, and the residual risk register shows no entries above the organization's risk tolerance. Before the system can be accredited, the ISSEP must confirm that the risk management process has accounted for which of the following?
An ISSEP is integrating a commercial off-the-shelf (COTS) component into a system that will process Controlled Unclassified Information (CUI). The vendor provides a self-signed statement of conformity but no independent assessment. The program needs to characterize the supply chain risk before the component enters the authorization boundary. Which approach best supports an informed supply chain risk determination?
An ISSEP is reviewing the risk management strategy for an organization deploying a new cloud-based email service. The organization wants to transfer as much risk as possible to the cloud provider. Which action should the ISSEP recommend to clarify what risk can actually be transferred?
An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where multiple nations will share data. The system owner asks which risk factors are MOST important to evaluate during the assessment. (Choose two.)
An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?
During a risk assessment of a distributed system, the ISSEP identifies that a critical cryptographic module is nearing its end of support and the vendor will stop issuing firmware patches. The module cannot be replaced before the next authorization cycle, but the system must continue operating. Which risk response best fits the ISSEP's role at this stage?
An ISSEP is assessing a system that uses an air-gapped network for processing highly sensitive data. The security team argues that because the network is air-gapped, risk from external threat actors is negligible and no further analysis is needed. Which response should the ISSEP provide?
An ISSEP is evaluating a new Engineered System that will be deployed across three geographically separated sites. The program manager wants to reuse a risk assessment performed two years ago for a similar system at a single site to save schedule time. Which factor most directly determines whether the earlier assessment can be reused?
An ISSEP is reviewing the risk management framework for a defense program. The program uses a continuous monitoring strategy that includes automated vulnerability scanning and configuration compliance checks. A recent audit found that findings are being generated but not consistently reviewed or remediated within the program's defined timelines. Which action should the ISSEP recommend to address the ROOT cause?
An ISSEP is reviewing a system's risk register and notices that several entries list only the threat source and the affected asset, without any statement of the potential mission consequence. The system owner asks why consequence information is necessary when the threat and asset are already recorded. What is the most accurate justification for including consequence detail?
An ISSEP is evaluating a proposed change to a system that will introduce a new external interface for partner data exchange. The change is scheduled for next week, and the program manager wants to skip a formal risk assessment to meet the deadline. Which action should the ISSEP take?
An ISSEP is establishing a risk management process for a new Engineered System that will process controlled unclassified information. The program office wants to ensure that risk decisions are defensible and repeatable across the system lifecycle. Which TWO activities are essential to achieving that outcome? (Choose two.)
An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)
An ISSEP is reviewing the risk analysis for an Engineered System that relies on a commercial cloud provider for data storage. The analysis lists provider-side outages as the only supply chain risk. The ISSEP knows the provider uses subcontractors for data center operations and hardware maintenance. Which deficiency in the analysis should the ISSEP address first?