ISC Risk Management Practice Test 2 — 15 Questions

Question 1

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 2

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized PII database creates a single aggregation point: one successful compromise (SQL injection, credential theft, misconfigured access) exposes the entire PII dataset at once. This violates the principle of minimizing blast radius and is the primary architectural risk, which is why regulations like GDPR and CCPA push for data minimization, segmentation, and encryption. The other options describe operational concerns, not the core security risk of centralization.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 3

An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?

Accepted Answer

Risk of cross-tenant data leakage via side-channel attacks.. The 'noisy neighbor' or cross-tenant data leakage risk is inherent to multi-tenant architectures where shared hardware/hypervisor resources could potentially be exploited to access data from another tenant.

Answer

Risk of unauthorized access by the cloud provider's employees.

Answer

Difficulty in performing system backups.

Answer

Risk of data loss due to provider bankruptcy.

Question 4

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

Accepted Answer

Implement constant-time cryptographic algorithms to eliminate timing signatures.. Side-channel attacks on HSMs exploit observable physical characteristics such as timing variations, power consumption, or electromagnetic emanations that correlate with secret key operations. Constant-time cryptographic algorithms execute in a fixed number of cycles regardless of input values, eliminating the timing signature that attackers use to infer key bits. This directly addresses the root cause of the timing side-channel rather than merely restricting access or increasing key size.

Answer

Implement a dual-factor authentication requirement for HSM access.

Answer

Increase the length of the RSA keys.

Answer

Use a larger number of HSMs in a cluster.

Question 5

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the foundational document that documents all security requirements, controls, and their implementation for a system. It captures the system boundary, control implementations, and inherited controls, making it the authoritative source for ensuring all security requirements are identified and addressed during a risk assessment. Reviewing the SSP first ensures the ISSEP has a complete picture of what controls are required and how they are implemented.

Answer

The vendor's marketing materials.

Answer

The project budget.

Answer

The organizational chart.

Question 6

An ISSEP is reviewing the risk of data residency for a system. Why is data residency a significant factor in a cloud-based risk assessment?

Accepted Answer

Legal and regulatory frameworks may mandate that sensitive data be stored within specific jurisdictions.. Data residency requirements often dictate that data must remain within specific geographic boundaries to comply with legal/regulatory obligations (e.g., GDPR, local laws), making it a significant compliance risk.

Answer

Cloud storage is inherently slower in some regions.

Answer

Cloud providers do not allow the choice of storage location.

Answer

Data residency is only applicable to on-premises systems.

Question 7

You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?

Accepted Answer

Zero-trust network policies that enforce default-deny communication between containers.. Micro-segmentation uses policies to restrict communication between workloads, typically at the application or service level. Deny-all by default policies between containers would prevent reconnaissance.

Answer

Enabling flow logging on the network switches.

Answer

Host-based IPS (HIPS).

Answer

Implementing a web application firewall (WAF) at the edge.

Question 8

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.

Question 9

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 10

An ISSEP is evaluating the risk of an API that uses basic authentication over HTTP. What is the most significant risk, and how should it be mitigated?

Accepted Answer

Credential interception; mitigate by upgrading to HTTPS/TLS.. Basic authentication sends credentials in cleartext; HTTP does not provide encryption. The risk is credential interception, and it must be mitigated by upgrading to HTTPS (TLS).

Answer

Denial of Service (DoS); mitigate by using a WAF.

Answer

API rate limiting; mitigate by adding a rate limiter.

Answer

Unauthorized data access; mitigate by using OAuth 2.0.

Question 11

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Accepted Answer

Add environmental sensors and hardened circuitry to detect and respond to fault injection attempts.. Fault injection (like voltage or clock glitching) targets the physical hardware during verification. Hardening the hardware against these physical disturbances (e.g., adding sensors to detect voltage spikes) is the appropriate defense.

Answer

Improve the software verification logic.

Answer

Increase the frequency of the RoT verification checks.

Answer

Implement a stronger hash algorithm for code signing.

Question 12

An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?

Accepted Answer

Easy extraction of keys through reverse engineering the binary.. Hardcoded API keys are embedded directly in the application binary or source code, so anyone who obtains the app package (APK/IPA) can decompile or disassemble it and recover the keys. Tools like jadx, apktool, Frida, and strings make this trivial, and once extracted the keys can be abused to impersonate the app, incur billing charges, or access third-party data. This is a classic CWE-798 (Use of Hard-coded Credentials) issue and is the dominant risk, not performance or availability.

Answer

Increased latency for API calls.

Answer

The keys will expire too quickly.

Answer

The app will crash when the API is unavailable.

Question 13

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the core document that details the security control selection, tailoring, and implementation status for a system under the RMF.

Answer

The Plan of Action and Milestones (POA&M).

Answer

The Authorization to Operate (ATO) letter.

Answer

The Risk Assessment Report (RAR).

Answer

The Security Assessment Plan (SAP).

Question 14

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

Accepted Answer

The security control is bypassed, allowing unauthorized access.. A 'fail-open' configuration means that when a security control (MFA) is unavailable, the system grants access anyway, effectively bypassing the security requirement and creating a critical vulnerability.

Answer

The system's performance will decrease.

Answer

The MFA provider will charge extra fees.

Answer

The system will be inaccessible to users.

Question 15

Which TWO of the following are essential components of a robust threat modeling process for an engineered system?

Accepted Answer

Creation of data flow diagrams (DFDs).. Option B is correct because data flow diagrams (DFDs) are a foundational artifact in threat modeling: they map how data moves between external entities, processes, data stores, and trust boundaries, which is exactly what you need to systematically identify where threats can be introduced or where controls are missing. Option E is correct because established frameworks such as STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege) and PASTA (Process for Attack Simulation and Threat Analysis) provide a repeatable, structured methodology for enumerating threats and prioritizing them, which is essential for a robust and consistent process. Option A is not essential to threat modeling because contract and legal review is a governance/compliance activity, not a technique for identifying threats against an engineered system. Option C is not essential because a full personnel inventory does not describe system architecture, data flows, or attack surface, and threat modeling focuses on the system rather than a complete HR roster. Option D is not essential because a vendor list alone does not reveal how components interact or where trust boundaries lie, so it cannot substitute for architectural modeling and a threat enumeration framework.

Answer

A detailed legal review of all contracts.

Answer

A complete inventory of all organizational personnel.

Answer

A list of all software vendors used by the organization.