ISC Risk Management Practice Test 2 — 15 Questions

Question 1

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement constant-time cryptographic algorithms to eliminate timing signatures.. Side-channel attacks often rely on power consumption or timing differences during cryptographic operations. Implementing constant-time algorithms and power-smoothing circuits within the HSM environment helps mask these signals.

Answer

Implement a dual-factor authentication requirement for HSM access.

Answer

Increase the length of the RSA keys.

Answer

Use a larger number of HSMs in a cluster.

Question 2

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

Accepted Answer

The System Security Plan (SSP).. The System Requirements Specification (SRS) or the System Security Plan (SSP) (if in progress) captures the functional and non-functional requirements, including those for security, providing the foundation for the assessment.

Answer

The vendor's marketing materials.

Answer

The project budget.

Answer

The organizational chart.

Question 3

An ISSEP is reviewing the risk of data residency for a system. Why is data residency a significant factor in a cloud-based risk assessment?

Accepted Answer

Legal and regulatory frameworks may mandate that sensitive data be stored within specific jurisdictions.. Data residency requirements often dictate that data must remain within specific geographic boundaries to comply with legal/regulatory obligations (e.g., GDPR, local laws), making it a significant compliance risk.

Answer

Cloud storage is inherently slower in some regions.

Answer

Cloud providers do not allow the choice of storage location.

Answer

Data residency is only applicable to on-premises systems.

Question 4

You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?

Accepted Answer

Zero-trust network policies that enforce default-deny communication between containers.. Micro-segmentation uses policies to restrict communication between workloads, typically at the application or service level. Deny-all by default policies between containers would prevent reconnaissance.

Answer

Enabling flow logging on the network switches.

Answer

Host-based IPS (HIPS).

Answer

Implementing a web application firewall (WAF) at the edge.

Question 5

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

Accepted Answer

To determine the risk level and prioritize the implementation of security controls.. The primary objective is to identify and document the risks to a specific system, helping stakeholders make informed decisions about risk acceptance and mitigation.

Answer

To conduct a full penetration test of the entire enterprise.

Answer

To replace all security controls with newer technology.

Answer

To eliminate all risks to the system.

Question 6

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

Accepted Answer

The risk is model inaccuracy; manage by monitoring performance metrics and retraining.. Concept drift occurs when the statistical properties of the target variable change over time, rendering the model inaccurate. It must be managed through continuous monitoring and periodic model retraining.

Answer

The risk is model poisoning; manage by sanitizing the training data.

Answer

The risk is model inversion; manage by adding differential privacy.

Answer

The risk is a data breach; manage by encrypting the dataset.

Question 7

An ISSEP is evaluating the risk of an API that uses basic authentication over HTTP. What is the most significant risk, and how should it be mitigated?

Accepted Answer

Credential interception; mitigate by upgrading to HTTPS/TLS.. Basic authentication sends credentials in cleartext; HTTP does not provide encryption. The risk is credential interception, and it must be mitigated by upgrading to HTTPS (TLS).

Answer

Denial of Service (DoS); mitigate by using a WAF.

Answer

API rate limiting; mitigate by adding a rate limiter.

Answer

Unauthorized data access; mitigate by using OAuth 2.0.

Question 8

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Accepted Answer

Add environmental sensors and hardened circuitry to detect and respond to fault injection attempts.. Fault injection (like voltage or clock glitching) targets the physical hardware during verification. Hardening the hardware against these physical disturbances (e.g., adding sensors to detect voltage spikes) is the appropriate defense.

Answer

Improve the software verification logic.

Answer

Increase the frequency of the RoT verification checks.

Answer

Implement a stronger hash algorithm for code signing.

Question 9

An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?

Accepted Answer

Easy extraction of keys through reverse engineering the binary.. Hardcoded keys are easily extractable via reverse engineering the app binary, leading to unauthorized use of the third-party services and potential compromise of the developer's account.

Answer

Increased latency for API calls.

Answer

The keys will expire too quickly.

Answer

The app will crash when the API is unavailable.

Question 10

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the core document that details the security control selection, tailoring, and implementation status for a system under the RMF.

Answer

The Plan of Action and Milestones (POA&M).

Answer

The Authorization to Operate (ATO) letter.

Answer

The Risk Assessment Report (RAR).

Answer

The Security Assessment Plan (SAP).

Question 11

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

Accepted Answer

The security control is bypassed, allowing unauthorized access.. A 'fail-open' configuration means that when a security control (MFA) is unavailable, the system grants access anyway, effectively bypassing the security requirement and creating a critical vulnerability.

Answer

The system's performance will decrease.

Answer

The MFA provider will charge extra fees.

Answer

The system will be inaccessible to users.

Question 12

You are assessing a system that uses 'Homomorphic Encryption' for data processing. What is the primary operational trade-off the system designer must consider?

Accepted Answer

Significant computational overhead and latency.. Homomorphic encryption allows computation on encrypted data, but it is extremely resource-intensive, resulting in significant latency and performance overhead compared to processing unencrypted data.

Answer

Increased security of data at rest.

Answer

Incompatibility with standard database engines.

Answer

Complexity of key management.

Question 13

Which TWO of the following are essential components of a robust threat modeling process for an engineered system?

Accepted Answer

Creation of data flow diagrams (DFDs).. Threat modeling requires understanding the system architecture (data flow diagrams) and identifying potential threats using established methodologies like STRIDE to systematically address risks.

Answer

A detailed legal review of all contracts.

Answer

A complete inventory of all organizational personnel.

Answer

A list of all software vendors used by the organization.

Question 14

Which of the following is the most appropriate action when an ISSEP identifies a high-risk vulnerability in a system that is currently in production?

Accepted Answer

Document the vulnerability in the POA&M and coordinate a remediation plan with the system owner.. The ISSEP must report the vulnerability to the system owner and the authorization official, then document it in the POA&M to track its remediation while managing the risk in the interim.

Answer

Ignore the vulnerability until the next scheduled maintenance window.

Answer

Immediately shut down the system.

Answer

Fix the vulnerability immediately without informing anyone.

Question 15

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.