ISC Risk Management Practice Test 3 — 15 Questions

Question 1

Which of the following is the most appropriate action when an ISSEP identifies a high-risk vulnerability in a system that is currently in production?

Accepted Answer

Document the vulnerability in the POA&M and coordinate a remediation plan with the system owner.. The ISSEP must report the vulnerability to the system owner and the authorization official, then document it in the POA&M to track its remediation while managing the risk in the interim.

Answer

Ignore the vulnerability until the next scheduled maintenance window.

Answer

Immediately shut down the system.

Answer

Fix the vulnerability immediately without informing anyone.

Question 2

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

Accepted Answer

Implementing unidirectional gateways (data diodes) to isolate the control network.. ICS security focuses on availability and integrity, requiring physical segmentation, secure remote access, and protecting the PLC/DCS controllers themselves from direct interference.

Answer

Replacing all legacy controllers with cloud-based instances.

Answer

Deploying standard IT-based patch management tools directly on all PLCs.

Question 3

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

Accepted Answer

Transfer the risk via insurance or contractual arrangements.. Residual risk must be formally addressed by either the risk owner accepting it (based on analysis) or transferring it (e.g., insurance), as controls rarely eliminate all risk.

Answer

Replace the entire system to eliminate the risk.

Answer

Ignore the risk if it is below a certain threshold.

Answer

Automate the assessment of the risk indefinitely.

Question 4

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

Accepted Answer

Automated scanning of open-source dependencies for known vulnerabilities (SCA).. Securing the supply chain requires verifying code, managing dependencies, and ensuring that the build environment itself is hardened against tampering.

Answer

Ensuring all developers have administrative access to the production environment.

Answer

Allowing all developers to push directly to the production branch.

Question 5

Which TWO of the following are key inputs for a quantitative risk analysis?

Accepted Answer

The Single Loss Expectancy (SLE) of the asset.. Quantitative risk analysis requires numerical data, specifically the value of the asset (Single Loss Expectancy) and the likelihood of the event (Annualized Rate of Occurrence).

Answer

The qualitative ranking of threats (e.g., High, Medium, Low).

Answer

A list of all potential security control vendors.

Answer

The subjective opinion of the IT staff.

Question 6

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

Accepted Answer

Implementing certificate pinning to prevent the use of fraudulent certificates.. MitM protection requires ensuring that the communication channel is encrypted (TLS), that the identity of the communicating parties is verified (mutual authentication), and that the certificate chain is trusted.

Answer

Storing all credentials in a plain-text configuration file.

Answer

Disabling all firewall rules between services to ensure performance.

Question 7

Which TWO of the following are common pitfalls when tailoring security controls in an RMF implementation?

Accepted Answer

Tailoring controls without documenting the security justification.. Tailoring must be justified and documented. Pitfalls include excessive tailoring (reducing security too much) or lack of justification, which both undermine the compliance posture.

Answer

Using the NIST 800-53 catalog to select controls.

Answer

Consulting with the System Owner during the tailoring process.

Answer

Including too many controls, which is always acceptable.

Question 8

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

Accepted Answer

Automated security scanning and log aggregation.. ConMon requires both the technical capability to detect changes/vulnerabilities and the organizational capability to respond to those findings in a timely manner.

Answer

Manual inspection of every system component once per year.

Answer

A complete cessation of all system updates.

Answer

Limiting the scope of monitoring to only the primary web server.

Question 9

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

Accepted Answer

Enforcing short-lived, dynamically generated credentials.. Secrets management relies on strong access control, secure delivery, and the ability to rotate credentials to limit the window of opportunity for attackers.

Answer

Using a single, static password for all administrative access.

Answer

Hardcoding the master recovery key in the application source code.

Question 10

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

Accepted Answer

Running the container process as the 'root' user.. Common container security issues include running as root, insecure communication between containers, and exposing management interfaces unnecessarily.

Answer

Enforcing non-root execution for all production images.

Answer

Implementing a read-only filesystem for the container.

Question 11

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

Accepted Answer

The SSP identifies the controls to be implemented.. The SSP defines the target security posture, while the POA&M tracks the remediation of items that fall short of that target (gaps). They work together to represent the security status of the system.

Answer

The SSP and POA&M are the same document.

Answer

The POA&M replaces the need for an SSP.

Answer

The SSP only needs to be updated when the system is decommissioned.

Question 12

You are assessing an Engineered System that uses 'Hardware Security Modules' (HSM). Which THREE of the following are the most critical administrative risks to address in an HSM policy?

Accepted Answer

Lack of audit logs for access to the HSM's administrative interface.. Option C is correct because without audit logs for the HSM administrative interface, there is no tamper-evident record of who accessed the device, when, and what commands were executed, which defeats accountability and forensic investigation requirements for cryptographic modules. Option D is correct because an insecure key ceremony—where key material, split knowledge, or M-of-N shares can be observed, copied, or handled by a single person—directly compromises the root of trust the HSM is meant to protect, so the policy must mandate witnessed, documented, and physically controlled ceremonies. Option E is correct because lack of separation of duties allows one administrator to perform sensitive operations alone (e.g., key generation, backup, and recovery), violating dual-control and split-knowledge principles required for HSM administration. Option A is not among the marked answers because it addresses only physical access authentication and is a weaker control than the administrative, procedural, and accountability risks covered by C, D, and E. Option B is also not marked because, while using a default vendor password is a serious weakness, it is a basic hardening/configuration issue rather than one of the three most critical administrative risks in an HSM policy.

Answer

Only requiring a password for physical access to the HSM appliance.

Answer

Using the default vendor password for the HSM web UI.

Question 13

An ISSEP is performing a system-level risk assessment for a new payroll system. The team decides to use a qualitative approach because quantitative data is scarce. Which of the following best describes a key limitation of qualitative risk assessment that the ISSEP should communicate to stakeholders?

Accepted Answer

It produces results that are subjective and difficult to express in monetary terms.. Qualitative risk assessment relies on expert judgment and descriptive scales, which introduces subjectivity and makes it difficult to express risk in monetary terms. Stakeholders often need financial figures to prioritize investments. While it can prioritize risks, the lack of quantitative precision is a key limitation that the ISSEP must communicate. The other options mischaracterize the method's applicability or requirements.

Answer

It cannot prioritize risks for remediation.

Answer

It requires specialized statistical expertise to perform.

Answer

It is only applicable to physical security risks, not cyber risks.

Question 14

An ISSEP is conducting a risk assessment for a system that processes classified information. The system owner proposes using a single risk assessment for both the system and its hosting facility. Which of the following is the most significant risk of this approach?

Accepted Answer

It may overlook facility-specific threats such as physical intrusion or power failures.. Combining system and facility risk assessments can lead to inadequate coverage of physical and environmental threats that are unique to the facility. A system-level assessment typically focuses on logical and technical risks, while a facility assessment addresses physical security, utilities, and environmental controls. Merging them risks missing critical facility-specific vulnerabilities, which is the most significant concern for classified information processing.

Answer

It will eliminate the need for a business impact analysis (BIA).

Answer

It will violate the principle of least privilege.

Answer

It will require more resources than separate assessments.

Question 15

An ISSEP is leading a risk assessment for a new cloud-based system that will store sensitive customer data. The organization must comply with GDPR and other privacy regulations. Which TWO of the following are the most critical factors to consider when assessing data residency risks? (Choose two.)

Accepted Answer

The cloud provider's data backup and disaster recovery locations.. Data residency risks are primarily concerned with where data is stored and processed, including backup and disaster recovery sites. The physical location of data centers determines which legal jurisdictions apply, and backup locations can inadvertently introduce cross-border transfers. Encryption, user count, and uptime SLAs, while important for security and availability, do not directly address the legal and regulatory aspects of data residency.

Answer

The number of users who will access the system.

Answer

The cloud provider's service level agreement (SLA) for uptime.

Answer

The encryption algorithms used for data at rest and in transit.