ISC Risk Management Practice Test 4 — 15 Questions

Question 1

An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

System Security Plan (SSP). The System Security Plan is the RMF artifact that describes the system's authorization boundary, the selected security controls, and how each control is implemented. It accompanies the system through assessment and authorization and is the foundational document the Authorizing Official reviews. The SAR, POA&M, and ATO each serve distinct roles later in the process but do not substitute for the SSP.

Answer

Plan of Action and Milestones (POA&M)

Answer

Security Assessment Report (SAR)

Answer

Authority to Operate (ATO) memorandum

Question 2

During a system security engineering review, an ISSEP discovers that a critical supplier's component firmware is updated automatically over the internet without cryptographic signature verification. The component is embedded in a system that processes Controlled Unclassified Information (CUI). Which risk treatment strategy should the ISSEP recommend FIRST?

Accepted Answer

Mitigate the risk by requiring the supplier to implement digitally signed firmware updates and verifying signatures before installation.. The absence of cryptographic signature verification for firmware updates is a supply chain vulnerability that can lead to arbitrary code execution. The most effective first response is to mitigate by mandating digitally signed updates and verifying them prior to installation. This control directly prevents tampered firmware from being loaded, reducing the risk to CUI. Other strategies either do not address the root cause or are premature.

Answer

Avoid the risk by disconnecting the component from all networks.

Answer

Accept the risk because the supplier is contractually obligated to provide secure updates.

Answer

Transfer the risk by purchasing cyber insurance that covers supply chain attacks.

Question 3

An ISSEP is performing a risk assessment on a system that depends on a commercial cloud provider for infrastructure. The provider's shared responsibility model places physical security and hypervisor patching with the provider, while the ISSEP's organization retains responsibility for data classification, identity management, and application security. The Authorizing Official asks the ISSEP to formally capture which controls are inherited, shared, or customer-owned so that residual risk is not double-counted or overlooked. Which risk management activity best addresses this need?

Accepted Answer

Conducting a control inheritance and shared responsibility mapping as part of the system security plan. Control inheritance mapping is the risk management activity that documents which controls the cloud provider implements and assesses, which are shared, and which remain the customer's responsibility. This prevents double-counting of provider-assessed controls and ensures customer-owned controls receive full assessment. It is the artifact the Authorizing Official needs to judge residual risk accurately.

Answer

Performing an independent penetration test of the provider's hypervisor layer

Answer

Re-categorizing the system at a higher FIPS 199 impact level to reflect cloud exposure

Answer

Requesting a new Authority to Operate directly from the cloud provider's authorizing official

Question 4

An ISSEP is briefing a program manager on the purpose of the Risk Management Framework (RMF) as defined in NIST SP 800-37. The program manager asks which statement best describes the fundamental goal of applying RMF to a new information system. Which response should the ISSEP give?

Accepted Answer

To integrate security and risk management activities into the system development life cycle. The RMF's core purpose is to integrate security, privacy, and risk management into every phase of the system development life cycle. It provides a structured process for categorizing systems, selecting and implementing controls, assessing them, authorizing operation, and monitoring continuously. It manages rather than eliminates risk and does not transfer accountability.

Answer

To transfer all system risk to the cloud service provider or integrator

Answer

To certify that a system meets a fixed security baseline regardless of mission needs

Answer

To eliminate all residual risk before the system is authorized to operate

Question 5

An ISSEP supports a defense program using the Risk Management Framework (RMF). The system has an approved Authorization to Operate (ATO). During continuous monitoring, a new Common Vulnerabilities and Exposures (CVE) is published that affects a component in the production environment. The vulnerability has a CVSS base score of 8.1, but the component is not exposed to any untrusted network and no known exploit exists. The program manager asks the ISSEP to determine the immediate next step. Which action is MOST appropriate?

Accepted Answer

Evaluate the vulnerability against the system's security controls and assess the potential impact to the authorization, then document the results in the continuous monitoring record.. The RMF continuous monitoring step requires the ISSEP to assess new vulnerabilities in the context of the system's authorization boundary, existing controls, and mission impact. Because the affected component is not exposed and no exploit exists, the appropriate action is to evaluate and document the risk rather than take disruptive action or ignore it. This maintains the ATO while keeping risk management current.

Answer

Immediately revoke the ATO and require the system to undergo a full reauthorization by the Authorizing Official.

Answer

Immediately remove the component from the production environment and replace it with a different vendor's product.

Answer

Ignore the vulnerability because the CVSS score does not matter when the component is not network-exposed.

Question 6

An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?

Accepted Answer

False Acceptance Rate (FAR). The risk of an unauthorized individual being granted access is quantified by the False Acceptance Rate (FAR). FAR directly measures the likelihood of a biometric false positive, which is a security concern. The ISSEP should use FAR to assess the risk and then determine if additional controls are needed. Other metrics like FRR and EER address different aspects and do not isolate the false acceptance risk.

Answer

Equal Error Rate (EER)

Answer

Crossover Error Rate (CER)

Answer

False Rejection Rate (FRR)

Question 7

An ISSEP is reviewing the security architecture of a system that will be accredited under the DoD Information Assurance Certification and Accreditation Process successor, the RMF. The system owner proposes to accept a known configuration weakness because compensating controls reduce the exploit likelihood. Before endorsing the risk acceptance, which action must the ISSEP take to ensure the decision is defensible?

Accepted Answer

Document the weakness, the compensating controls, and the residual risk in the Plan of Action and Milestones and obtain Authorizing Official acceptance. A defensible risk acceptance requires documenting the weakness, the compensating controls, and the resulting residual risk, then obtaining formal acceptance from the Authorizing Official through the POA&M or equivalent risk acceptance record. This preserves accountability and an audit trail. Closing findings as false positives, undocumented waivers, or altering categorization do not satisfy that requirement.

Answer

Reclassify the weakness as a false positive in the vulnerability scanner and close the finding

Answer

Increase the system's FIPS 199 availability impact rating to offset the weakness

Answer

Waive the weakness without documentation because compensating controls are in place

Question 8

An ISSEP is performing a risk assessment for a new system that will process Controlled Unclassified Information (CUI). The system owner wants to use a cloud service provider (CSP) that stores data in multiple countries. The ISSEP must ensure compliance with applicable federal requirements. Which action should the ISSEP take FIRST?

Accepted Answer

Verify that the CSP has a FedRAMP authorization at the appropriate impact level and that the data residency aligns with federal requirements.. When selecting a CSP for federal CUI, the ISSEP must first confirm that the CSP holds a FedRAMP authorization at the correct impact level and that data residency complies with federal mandates. These are non-negotiable prerequisites. Only after these are verified should the ISSEP address contractual or technical controls like SLAs and encryption.

Answer

Require the CSP to encrypt all data at rest and in transit, then proceed with the selection.

Answer

Conduct a penetration test of the CSP's infrastructure to independently validate its security posture.

Answer

Negotiate a custom service-level agreement (SLA) with the CSP that includes penalties for data breaches.

Question 9

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where information must be shared with partner nations. The system uses a cross-domain solution (CDS) to transfer data between security domains. Which TWO of the following are the most critical risk factors to evaluate regarding the CDS? (Choose two.)

Accepted Answer

The CDS's ability to enforce data flow policies based on content and context.. The most critical risk factors for a CDS are its ability to enforce data flow policies and its resistance to bypass or covert channel attacks. These directly affect whether data is transferred only as authorized and whether the CDS can be subverted. Other factors like cost, size, or user load are secondary and do not directly compromise the security of cross-domain information sharing.

Answer

The number of users who will access the CDS simultaneously.

Answer

The physical size and weight of the CDS hardware.

Answer

The cost of the CDS compared to other security controls.

Question 10

An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)

Accepted Answer

Determining the potential adverse impacts to organizational operations, assets, and individuals. A system-level risk assessment must identify relevant threat sources and events and determine the potential adverse impacts on organizational operations, assets, and individuals. These two activities establish the likelihood and consequence dimensions the Authorizing Official needs. Product selection, exhaustive quantitative loss calculations, and premature authorization signatures are not essential components of the assessment itself.

Answer

Calculating the annualized loss expectancy for every asset in the enterprise enclave

Answer

Selecting the specific commercial product that will implement the cross-domain guard

Answer

Obtaining the Authorizing Official's signature on the Authority to Operate before beginning analysis

Question 11

An ISSEP is performing a system-level risk assessment for a new payroll application that will process employee bank account details. The system owner insists on using a proprietary, unpublished encryption algorithm because it is 'faster than AES.' Which risk response is MOST appropriate according to ISSEP risk management principles?

Accepted Answer

Reject the design and require the use of a NIST-approved, publicly vetted cryptographic algorithm such as AES-256 for data at rest and in transit.. The proprietary algorithm has no public cryptanalysis, so its vulnerability is unknown and cannot be reliably assessed. ISSEP risk management favors proven, standards-based controls. Mandating a NIST-approved algorithm such as AES-256 provides validated assurance, reduces likelihood of compromise, and meets regulatory expectations for PII protection. The other responses either accept unquantified risk, transfer only financial liability, or layer an unvetted cipher, none of which adequately mitigates the technical risk.

Answer

Accept the proprietary algorithm because performance is a valid risk trade-off if the system owner formally accepts the residual risk.

Answer

Transfer the cryptographic risk to the software vendor by requiring an indemnification clause in the procurement contract.

Answer

Mitigate the risk by adding a second layer of the same proprietary algorithm (double encryption) to increase the effective key strength.

Question 12

An ISSEP is reviewing a system's risk management plan. The plan states that risk will be assessed using a qualitative approach. Which of the following best describes a qualitative risk assessment?

Accepted Answer

It uses subjective ratings such as high, medium, and low to prioritize risks.. A qualitative risk assessment uses descriptive ratings such as high, medium, and low to characterize risk. This method is subjective but valuable for prioritizing risks when quantitative data is unavailable or not cost-effective to obtain. The other options describe quantitative techniques that involve monetary values or numerical simulations, which do not align with the stated qualitative approach.

Answer

It uses Monte Carlo simulations to model risk probabilities.

Answer

It calculates the Annualized Loss Expectancy (ALE) for each identified risk.

Answer

It assigns monetary values to assets and calculates expected annual loss.

Question 13

An ISSEP is conducting a risk assessment for a new system that will process Controlled Unclassified Information (CUI) on a government contract. The system owner proposes a purely qualitative risk assessment using a 5x5 likelihood-impact matrix because it is faster and cheaper. The contract requires compliance with NIST SP 800-171 and a defensible risk determination. Which action should the ISSEP recommend?

Accepted Answer

Perform a hybrid assessment that uses the qualitative matrix for initial screening and a quantitative analysis for high-impact risks.. The hybrid method is appropriate because it balances efficiency with defensibility. Qualitative screening quickly categorizes risks, while quantitative analysis of the most consequential risks provides the numeric basis needed for cost-benefit decisions and risk acceptance. This satisfies both the practical constraints of the project and the requirement for a defensible determination supporting CUI protection.

Answer

Accept the qualitative matrix because it satisfies the risk assessment requirement in NIST SP 800-171.

Answer

Replace the matrix with a full quantitative Monte Carlo simulation for every identified risk, regardless of severity.

Answer

Defer the risk assessment until the system is operational so that real incident data can be used instead of estimates.

Question 14

An ISSEP is assessing a border control system that uses biometric facial recognition for traveler verification. The system's FAR is 0.001 and FRR is 0.05 at the current threshold. The mission owner wants to reduce the chance of a false match to near zero. Which action should the ISSEP recommend FIRST?

Accepted Answer

Increase the decision threshold to lower the False Acceptance Rate, accepting a higher False Rejection Rate as a trade-off.. The mission owner wants to minimize false matches, which corresponds to lowering the False Acceptance Rate. In biometric systems, FAR and FRR are inversely related through the decision threshold. Increasing the threshold makes matching stricter, reducing FAR at the cost of higher FRR. This is the most direct, lowest-cost first action because it uses the existing system and can be tuned operationally. More complex changes like multimodal fusion or system replacement should be considered only if threshold tuning cannot achieve the required risk reduction.

Answer

Deploy a second, independent biometric modality such as iris recognition and require both to match for verification.

Answer

Reduce the size of the enrolled biometric template database to lower the probability of a random false match.

Answer

Replace facial recognition with a knowledge-based challenge-response system to eliminate biometric error rates entirely.

Question 15

An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?

Accepted Answer

The integrity of data before it is written to the blockchain may be compromised.. The most significant residual risk is that data integrity can be compromised before it is written to the blockchain. Blockchain provides immutability and tamper-evidence for data after it is recorded, but it cannot verify the truthfulness of the input. If an attacker can manipulate the logging source, false entries become permanently stored. Thus, the ISSEP should emphasize controls at the data origin.

Answer

The blockchain's cryptographic hash functions may be broken in the future.

Answer

The audit logs may become too large to store on the blockchain.

Answer

The blockchain's consensus algorithm may be vulnerable to a 51% attack.