ISC Risk Management Practice Test 5 — 15 Questions

Question 1

An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement network segmentation with industrial firewalls to isolate the PLCs from the corporate network and the internet.. For unpatched legacy PLCs, the most effective compensating controls are network segmentation with industrial firewalls and strict physical access controls. These measures reduce the attack surface and prevent unauthorized access, which are critical when patching is not an option. Other options are either infeasible or do not directly address the vulnerabilities of the PLCs.

Answer

Replace all legacy PLCs with new models that support patching.

Answer

Deploy host-based antivirus software directly on the PLCs.

Answer

Require all operators to use multi-factor authentication (MFA) when logging into the PLCs.

Question 2

An ISSEP is performing a system-level risk assessment for a new payroll processing system that will operate in a shared datacenter. The system owner insists on using a qualitative risk matrix because the organization lacks reliable historical incident data. During validation, the ISSEP notes that two different assessors assigned the same threat scenario to different likelihood categories, and the risk scores diverged significantly. Which action best addresses this inconsistency while preserving the qualitative approach?

Accepted Answer

Define explicit ordinal scales with documented criteria and anchor examples for each likelihood and impact level, then calibrate assessors against them.. The inconsistency stems from ambiguous likelihood and impact definitions, not from the qualitative method itself. Establishing explicit ordinal scales with documented criteria and anchor examples gives assessors a common reference, and calibration exercises align their judgments. This directly corrects the divergence while retaining the qualitative approach that the missing historical data makes necessary. Averaging, escalation, or switching to quantitative methods does not fix the definitional ambiguity.

Answer

Replace the qualitative matrix with a purely quantitative Annualized Loss Expectancy (ALE) calculation using industry-average exposure factors.

Answer

Escalate every disputed scenario to the Authorizing Official for a final risk determination before the assessment can continue.

Answer

Average the two assessors' likelihood ratings for every scenario and use the mean value as the final likelihood category.

Question 3

An ISSEP is leading a system-level risk assessment for a new command-and-control (C2) system that will operate on a classified network. The program manager asks which activities are required to ensure the assessment supports a defensible authorization decision. (Choose two.)

Accepted Answer

Identify and document the system's mission, architecture, and boundary so risk is assessed in the correct operational context.. A defensible risk assessment begins with a clear understanding of the system's mission, architecture, and boundary, and then systematically evaluates threats and vulnerabilities to document likelihood and impact. These activities produce the evidence an authorizing official needs. Neither eliminating residual risk nor relying on vendor marketing nor minimizing cost alone can substitute for a rigorous, context-aware analysis.

Answer

Select controls based only on the lowest implementation cost to stay within the program budget.

Answer

Ensure all residual risk is reduced to zero before submitting the authorization package for approval.

Answer

Rely solely on the vendor's security whitepaper as the primary source of vulnerability information for the C2 system.

Question 4

An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?

Accepted Answer

Continuously monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official.. Continuous monitoring under RMF is an ongoing process of monitoring security controls, assessing changes, and reporting the security posture to the Authorizing Official. This enables timely risk-based decisions and maintains the authorization. Periodic activities like full assessments or penetration tests are supporting elements, not the primary focus.

Answer

Performing an annual penetration test to identify new vulnerabilities.

Answer

Updating the system security plan (SSP) only when a major change occurs.

Answer

Conducting a full security assessment every three years to renew the ATO.

Question 5

An ISSEP is facilitating a risk assessment workshop for an Engineered System that controls a regional electrical substation. The system owner insists that the design is safe because every identified threat has an assigned countermeasure, and the residual risk register shows no entries above the organization's risk tolerance. Before the system can be accredited, the ISSEP must confirm that the risk management process has accounted for which of the following?

Accepted Answer

The aggregate effect of multiple low-severity residual risks interacting within the same trust boundary.. Residual risks that each fall below the stated tolerance can still produce unacceptable exposure when they share a trust boundary, a communication path, or a common failure mode. The ISSEP's duty in the risk management domain is to ensure the assessment addresses aggregate and cumulative risk before accreditation, not merely per-threat compliance or framework alignment.

Answer

That the Annualized Loss Expectancy for each threat has been recalculated using a Single Loss Expectancy derived from the replacement cost of the substation.

Answer

Whether each countermeasure was selected from a Common Criteria Protection Profile listed on the NIAP product compliant list.

Answer

That the system has been certified against the NIST Cybersecurity Framework version 2.0 before the Authorizing Official signs the accreditation decision.

Question 6

An ISSEP is integrating a commercial off-the-shelf (COTS) component into a system that will process Controlled Unclassified Information (CUI). The vendor provides a self-signed statement of conformity but no independent assessment. The program needs to characterize the supply chain risk before the component enters the authorization boundary. Which approach best supports an informed supply chain risk determination?

Accepted Answer

Obtain independent third-party assessment artifacts and software bill of materials (SBOM) data, then analyze them against the program's supply chain risk criteria.. A self-signed statement of conformity is an unverified assertion, so the program needs objective evidence. Independent third-party assessment artifacts plus SBOM data expose provenance, dependencies, and known weaknesses, allowing the ISSEP to evaluate the component against defined supply chain criteria. This produces a defensible risk characterization before the component crosses the authorization boundary, which is the point at which the decision must be informed.

Answer

Defer the supply chain risk assessment until after authorization, relying on continuous monitoring to detect component issues in production.

Answer

Require the vendor to complete a security questionnaire and map the responses to the organization's supply chain risk controls.

Answer

Accept the vendor's statement of conformity at face value because COTS products are outside the program's configuration control.

Question 7

An ISSEP is reviewing the risk management strategy for an organization deploying a new cloud-based email service. The organization wants to transfer as much risk as possible to the cloud provider. Which action should the ISSEP recommend to clarify what risk can actually be transferred?

Accepted Answer

Review the cloud service provider's shared responsibility matrix and service level agreements to determine which controls the provider owns.. Risk transfer in cloud services depends on the shared responsibility model. The provider owns security of the cloud, while the customer owns security in the cloud. Reviewing the responsibility matrix and SLAs reveals which controls and risks the provider assumes and which remain with the organization. Only after that mapping can the ISSEP advise on insurance, contractual terms, or additional controls.

Answer

Require the cloud provider to accept unlimited liability for any breach involving the organization's data.

Answer

Assume that signing a cloud contract transfers all security risk to the provider because the provider operates the infrastructure.

Answer

Purchase cyber insurance to transfer all remaining risk after the cloud migration is complete.

Question 8

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where multiple nations will share data. The system owner asks which risk factors are MOST important to evaluate during the assessment. (Choose two.)

Accepted Answer

Differing national data protection and export control regulations that govern how shared data may be stored and transmitted.. Coalition environments introduce risk from divergent legal and regulatory frameworks as well as from inconsistent incident response capabilities. Data protection and export control laws determine lawful handling of shared information, while incident response variations affect how quickly and effectively a breach can be contained across partners. Both factors directly influence likelihood and impact of security events. UI branding, documentation translation, and typing speed are usability or ergonomic concerns that do not materially change the system's security risk profile.

Answer

The average keyboard typing speed of operators in each participating nation.

Answer

The physical color scheme and branding of the user interface used by each coalition partner.

Answer

The number of languages into which the system's help documentation has been translated.

Question 9

An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?

Accepted Answer

Escalate the finding to the Authorizing Official with an assessment of the risk and recommended alternatives, since risk acceptance authority rests with that official.. Accepting risk to an accredited system is the Authorizing Official's prerogative. The ISSEP's proper contribution is a clear risk analysis and escalation with alternatives, preserving both the technical record and the formal accountability chain. Unilateral action or informal acceptance would bypass the authorization framework that governs classified systems.

Answer

Direct the operations team to encrypt the tapes immediately and update the security plan, since the ISSEP has authority over security configuration of accredited systems.

Answer

Document the risk acceptance in the plan of action and milestones and allow the system owner to proceed without further action.

Answer

Perform a new quantitative risk assessment to calculate the Annualized Loss Expectancy of tape loss and let the resulting dollar value determine whether the risk is acceptable.

Question 10

During a risk assessment of a distributed system, the ISSEP identifies that a critical cryptographic module is nearing its end of support and the vendor will stop issuing firmware patches. The module cannot be replaced before the next authorization cycle, but the system must continue operating. Which risk response best fits the ISSEP's role at this stage?

Accepted Answer

Document the residual risk, propose compensating controls such as network isolation and enhanced monitoring, and present the options to the Authorizing Official for a risk decision.. The ISSEP supports risk-informed decisions rather than making them. With the module unable to be replaced before the next cycle, the appropriate action is to document the residual risk, propose compensating controls that constrain exposure, and present the trade-offs to the Authorizing Official. This keeps the system operating as required while ensuring the acceptance decision is made by the accountable authority with full awareness.

Answer

Immediately remove the module from the authorization boundary and accept the resulting loss of functionality as a necessary security trade-off.

Answer

Delay the risk assessment until the next authorization cycle so the module's replacement can be evaluated together with other system changes.

Answer

Accept the risk on behalf of the system owner because the module still meets its original certification and no exploit is currently known.

Question 11

An ISSEP is assessing a system that uses an air-gapped network for processing highly sensitive data. The security team argues that because the network is air-gapped, risk from external threat actors is negligible and no further analysis is needed. Which response should the ISSEP provide?

Accepted Answer

Explain that air gaps reduce network-based attack paths but do not remove risk from insider threats, supply chain compromise, or removable media, so a full risk assessment is still required.. Air gaps change the threat landscape but do not eliminate risk. External actors can still reach the system through insiders, compromised supply chain components, or removable media. The ISSEP must ensure the risk assessment considers all credible attack paths and vulnerabilities, not just network-based ones, so that controls and residual risk are properly understood and documented.

Answer

Agree, because air gaps eliminate all network-based attack paths and therefore eliminate external risk.

Answer

State that risk analysis is only needed for systems connected to public networks, so the air-gapped system is exempt.

Answer

Recommend removing the air gap and connecting the network to the enterprise so that centralized monitoring tools can be deployed.

Question 12

An ISSEP is evaluating a new Engineered System that will be deployed across three geographically separated sites. The program manager wants to reuse a risk assessment performed two years ago for a similar system at a single site to save schedule time. Which factor most directly determines whether the earlier assessment can be reused?

Accepted Answer

Whether the new system's architecture, operating environment, and threat landscape are sufficiently similar to those covered by the earlier assessment.. Prior risk assessments are reusable only to the extent that the system, its environment, and the threat landscape remain comparable. Expanding from one site to three changes connectivity, physical exposure, and potentially the threat profile, so the ISSEP must validate scope and assumptions before relying on earlier findings.

Answer

Whether the new program has budget available to commission a fresh assessment from an independent third party.

Answer

Whether the earlier assessment was signed by the same Authorizing Official who will accredit the new system.

Answer

Whether the earlier assessment used the same risk scoring scale, such as a five-by-five likelihood and impact matrix.

Question 13

An ISSEP is reviewing the risk management framework for a defense program. The program uses a continuous monitoring strategy that includes automated vulnerability scanning and configuration compliance checks. A recent audit found that findings are being generated but not consistently reviewed or remediated within the program's defined timelines. Which action should the ISSEP recommend to address the ROOT cause?

Accepted Answer

Establish and enforce a formal risk management process with defined roles, review cadences, and escalation paths for continuous monitoring findings.. The audit finding describes a process failure: findings are generated but not consistently reviewed or remediated. The root cause is the absence of defined accountability, review cadence, and escalation. Increasing scan frequency, changing tools, or reducing scope all address symptoms or workload rather than the governance gap. Establishing a formal risk management process with clear roles, scheduled reviews, and escalation paths creates the structure needed to ensure findings are acted upon within the program's timelines.

Answer

Reduce the scope of continuous monitoring to only critical vulnerabilities so that fewer findings require review.

Answer

Increase the frequency of automated vulnerability scans from weekly to daily to generate more complete data.

Answer

Replace the automated scanning tools with a different vendor's product that has better reporting dashboards.

Question 14

An ISSEP is reviewing a system's risk register and notices that several entries list only the threat source and the affected asset, without any statement of the potential mission consequence. The system owner asks why consequence information is necessary when the threat and asset are already recorded. What is the most accurate justification for including consequence detail?

Accepted Answer

Consequence detail enables prioritization and supports the Authorizing Official in determining whether the residual risk is acceptable for the mission.. Risk combines likelihood with consequence, so a register that omits consequence cannot convey risk magnitude. Consequence detail allows findings to be ranked, remediation to be prioritized, and the Authorizing Official to judge whether residual risk is tolerable for the mission. It links technical findings to mission outcomes, which is precisely the information decision-makers need and the reason the register exists.

Answer

Consequence detail replaces the need to identify threat sources because the impact alone determines the appropriate control set.

Answer

Consequence detail is primarily used to calculate the Annualized Loss Expectancy for each risk entry in the register.

Answer

Consequence detail is required only for systems processing classified information, so it can be omitted for unclassified systems.

Question 15

An ISSEP is evaluating a proposed change to a system that will introduce a new external interface for partner data exchange. The change is scheduled for next week, and the program manager wants to skip a formal risk assessment to meet the deadline. Which action should the ISSEP take?

Accepted Answer

Perform an abbreviated risk assessment focused on the new interface, document the findings, and present them to the authorizing official for a decision.. When a change introduces a new external interface, a focused risk assessment of that change is appropriate and can be completed quickly. Documenting the findings and presenting them to the authorizing official preserves the decision-making process and provides an auditable record. This approach respects both the schedule and the need to manage risk, rather than skipping assessment or blocking the change entirely.

Answer

Approve the change without assessment because the schedule is tight and the interface is with a trusted partner.

Answer

Reject the change outright because no changes are permitted without a full system-level reassessment.

Answer

Defer the risk assessment until after the interface is deployed and operating, then assess based on real traffic.