ISC Risk Management — Timed 10 Questions

Question 1

An ISSEP is reviewing the 'Maintain' phase of the RMF for a system that has undergone a significant software update. What is the most critical activity to ensure that the system's security posture remains intact?

10 minute time limit — choose an answer to begin.

Accepted Answer

Conduct a Security Impact Analysis (SIA) to determine the extent of the changes.. Following a significant change, a re-assessment (or targeted assessment) is required to ensure that the security controls remain effective and that new vulnerabilities have not been introduced.

Answer

Perform a full system penetration test.

Answer

Notify the system users of the update.

Answer

Update the system backup schedule.

Question 2

An organization is deploying a serverless architecture (AWS Lambda). How does the risk of patch management change compared to a traditional IaaS model?

Accepted Answer

Patch management of the underlying host OS is handled by the cloud provider.. In a serverless model like AWS Lambda, the cloud provider manages the underlying host OS and the runtime environment (e.g., patching the Node.js or Python runtime). The user is responsible for their application code and dependencies, but not the infrastructure patching. Option A is correct, but the explanation should clarify that the provider manages the runtime environment as well.

Answer

Patch management complexity increases due to the number of functions.

Answer

The user must now use a specialized patching tool for the serverless platform.

Answer

The user is no longer responsible for any patching.

Question 3

You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?

Accepted Answer

Use a password-based derivation function (PBKDF2) to store the keys.. A Trusted Execution Environment (TEE) like ARM TrustZone is a hardware-based security feature, which contradicts the constraint in the stem stating that the hardware does not support a dedicated security module. A purely software-based alternative when hardware features are absent would typically involve key derivation (like PBKDF2) combined with encryption, or obfuscation techniques.

Answer

Store the keys in a hardcoded configuration file.

Answer

Store the keys in the system's non-volatile memory (NVM) with XOR masking.

Answer

Utilize a TEE (e.g., ARM TrustZone) to isolate keys and perform cryptographic operations.

Question 4

An ISSEP needs to ensure that the development process follows secure coding standards. Which standard should the team adopt?

Accepted Answer

SEI CERT C Coding Standard.. The OWASP Application Security Verification Standard (ASVS) or the SEI CERT C/C++ Coding Standards are the industry-standard frameworks for implementing secure coding practices.

Answer

NIST SP 800-53.

Answer

ISO/IEC 27001.

Answer

ITIL v4.

Question 5

You are assessing a system that uses 'Homomorphic Encryption' for data processing. What is the primary operational trade-off the system designer must consider?

Accepted Answer

Significant computational overhead and latency.. Homomorphic encryption allows computation on encrypted data, but it is extremely resource-intensive, resulting in significant latency and performance overhead compared to processing unencrypted data.

Answer

Increased security of data at rest.

Answer

Incompatibility with standard database engines.

Answer

Complexity of key management.

Question 6

An ISSEP is assessing the risk of a supply chain attack on a system that uses commercial off-the-shelf (COTS) hardware with embedded firmware. The vendor provides a software bill of materials (SBOM) but does not allow independent firmware inspection. Which risk management strategy is MOST appropriate?

Accepted Answer

Mitigate the risk by implementing hardware-based attestation and continuous monitoring of firmware integrity, and document residual risk.. When firmware cannot be independently inspected, the ISSEP should implement mitigations such as hardware-based attestation and continuous integrity monitoring to detect tampering. This reduces the risk to an acceptable level and allows the system to operate while documenting residual risk. Accepting, transferring, or avoiding the risk without technical controls is less effective in this scenario.

Answer

Avoid the risk by replacing the COTS hardware with custom-developed hardware that can be fully inspected.

Answer

Transfer the risk by purchasing cyber insurance that covers supply chain attacks.

Answer

Accept the risk because the vendor provides an SBOM, which is sufficient to identify all components.

Question 7

An ISSEP is helping a program manager interpret the results of a system-level risk assessment. The assessment identified a vulnerability with a likelihood of 4 and an impact of 5 on a 1-5 scale. Which statement BEST describes how this risk should be communicated to the program manager?

Accepted Answer

The risk is high because a likelihood of 4 and impact of 5 combine to a high risk score that requires prioritized treatment.. Risk is commonly expressed as a function of likelihood and impact, often as their product or their intersection on a risk matrix. A likelihood of 4 and impact of 5 on a 1-5 scale yields a high risk score, signaling that the vulnerability could cause severe mission harm and is reasonably likely to occur. The ISSEP should communicate this as a high-priority risk so the program manager can allocate mitigation resources appropriately. Averaging the factors, treating them as independent, or waiting for monetary quantification all misrepresent the urgency.

Answer

The risk is medium because the average of likelihood and impact is 4.5, which falls in the medium range.

Answer

The risk is low because likelihood and impact are separate dimensions and should not be combined.

Answer

The risk cannot be evaluated until a monetary value is assigned to the impact, so the program manager should wait for a quantitative assessment.

Question 8

An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. The ALE is calculated by multiplying the SLE by the ARO (100,000 * 0.5 = 50,000).

Answer

$200,000

Answer

$500,000

Answer

$100,000

Question 9

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

Accepted Answer

The sensor firmware is not signed.. Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.

Answer

The sensor housing is not tamper-evident.

Answer

The sensors use an older version of Bluetooth.

Answer

The vendor does not provide a Service Level Agreement (SLA).

Question 10

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

Accepted Answer

Perform a firmware update using the manufacturer's signed secure update process.. Firmware vulnerabilities involving the TPM and secure boot chain represent a fundamental compromise of the root of trust. Remediation must prioritize the update of the firmware to restore the integrity of the secure boot sequence.

Answer

Update the security policy to include manual verification of boot logs.

Answer

Configure an IDS to block unauthorized firmware update attempts.

Answer

Disable TPM-based secure boot until the vendor releases a patch.