ISC Risk Management — Timed 20 Questions

Question 1

An ISSEP is reviewing the 'Maintain' phase of the RMF for a system that has undergone a significant software update. What is the most critical activity to ensure that the system's security posture remains intact?

20 minute time limit — choose an answer to begin.

Accepted Answer

Conduct a Security Impact Analysis (SIA) to determine the extent of the changes.. Following a significant change, a re-assessment (or targeted assessment) is required to ensure that the security controls remain effective and that new vulnerabilities have not been introduced.

Answer

Perform a full system penetration test.

Answer

Notify the system users of the update.

Answer

Update the system backup schedule.

Question 2

An organization is deploying a serverless architecture (AWS Lambda). How does the risk of patch management change compared to a traditional IaaS model?

Accepted Answer

Patch management of the underlying host OS is handled by the cloud provider.. In a serverless model like AWS Lambda, the cloud provider manages the underlying host OS and the runtime environment (e.g., patching the Node.js or Python runtime). The user is responsible for their application code and dependencies, but not the infrastructure patching. Option A is correct, but the explanation should clarify that the provider manages the runtime environment as well.

Answer

Patch management complexity increases due to the number of functions.

Answer

The user must now use a specialized patching tool for the serverless platform.

Answer

The user is no longer responsible for any patching.

Question 3

You are designing an embedded system for a medical device. The device needs to store encryption keys securely. The hardware does not support a dedicated HSM or TPM. What is the most robust software-based alternative to protect these keys?

Accepted Answer

Use a password-based derivation function (PBKDF2) to store the keys.. A Trusted Execution Environment (TEE) like ARM TrustZone is a hardware-based security feature, which contradicts the constraint in the stem stating that the hardware does not support a dedicated security module. A purely software-based alternative when hardware features are absent would typically involve key derivation (like PBKDF2) combined with encryption, or obfuscation techniques.

Answer

Store the keys in a hardcoded configuration file.

Answer

Store the keys in the system's non-volatile memory (NVM) with XOR masking.

Answer

Utilize a TEE (e.g., ARM TrustZone) to isolate keys and perform cryptographic operations.

Question 4

An ISSEP needs to ensure that the development process follows secure coding standards. Which standard should the team adopt?

Accepted Answer

SEI CERT C Coding Standard.. The OWASP Application Security Verification Standard (ASVS) or the SEI CERT C/C++ Coding Standards are the industry-standard frameworks for implementing secure coding practices.

Answer

NIST SP 800-53.

Answer

ISO/IEC 27001.

Answer

ITIL v4.

Question 5

You are assessing a system that uses 'Homomorphic Encryption' for data processing. What is the primary operational trade-off the system designer must consider?

Accepted Answer

Significant computational overhead and latency.. Homomorphic encryption allows computation on encrypted data, but it is extremely resource-intensive, resulting in significant latency and performance overhead compared to processing unencrypted data.

Answer

Increased security of data at rest.

Answer

Incompatibility with standard database engines.

Answer

Complexity of key management.

Question 6

An ISSEP is assessing the risk of a supply chain attack on a system that uses commercial off-the-shelf (COTS) hardware with embedded firmware. The vendor provides a software bill of materials (SBOM) but does not allow independent firmware inspection. Which risk management strategy is MOST appropriate?

Accepted Answer

Mitigate the risk by implementing hardware-based attestation and continuous monitoring of firmware integrity, and document residual risk.. When firmware cannot be independently inspected, the ISSEP should implement mitigations such as hardware-based attestation and continuous integrity monitoring to detect tampering. This reduces the risk to an acceptable level and allows the system to operate while documenting residual risk. Accepting, transferring, or avoiding the risk without technical controls is less effective in this scenario.

Answer

Avoid the risk by replacing the COTS hardware with custom-developed hardware that can be fully inspected.

Answer

Transfer the risk by purchasing cyber insurance that covers supply chain attacks.

Answer

Accept the risk because the vendor provides an SBOM, which is sufficient to identify all components.

Question 7

An ISSEP is helping a program manager interpret the results of a system-level risk assessment. The assessment identified a vulnerability with a likelihood of 4 and an impact of 5 on a 1-5 scale. Which statement BEST describes how this risk should be communicated to the program manager?

Accepted Answer

The risk is high because a likelihood of 4 and impact of 5 combine to a high risk score that requires prioritized treatment.. Risk is commonly expressed as a function of likelihood and impact, often as their product or their intersection on a risk matrix. A likelihood of 4 and impact of 5 on a 1-5 scale yields a high risk score, signaling that the vulnerability could cause severe mission harm and is reasonably likely to occur. The ISSEP should communicate this as a high-priority risk so the program manager can allocate mitigation resources appropriately. Averaging the factors, treating them as independent, or waiting for monetary quantification all misrepresent the urgency.

Answer

The risk is medium because the average of likelihood and impact is 4.5, which falls in the medium range.

Answer

The risk is low because likelihood and impact are separate dimensions and should not be combined.

Answer

The risk cannot be evaluated until a monetary value is assigned to the impact, so the program manager should wait for a quantitative assessment.

Question 8

An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?

Accepted Answer

$50,000. The ALE is calculated by multiplying the SLE by the ARO (100,000 * 0.5 = 50,000).

Answer

$200,000

Answer

$500,000

Answer

$100,000

Question 9

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

Accepted Answer

The sensor firmware is not signed.. Supply chain integrity is compromised when the provenance of hardware or software cannot be verified, as this allows for the insertion of hardware Trojans or backdoors that bypass traditional security controls.

Answer

The sensor housing is not tamper-evident.

Answer

The sensors use an older version of Bluetooth.

Answer

The vendor does not provide a Service Level Agreement (SLA).

Question 10

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

Accepted Answer

Perform a firmware update using the manufacturer's signed secure update process.. Firmware vulnerabilities involving the TPM and secure boot chain represent a fundamental compromise of the root of trust. Remediation must prioritize the update of the firmware to restore the integrity of the secure boot sequence.

Answer

Update the security policy to include manual verification of boot logs.

Answer

Configure an IDS to block unauthorized firmware update attempts.

Answer

Disable TPM-based secure boot until the vendor releases a patch.

Question 11

An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?

Accepted Answer

That all cryptographic modules utilized by the system are FIPS 140-3 validated.. FIPS 140-3 is a U.S. government standard (superseding FIPS 140-2) that specifies security requirements for cryptographic modules. To claim FIPS 140-3 compliance, every cryptographic module the system relies on — for encryption, hashing, key generation, TLS, signing, etc. — must be validated under the CMVP (Cryptographic Module Validation Program) and appear on the NIST validated modules list. The ISSEP must verify this during design because swapping in a non-validated module later invalidates the entire compliance posture.

Answer

That the system uses TLS 1.3 for data in transit.

Answer

That the cloud management console uses Multi-Factor Authentication (MFA).

Answer

That the cloud provider's storage is encrypted at rest.

Question 12

You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?

Accepted Answer

Enforce physical network isolation using unidirectional security gateways to separate the control network from the enterprise network.. When a proprietary protocol defeats DPI and signature-based monitoring, the most reliable risk reduction is to remove the attack path entirely via physical/network isolation using unidirectional gateways (data diodes). This enforces a hardware-level guarantee that data can only flow out of the control network, preventing inbound attacks, lateral movement, and remote exploitation regardless of protocol obscurity. It is the strongest control available when you cannot inspect the traffic.

Answer

Replace the proprietary protocol with OPC-UA to enable standard security monitoring.

Answer

Implement a host-based firewall on the SCADA master station.

Answer

Deploy an intrusion detection system (IDS) that uses behavioral pattern matching.

Question 13

You are evaluating the risk of an Artificial Intelligence (AI) model deployment. The model is susceptible to 'model inversion' attacks, where an attacker can reconstruct sensitive training data. What is the most effective engineering control to prevent this?

Accepted Answer

Apply differential privacy techniques to the training process.. Model inversion attacks reconstruct sensitive training data by querying the model and analyzing its outputs, exploiting the model's tendency to memorize and leak information about its training set. Differential privacy adds calibrated noise during training so that the model's outputs are statistically indistinguishable whether or not any single individual's data was included, directly preventing reconstruction of specific training records. This is the most effective engineering control because it addresses the root cause — information leakage through model parameters.

Answer

Encrypt the model weights at rest.

Answer

Implement rate limiting on the model's API.

Answer

Retrain the model on a smaller, obfuscated dataset.

Question 14

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

Accepted Answer

Update the System Security Plan (SSP) to include the missing controls and implement the baseline via Infrastructure-as-Code (IaC) templates.. The RMF requires that security controls be implemented and documented. Identifying a missing baseline during the assessment phase necessitates updating the System Security Plan (SSP) and verifying the implementation of baseline controls before proceeding to the 'Authorize' step.

Answer

Modify the Security Assessment Plan (SAP) to exclude the container layer from the current assessment scope.

Answer

Proceed to authorization and defer the container baseline to the next Continuous Monitoring cycle.

Answer

Request a waiver from the Chief Information Security Officer (CISO) for container orchestration security.

Question 15

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

Accepted Answer

Encapsulate the API behind an authenticated API gateway that enforces OAuth 2.0.. In engineering, when a component is inherently vulnerable, compensating controls like API gateways that perform authentication and authorization can effectively mitigate the risk without modifying the legacy component.

Answer

Accept the risk because the API is internal-facing.

Answer

Disable the API entirely.

Answer

Monitor API logs for suspicious activity.

Question 16

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

Accepted Answer

Implement VLAN segmentation to isolate the workstation from the PLC network.. Network segmentation, particularly by isolating critical control devices from general-purpose administrative workstations, is a foundational risk mitigation strategy in ICS security.

Answer

Require MFA for workstation access.

Answer

Install an antivirus on the workstation.

Answer

Disable all unused ports on the PLC network switch.

Question 17

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

Accepted Answer

Increased risk of data exposure through a single point of compromise.. A centralized PII database creates a single aggregation point: one successful compromise (SQL injection, credential theft, misconfigured access) exposes the entire PII dataset at once. This violates the principle of minimizing blast radius and is the primary architectural risk, which is why regulations like GDPR and CCPA push for data minimization, segmentation, and encryption. The other options describe operational concerns, not the core security risk of centralization.

Answer

Incompatibility with cloud-based storage.

Answer

Increased latency for data retrieval.

Answer

Difficulty in performing data backups.

Question 18

An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?

Accepted Answer

Risk of cross-tenant data leakage via side-channel attacks.. The 'noisy neighbor' or cross-tenant data leakage risk is inherent to multi-tenant architectures where shared hardware/hypervisor resources could potentially be exploited to access data from another tenant.

Answer

Risk of unauthorized access by the cloud provider's employees.

Answer

Difficulty in performing system backups.

Answer

Risk of data loss due to provider bankruptcy.

Question 19

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

Accepted Answer

Implement constant-time cryptographic algorithms to eliminate timing signatures.. Side-channel attacks on HSMs exploit observable physical characteristics such as timing variations, power consumption, or electromagnetic emanations that correlate with secret key operations. Constant-time cryptographic algorithms execute in a fixed number of cycles regardless of input values, eliminating the timing signature that attackers use to infer key bits. This directly addresses the root cause of the timing side-channel rather than merely restricting access or increasing key size.

Answer

Implement a dual-factor authentication requirement for HSM access.

Answer

Increase the length of the RSA keys.

Answer

Use a larger number of HSMs in a cluster.

Question 20

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

Accepted Answer

The System Security Plan (SSP).. The System Security Plan (SSP) is the foundational document that documents all security requirements, controls, and their implementation for a system. It captures the system boundary, control implementations, and inherited controls, making it the authoritative source for ensuring all security requirements are identified and addressed during a risk assessment. Reviewing the SSP first ensures the ISSEP has a complete picture of what controls are required and how they are implemented.

Answer

The vendor's marketing materials.

Answer

The project budget.

Answer

The organizational chart.