ISC Security Planning And Engineering — 15 Questions

Question 1

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.. Referencing the Security Group ID of the web tier within the inbound rules of the application tier's Security Group ensures only traffic from authorized instances is accepted, regardless of IP changes.

Answer

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Answer

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Answer

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.

Question 2

An ISSEP is conducting a gap analysis between a legacy system and ISO/IEC 27001 requirements. The system lacks automated audit logging. Which control implementation is most effective for meeting the 'Logging and Monitoring' requirements?

Accepted Answer

Implement centralized log aggregation using a SIEM solution with automated alerting.. If the system lacks automated audit logging, implementing a SIEM (Option A) does not solve the root problem of the system not generating the logs in the first place. The ISSEP must first enable or configure the audit logging mechanisms within the OS or application before aggregation can occur.

Answer

Redirect all logs to a local write-only file system on each server.

Answer

Disable unnecessary services to reduce the attack surface.

Answer

Require manual review of system event logs by administrators weekly.

Question 3

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

Accepted Answer

The IdP must digitally sign the SAML assertion.. While signing is the primary mechanism for integrity, the SAML 2.0 specification allows for either the Assertion or the Response (or both) to be signed. The explanation should clarify that signing the assertion is the standard method to prevent tampering, but the IdP must sign at least one of these elements to ensure integrity.

Answer

Use a shared secret between the IdP and SP.

Answer

Use HTTPS with TLS 1.3 for transport.

Answer

The Service Provider must encrypt the assertion.

Question 4

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 5

An ISSEP is configuring an AWS S3 bucket. What policy setting best prevents public access while allowing access from a specific VPC?

Accepted Answer

Bucket Policy with 'Condition' element matching 'aws:SourceVpc'.. Using an S3 Bucket Policy with a 'Condition' block that checks the 'aws:SourceVpc' key is the standard way to restrict access to a private network.

Answer

Enable 'Block Public Access' and ACLs.

Answer

Create an IAM role for every user in the VPC.

Answer

Use an S3 Pre-signed URL.

Question 6

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

Accepted Answer

Role-Based Access Control (RBAC).. Encryption (AES-256) and strong access controls (RBAC) are standard for high-impact data protection.

Answer

Storing data only in the local cache.

Answer

Disabling all audit logging.

Answer

Using cleartext storage for performance.

Question 7

Which THREE of the following are recognized categories of security controls in NIST SP 800-53?

Accepted Answer

Operational.. NIST SP 800-53 classifies security controls into three families: Management, Operational, and Technical. However, the provided options list 'Physical' as wrong, when in fact Physical is a recognized control class in NIST SP 800-53 (often grouped under Operational or as a distinct category depending on the revision context). More importantly, the provided options A, D, and E are correct, but the labeling in the provided options list is inconsistent with the explanation.

Answer

Physical.

Answer

Financial.

Question 8

Which THREE methods can be used to ensure high availability for a database in a secure architecture?

Accepted Answer

Multi-region deployment.. Active-passive failover, replication (read replicas), and multi-region deployment are the standard HA methods for databases.

Answer

Ignoring error logs.

Answer

Running the database on a single server.

Question 9

Which THREE items should be included in an Incident Response (IR) plan for an information system?

Accepted Answer

Communication and notification procedures.. An IR plan must include roles and responsibilities, specific procedures for different attack types, and communication/reporting protocols.

Answer

The history of the company logo.

Answer

The CEO's personal home phone number.

Question 10

An ISSEP architect is designing a system under NIST SP 800-53 controls and needs to implement an automated mechanism to enforce the principle of least privilege for non-privileged accounts. Which configuration in an AWS environment best aligns with the 'AC-6' control requirement?

Accepted Answer

Apply AWS IAM Permission Boundaries to define the maximum permissions for user roles.. AWS IAM Permission Boundaries allow an architect to set the maximum permissions an identity-based policy can grant, effectively enforcing least privilege at scale without managing individual inline policies.

Answer

Use AWS Trusted Advisor to identify unused IAM credentials.

Answer

Enable AWS CloudTrail organization-level logging.

Answer

Implement AWS Config rules for S3 bucket public access blocks.

Question 11

When mapping security requirements from ISO/IEC 27001 to a cloud-native architecture, you are configuring Azure Policy to ensure all newly created storage accounts have 'Secure transfer required' enabled. What is the most efficient way to achieve this enforcement?

Accepted Answer

Create an Azure Policy assignment with a 'Deny' effect for the 'Storage account secure transfer' definition.. Azure Policy is the native tool for policy enforcement; 'DeployIfNotExists' or 'Deny' effects prevent non-compliant resources from existing.

Answer

Configure Microsoft Defender for Cloud to trigger an alert on insecure storage.

Answer

Set up a Logic App to delete non-compliant storage accounts.

Answer

Use Azure Blueprint to deploy a hardened ARM template.

Question 12

You are conducting a threat modeling exercise using the STRIDE methodology. A specific service-to-service communication path lacks mutual TLS. Which STRIDE category does this vulnerability primarily fall under?

Accepted Answer

Information Disclosure. Lack of mutual TLS (mTLS) primarily allows an attacker to intercept traffic (Information Disclosure) and modify traffic in transit (Tampering). While mTLS provides authentication, the primary vulnerabilities exposed by unencrypted and unauthenticated channels are Tampering and Information Disclosure. In standard STRIDE threat modeling (e.g., Microsoft's guidelines), lack of encryption maps to Information Disclosure, and lack of integrity/signing maps to Tampering. Furthermore, the explanation mentions Tampering and Spoofing interchangeably while C and D are wrong, but Information Disclosure is the standard STRIDE category for lack of encryption (confidentiality).

Answer

Denial of Service

Answer

Spoofing

Answer

Elevation of Privilege

Question 13

An ISSEP is leading the security engineering effort for a new Department of Defense (DoD) information system that will process Controlled Unclassified Information (CUI). The system owner requires that the system be assessed and authorized using the Risk Management Framework (RMF). The ISSEP must determine which set of controls to use as the basis for the security plan. Which document should the ISSEP use to select the security controls?

Accepted Answer

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). DoD Instruction 8510.01 is the governing document for the RMF within the DoD. It mandates the use of DoD control baselines, which are tailored from NIST SP 800-53 and include overlays for CUI. While NIST SP 800-53 and SP 800-171 provide the foundational controls, the DoD-specific instruction ensures the correct selection and implementation for DoD systems. Thus, the ISSEP must use DoDI 8510.01 to select the appropriate security controls.

Answer

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

Answer

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Answer

CNSSI 1253, Security Categorization and Control Selection for National Security Systems

Question 14

An ISSEP is defining the security requirements for a new cross-domain solution that will transfer data between a Secret enclave and an Unclassified enclave. The design must enforce a strict information flow policy. Which TWO mechanisms should the ISSEP specify to satisfy this requirement? (Choose two.)

Accepted Answer

A high-assurance guard that enforces a pre-approved, data-type-specific release policy on all transfers. Strict cross-domain information flow requires a mediated release policy plus a physically enforced direction. A high-assurance guard performs the policy-based content release, while a data diode guarantees the transfer direction cannot be reversed. Together they ensure that only approved data types cross and that no covert return path exists, which general-purpose hosts and encrypted channels cannot provide.

Answer

A shared storage area network (SAN) volume mounted read-only by both enclaves

Answer

TLS 1.3 mutual authentication between a client in each enclave and a shared broker

Answer

A demilitarized zone (DMZ) built from general-purpose servers with host-based intrusion prevention systems

Question 15

An ISSEP is conducting a security architecture review for a system that will process Controlled Unclassified Information (CUI) in a cloud environment. The system must comply with NIST SP 800-171. The ISSEP needs to ensure that the cloud provider's shared responsibility model is properly addressed. Which TWO responsibilities remain with the organization under the shared responsibility model for IaaS? (Choose two.)

Accepted Answer

Patch management of the guest operating system. Under the IaaS shared responsibility model, the organization is responsible for securing the guest operating system, including patch management, and for configuring virtual network security groups. The cloud provider is responsible for physical security and hypervisor management. Encryption of data at rest is a shared responsibility, but the organization must ensure it is implemented; however, the provider often supplies the encryption capability. The two clear organizational responsibilities are patching the guest OS and configuring network security groups.

Answer

Encryption of data at rest in the cloud provider's storage

Answer

Management of the hypervisor

Answer

Physical security of the data center