ISC Security Planning And Engineering — 30 Questions

Question 1

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 2

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

Accepted Answer

Authorization Code Flow with PKCE.. The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the industry-standard security best practice for mobile applications to prevent authorization code interception.

Answer

Client Credentials Flow.

Answer

Resource Owner Password Credentials Flow.

Answer

Implicit Flow.

Question 3

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

Accepted Answer

Use Cloud HSM to store keys and keep raw PII in an on-premises database.. Data at rest is kept on-premises in a sovereign zone, while ephemeral processing is performed in the cloud, utilizing encryption with customer-managed keys (CMK) stored on-premises to ensure control.

Answer

Implement a full database mirror in the cloud without encryption.

Answer

Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.

Answer

Use public cloud object storage and rely on IP whitelisting.

Question 4

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

Accepted Answer

Implement Istio with mTLS and AuthorizationPolicies.. Using a service mesh like Istio enables mTLS and granular authorization policies (RBAC) between microservices, which is the standard implementation for least privilege in containerized environments.

Answer

Use the default ClusterRoleBinding for all pods.

Answer

Deploy all microservices into a single flat network segment.

Answer

Enable Kubernetes NetworkPolicies only at the namespace level.

Question 5

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

Accepted Answer

Select security and privacy controls.. The RMF sequence is: Categorize, Select, Implement, Assess, Authorize, Monitor. Selecting controls follows categorization.

Answer

Implement security and privacy controls.

Answer

Monitor security and privacy controls.

Answer

Assess security and privacy controls.

Question 6

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

Accepted Answer

Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.. Referencing the Security Group ID of the web tier within the inbound rules of the application tier's Security Group ensures only traffic from authorized instances is accepted, regardless of IP changes.

Answer

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Answer

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Answer

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.

Question 7

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

Accepted Answer

Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.. Configuring specific SQL Injection (SQLi) and Cross-Site Scripting (XSS) rules that inspect request bodies and query parameters is the primary method for blocking injection attacks at the WAF.

Answer

Enable 'TLS Termination' to offload encryption.

Answer

Enable 'Geo-blocking' to restrict access to local users only.

Answer

Enable 'Rate Limiting' on all incoming traffic.

Question 8

An ISSEP is conducting a gap analysis between a legacy system and ISO/IEC 27001 requirements. The system lacks automated audit logging. Which control implementation is most effective for meeting the 'Logging and Monitoring' requirements?

Accepted Answer

Implement centralized log aggregation using a SIEM solution with automated alerting.. Centralized log management (like a SIEM) allows for aggregation, alerting, and forensic analysis, which is fundamental to ISO 27001 compliance.

Answer

Redirect all logs to a local write-only file system on each server.

Answer

Disable unnecessary services to reduce the attack surface.

Answer

Require manual review of system event logs by administrators weekly.

Question 9

An ISSEP must secure a server-to-server connection that currently uses plaintext LDAP. What is the recommended secure alternative?

Accepted Answer

Migrate to LDAPS (LDAP over TLS) on port 636.. LDAPS (LDAP over TLS/SSL) on port 636 is the industry-standard way to encrypt LDAP traffic.

Answer

Use LDAP with Kerberos binding only.

Answer

Use IPsec to encrypt traffic between servers.

Answer

Use a VPN tunnel.

Question 10

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 11

When designing an information system architecture, what is the primary role of a System Security Plan (SSP)?

Accepted Answer

Document the system boundaries, security controls, and implementation details.. The SSP is the foundational document that describes the system boundaries, security controls, and how they are implemented to satisfy requirements.

Answer

Record the results of security control assessments.

Answer

List the vulnerabilities found during a scan.

Answer

Define the business strategy for the organization.

Question 12

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 13

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

Accepted Answer

Verify the module is on the NIST CMVP validated list.. The cryptographic module must be explicitly listed on the CMVP (Cryptographic Module Validation Program) validated list, not just 'based on' an algorithm.

Answer

Ensure the vendor claims the product is FIPS compliant.

Answer

Ensure the product is open source.

Answer

Verify the algorithms are AES-256.

Question 14

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Accepted Answer

Statement of Applicability (SoA).. The Statement of Applicability (SoA) is the required document in ISO 27001 that outlines which controls are applicable and provides justifications for those that are excluded.

Answer

Risk Assessment Report (RAR).

Answer

System Security Plan (SSP).

Answer

Business Impact Analysis (BIA).

Question 15

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

Accepted Answer

Physical air-gapping and hardware-level encryption with HSMs.. Air-gapping (physical) combined with Hardware Security Modules (logical) provides the highest level of isolation for sensitive data.

Answer

Shared storage with ACLs.

Answer

VLAN tagging and firewall rules.

Answer

Container isolation with restricted network access.

Question 16

What is the primary objective of the 'Assessment' phase in the NIST RMF?

Accepted Answer

Verify that security controls are implemented correctly and operating as intended.. The Assessment phase is dedicated to determining if the selected security controls are correctly implemented and operating as intended.

Answer

Document the risk acceptance by the authorizing official.

Answer

Define the system's security impact level.

Answer

Deploy security software to endpoints.

Question 17

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

Accepted Answer

The IdP must digitally sign the SAML assertion.. SAML assertions must be digitally signed by the Identity Provider (IdP) to ensure integrity and authenticity.

Answer

Use a shared secret between the IdP and SP.

Answer

Use HTTPS with TLS 1.3 for transport.

Answer

The Service Provider must encrypt the assertion.

Question 18

An ISSEP needs to secure inter-process communication (IPC) on a Linux host. Which feature should be configured to prevent unauthorized processes from accessing sensitive memory space?

Accepted Answer

Enable and configure SELinux with restrictive policies.. SELinux (Security-Enhanced Linux) provides Mandatory Access Control (MAC) that limits process access to system resources, including memory.

Answer

Set file permissions to 600.

Answer

Use a rootkit scanner.

Answer

Update the host kernel.

Question 19

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

Accepted Answer

POA&M (Plan of Action and Milestones).. The POA&M (Plan of Action and Milestones) is the document used to track security weaknesses and the progress of remediation efforts.

Answer

Risk Management Framework (RMF) Guide.

Answer

System Security Plan (SSP).

Answer

Security Assessment Report (SAR).

Question 20

An ISSEP is designing a secure storage solution for a database. To ensure data integrity, which mechanism is most reliable?

Accepted Answer

Implement continuous file integrity monitoring (FIM) with cryptographic hashing.. Hashing data periodically and comparing it against a known good baseline is the most reliable way to detect unauthorized modifications (integrity failure).

Answer

Use RAID 10 for storage redundancy.

Answer

Require multi-factor authentication for database access.

Answer

Perform daily backups to an offsite location.