ISC Security Planning And Engineering Practice Test 2 — 15 Questions

Question 1

An ISSEP is developing a security architecture for a new system that will process Controlled Unclassified Information (CUI) for a federal agency. The system will be hosted in a commercial cloud environment. The agency requires compliance with NIST SP 800-171. Which TWO security requirements from NIST SP 800-171 are MOST directly related to protecting CUI at rest and in transit? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement cryptographic mechanisms to protect the confidentiality of CUI at rest.. The two NIST SP 800-171 requirements that most directly protect CUI at rest and in transit are 3.13.16 (cryptographic mechanisms for CUI at rest) and 3.13.8 (cryptographic mechanisms for CUI during transmission). These are core technical controls for data protection in a cloud-hosted system. The other options address mobile device encryption, training, and social media, which are less directly tied to the general protection of CUI at rest and in transit.

Answer

Establish and maintain a security awareness and training program.

Answer

Encrypt CUI on mobile devices and mobile computing platforms.

Answer

Control and manage the use of social media and networking sites.

Question 2

An ISSEP is performing a security architecture review for a system that uses a service-oriented architecture (SOA). The system integrates multiple web services, some of which are exposed to external partners. The ISSEP must ensure that the architecture addresses the risk of injection attacks across service boundaries. Which design approach BEST mitigates this risk?

Accepted Answer

Implement a centralized API gateway that performs input validation and schema validation for all incoming requests.. The best design approach to mitigate injection attacks across service boundaries is to implement a centralized API gateway that performs input validation and schema validation for all incoming requests. This creates a consistent, enforceable security checkpoint that all traffic must pass through, reducing the chance that any single service's validation weaknesses can be exploited. Other options are either too narrow or address different security concerns.

Answer

Use parameterized queries for all database access within each service.

Answer

Require each service to implement its own input validation using a common library.

Answer

Encrypt all service-to-service communication using TLS 1.3.

Question 3

An ISSEP is working on a system that will be authorized under the NIST Risk Management Framework (RMF). The system owner asks when the Plan of Action and Milestones (POA&M) should be initially developed and what its primary purpose is. Which statement accurately describes the POA&M in the RMF process?

Accepted Answer

The POA&M is initiated during the Prepare step and is used to track the status of remediation activities for identified weaknesses.. The POA&M is a living document that is initiated early in the RMF process, often during the Prepare step, and is used to track remediation of identified weaknesses. It is not limited to post-authorization or the Select step. The correct answer reflects that the POA&M supports continuous monitoring and informed risk-based authorization decisions by documenting planned actions and milestones.

Answer

The POA&M is created after authorization and only includes weaknesses that were not remediated before the authorization decision.

Answer

The POA&M is created during the Assess step and documents all identified vulnerabilities for remediation.

Answer

The POA&M is developed during the Select step and identifies controls that cannot be implemented.

Question 4

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 5

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

Accepted Answer

Authorization Code Flow with PKCE.. The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the industry-standard security best practice for mobile applications to prevent authorization code interception.

Answer

Client Credentials Flow.

Answer

Resource Owner Password Credentials Flow.

Answer

Implicit Flow.

Question 6

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

Accepted Answer

Use Cloud HSM to store keys and keep raw PII in an on-premises database.. Data at rest is kept on-premises in a sovereign zone, while ephemeral processing is performed in the cloud, utilizing encryption with customer-managed keys (CMK) stored on-premises to ensure control.

Answer

Implement a full database mirror in the cloud without encryption.

Answer

Migrate all data to the cloud and rely on the Cloud Service Provider's encryption-at-rest.

Answer

Use public cloud object storage and rely on IP whitelisting.

Question 7

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

Accepted Answer

Implement Istio with mTLS and AuthorizationPolicies.. Using a service mesh like Istio enables mTLS and granular authorization policies (RBAC) between microservices, which is the standard implementation for least privilege in containerized environments.

Answer

Use the default ClusterRoleBinding for all pods.

Answer

Deploy all microservices into a single flat network segment.

Answer

Enable Kubernetes NetworkPolicies only at the namespace level.

Question 8

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

Accepted Answer

Select security and privacy controls.. The RMF sequence is: Categorize, Select, Implement, Assess, Authorize, Monitor. Selecting controls follows categorization.

Answer

Implement security and privacy controls.

Answer

Monitor security and privacy controls.

Answer

Assess security and privacy controls.

Question 9

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

Accepted Answer

Enable 'SQL Injection' and 'Cross-Site Scripting' inspection in the WAF policy.. Configuring specific SQL Injection (SQLi) and Cross-Site Scripting (XSS) rules that inspect request bodies and query parameters is the primary method for blocking injection attacks at the WAF.

Answer

Enable 'TLS Termination' to offload encryption.

Answer

Enable 'Geo-blocking' to restrict access to local users only.

Answer

Enable 'Rate Limiting' on all incoming traffic.

Question 10

An ISSEP must secure a server-to-server connection that currently uses plaintext LDAP. What is the recommended secure alternative?

Accepted Answer

Migrate to LDAPS (LDAP over TLS) on port 636.. LDAPS (LDAP over TLS/SSL) on port 636 is the industry-standard way to encrypt LDAP traffic.

Answer

Use LDAP with Kerberos binding only.

Answer

Use IPsec to encrypt traffic between servers.

Answer

Use a VPN tunnel.

Question 11

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

Accepted Answer

Evaluate access requests based on context, identity, and policy to issue a decision.. The PDP is the central engine that evaluates requests against security policies and context to make an 'allow' or 'deny' decision.

Answer

Enforce the access decision on the network resource.

Answer

Monitor network traffic for anomalous behavior.

Answer

Store user authentication credentials.

Question 12

When designing an information system architecture, what is the primary role of a System Security Plan (SSP)?

Accepted Answer

Document the system boundaries, security controls, and implementation details.. The SSP is the foundational document that describes the system boundaries, security controls, and how they are implemented to satisfy requirements.

Answer

Record the results of security control assessments.

Answer

List the vulnerabilities found during a scan.

Answer

Define the business strategy for the organization.

Question 13

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Accepted Answer

Implement pre-commit hooks to scan for patterns of secrets.. Pre-commit hooks and automated secret scanning tools (e.g., git-secrets or GitHub Advanced Security) are the most effective preventive controls.

Answer

Rotate all secrets after every deployment.

Answer

Use environment variables for all configuration.

Answer

Delete the repository history periodically.

Question 14

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

Accepted Answer

Verify the module is on the NIST CMVP validated list.. The cryptographic module must be explicitly listed on the CMVP (Cryptographic Module Validation Program) validated list, not just 'based on' an algorithm.

Answer

Ensure the vendor claims the product is FIPS compliant.

Answer

Ensure the product is open source.

Answer

Verify the algorithms are AES-256.

Question 15

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

Accepted Answer

Statement of Applicability (SoA).. The Statement of Applicability (SoA) is the required document in ISO 27001 that outlines which controls are applicable and provides justifications for those that are excluded.

Answer

Risk Assessment Report (RAR).

Answer

System Security Plan (SSP).

Answer

Business Impact Analysis (BIA).