ISC Security Planning And Engineering Practice Test 3 — 15 Questions

Question 1

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

Accepted Answer

Physical air-gapping and hardware-level encryption with HSMs.. Air-gapping (physical) combined with Hardware Security Modules (logical) provides the highest level of isolation for sensitive data.

Answer

Shared storage with ACLs.

Answer

VLAN tagging and firewall rules.

Answer

Container isolation with restricted network access.

Question 2

What is the primary objective of the 'Assessment' phase in the NIST RMF?

Accepted Answer

Verify that security controls are implemented correctly and operating as intended.. The Assessment phase is dedicated to determining if the selected security controls are correctly implemented and operating as intended.

Answer

Document the risk acceptance by the authorizing official.

Answer

Define the system's security impact level.

Answer

Deploy security software to endpoints.

Question 3

An ISSEP needs to secure inter-process communication (IPC) on a Linux host. Which feature should be configured to prevent unauthorized processes from accessing sensitive memory space?

Accepted Answer

Enable and configure SELinux with restrictive policies.. SELinux (Security-Enhanced Linux) is a mandatory access control (MAC) mechanism that enforces fine-grained policies to restrict processes from accessing memory, files, and other resources. By configuring SELinux with restrictive policies, an ISSEP can prevent unauthorized processes from accessing sensitive memory space, even if they run with elevated privileges. This directly addresses IPC security.

Answer

Set file permissions to 600.

Answer

Use a rootkit scanner.

Answer

Update the host kernel.

Question 4

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

Accepted Answer

POA&M (Plan of Action and Milestones).. The POA&M (Plan of Action and Milestones) is the document used to track security weaknesses and the progress of remediation efforts.

Answer

Risk Management Framework (RMF) Guide.

Answer

System Security Plan (SSP).

Answer

Security Assessment Report (SAR).

Question 5

An ISSEP is designing a secure storage solution for a database. To ensure data integrity, which mechanism is most reliable?

Accepted Answer

Implement continuous file integrity monitoring (FIM) with cryptographic hashing.. Continuous file integrity monitoring (FIM) with cryptographic hashing is the most reliable mechanism for ensuring data integrity because it detects unauthorized changes to files by comparing current hash values against known good baselines. This provides ongoing verification that data has not been altered, whether maliciously or accidentally. FIM is specifically designed to alert on integrity violations.

Answer

Use RAID 10 for storage redundancy.

Answer

Require multi-factor authentication for database access.

Answer

Perform daily backups to an offsite location.

Question 6

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Accepted Answer

Act as a centralized TLS termination and traffic inspection point.. A Load Balancer can serve as an SSL termination point, allowing the security team to inspect traffic for malware at a single, centralized ingress point.

Answer

Automatically patch all backend servers.

Answer

Remove the need for host-based firewalls.

Answer

Encrypt all backend data at rest.

Question 7

In a cloud environment, you must ensure that VM snapshots are encrypted. What is the most effective approach?

Accepted Answer

Enable the provider-level setting to enforce encryption for all new snapshots.. Configuring the account-level setting to enforce encryption on all new snapshots ensures that no unencrypted snapshots can be created by users.

Answer

Run a script to encrypt snapshots after they are created.

Answer

Train users to check the 'encrypt' box when taking snapshots.

Answer

Use an external scanner to identify and delete unencrypted snapshots.

Question 8

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

Accepted Answer

Adjust the baseline controls to address the specific system environment and mission.. Tailoring involves selecting, adapting, and supplementing controls to fit the specific mission and environment, rather than applying a blanket baseline.

Answer

Select all controls from the highest security baseline.

Answer

Exclude all controls that are difficult to implement.

Answer

Only apply controls that are mandated by law.

Question 9

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

Accepted Answer

Configure API Gateway rate limiting policies per user or per IP.. Implementing API rate limiting at the API Gateway level prevents single clients from overwhelming the backend services.

Answer

Require an API key for every request.

Answer

Load balance the API across more servers.

Answer

Use a custom header to validate the request source.

Question 10

What is the correct order of operations when handling a vulnerability in a production system according to the RMF?

Accepted Answer

Identify, Assess Risk, Remediate, Verify.. Identify (scan), analyze (risk), remediate, and verify (scan again).

Answer

Remediate, Identify, Assess Risk, Verify.

Answer

Identify, Remediate, Assess Risk, Authorize.

Answer

Authorize, Identify, Remediate, Verify.

Question 11

What is the primary goal of the 'Authorization' phase in the NIST RMF?

Accepted Answer

For the Authorizing Official to formally accept the system's risk.. The authorization phase is where the Authorizing Official (AO) reviews the security documentation and decides whether to accept the risk associated with operating the system.

Answer

To patch all identified vulnerabilities.

Answer

To define the system's security controls.

Answer

To set up the monitoring tools.

Question 12

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

Accepted Answer

X-Frame-Options: DENY or SAMEORIGIN.. The X-Frame-Options or Content-Security-Policy (CSP) with 'frame-ancestors' are the standard headers used to prevent clickjacking.

Answer

X-Content-Type-Options: nosniff.

Answer

Strict-Transport-Security: max-age=63072000.

Answer

X-XSS-Protection: 1; mode=block.

Question 13

During a system migration, you need to ensure integrity of transferred data. What is the best cryptographic method?

Accepted Answer

Use HMAC for the data stream.. Using HMAC (Hash-based Message Authentication Code) with a shared key ensures both integrity and authenticity of the data stream.

Answer

Use TLS 1.0.

Answer

Use a simple CRC32 checksum.

Answer

Use base64 encoding.

Question 14

Which TWO of the following are considered critical components of a Secure Software Development Life Cycle (SDLC)?

Accepted Answer

Threat Modeling.. Security requirements analysis and threat modeling are fundamental proactive steps in an SDLC.

Answer

Patching the OS of the build server.

Answer

Using a dark theme for the IDE.

Answer

Final penetration testing before release.

Question 15

Which TWO methods are effective for managing cryptographic keys in a cloud architecture?

Accepted Answer

Deploy a dedicated Hardware Security Module (HSM).. Using a managed Key Management Service (KMS) or a Hardware Security Module (HSM) are the industry standard approaches for secure key management.

Answer

Hardcode keys in the application source code.

Answer

Save keys as plain text files on the VM.

Answer

Store keys in environment variables.