ISC Security Planning And Engineering Practice Test 5 — 15 Questions

Question 1

An ISSEP is drafting the security architecture for a new federal financial system. The system will process moderate-impact data and must follow the NIST Risk Management Framework (RMF). The system owner asks which document provides the initial allocation of security controls to the system based on the security categorization. Which document should the ISSEP reference?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Control baseline from NIST SP 800-53B. The RMF Select step begins with a control baseline from NIST SP 800-53B based on the system's security categorization. For a moderate-impact system, the moderate baseline is the starting point. The ISSEP then tailors the baseline by applying scoping guidance, compensating controls, and organization-defined parameters. The SSP, SAR, and POA&M are later artifacts that document implementation, assessment, and remediation, not the initial allocation.

Answer

Plan of Action and Milestones (POA&M)

Answer

System Security Plan (SSP)

Answer

Security Assessment Report (SAR)

Question 2

An ISSEP is drafting the initial security documentation for a new federal payroll system before any controls have been implemented. The authorizing official wants a document that records the system boundary, the security categorization, and the security controls selected from NIST SP 800-53 Rev. 5, and that will serve as the primary artifact supporting the authorization decision throughout the RMF. Which document should the ISSEP produce?

Accepted Answer

System Security Plan (SSP). The System Security Plan is the central RMF artifact that describes the system boundary, the FIPS 199 security categorization, the tailored NIST SP 800-53 Rev. 5 control baseline, and the implementation status of each control. The authorizing official relies on it together with the SAR and POA&M to accept risk, and it must be maintained current across the system lifecycle.

Answer

Security Assessment Report (SAR)

Answer

Information System Contingency Plan (ISCP)

Answer

Plan of Action and Milestones (POA&M)

Question 3

An ISSEP is developing the security architecture for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to reuse an existing authorization package from a similar system to reduce costs. The ISSEP must ensure the reuse is valid under the NIST Risk Management Framework (RMF) and NIST SP 800-37 Rev. 2. Which action best supports this goal?

Accepted Answer

Conduct a gap analysis between the security controls of the existing system and the requirements for the new system, and update the security plan accordingly.. Reusing an authorization package under the NIST RMF requires a gap analysis to ensure the existing controls meet the new system's requirements. NIST SP 800-37 Rev. 2 emphasizes that the ISSEP must evaluate differences in environment, data sensitivity, and risk. Updating the security plan based on this analysis ensures that the authorization decision is based on accurate, system-specific information, maintaining compliance and security effectiveness.

Answer

Implement all security controls from the existing system verbatim in the new system and document them in the security plan.

Answer

Obtain a new authorization to operate (ATO) from the authorizing official without additional assessment, citing the existing ATO.

Answer

Perform a security control assessment of the existing system and document any differences in the security plan.

Question 4

An ISSEP is designing a secure network architecture for a Department of Defense (DoD) system that must comply with the NIST Risk Management Framework (RMF) and DoD Instruction 8510.01. The system will use a demilitarized zone (DMZ) to host a public-facing web server. The ISSEP must ensure that the DMZ design follows the principle of least privilege and prevents direct access to the internal network. Which design approach best meets these requirements?

Accepted Answer

Segment the DMZ from the internal network using a firewall that allows only specific, necessary traffic from the DMZ to the internal network.. A DMZ must be isolated from the internal network by a firewall that enforces least privilege. Only specific, necessary traffic should be allowed from the DMZ to the internal network. This limits the impact of a compromised public-facing server. Other options either place the server in the internal network, allow routing between networks, or rely solely on VLANs, which are insufficient for a secure DMZ.

Answer

Use a dual-homed host with two network interfaces: one connected to the DMZ and one to the internal network, with routing enabled.

Answer

Place the web server in the internal network and use a reverse proxy in the DMZ to forward requests.

Answer

Connect the DMZ and internal network to the same VLAN but use VLAN access control lists (VACLs) to filter traffic.

Question 5

An ISSEP is designing a cross-domain solution (CDS) to allow data transfer between a high-assurance network and a low-assurance network. The solution must enforce a strict one-way flow of data and prevent any possibility of a covert channel back to the high side. Which architectural approach BEST satisfies this requirement?

Accepted Answer

A data diode that physically enforces unidirectional data flow.. A data diode provides a hardware-enforced one-way data path, making it impossible for data to flow from the low side back to the high side. This eliminates covert channels through the transfer mechanism itself. Other solutions like firewalls, VPNs, or proxies are software- or configuration-based and remain bidirectional in principle, so they cannot guarantee the strict unidirectional requirement for a high-assurance CDS.

Answer

A VPN tunnel with IPsec in transport mode between the two networks.

Answer

A dual-homed firewall with stateful inspection and strict ACLs.

Answer

A proxy server that inspects and filters application-layer data.

Question 6

An ISSEP is designing a secure network architecture for a defense contractor that must comply with NIST SP 800-171. The system will handle CUI and requires protection against advanced persistent threats (APTs). The ISSEP proposes using a demilitarized zone (DMZ) with firewalls and intrusion detection systems. Which additional architectural control is most critical to satisfy the NIST SP 800-171 requirement for boundary protection?

Accepted Answer

Establish controlled interfaces at all external and internal boundaries, including subnetworks for publicly accessible components.. NIST SP 800-171 requirement 3.13.1 mandates monitoring, controlling, and protecting communications at external and key internal boundaries. It also requires subnetworks for publicly accessible components. Establishing controlled interfaces at all boundaries directly satisfies this by filtering and inspecting traffic, limiting connections to essential services, and segmenting public-facing components from internal networks. This is the most critical architectural control for boundary protection.

Answer

Deploy a web application firewall (WAF) at the internet boundary to inspect HTTP traffic.

Answer

Implement a screened subnet with stateful firewalls and a proxy for all outbound traffic.

Answer

Encrypt all data in transit using TLS 1.3 between all internal and external endpoints.

Question 7

An ISSEP is designing a secure network architecture for a system that must support remote users accessing sensitive data. The system owner has mandated the use of a VPN to protect data in transit. The ISSEP must select a VPN protocol that provides confidentiality, integrity, and mutual authentication. Which protocol should the ISSEP choose?

Accepted Answer

IPsec in tunnel mode with IKEv2. IPsec in tunnel mode with IKEv2 is the only option that provides all three required security services: confidentiality, integrity, and mutual authentication. IKEv2 supports strong authentication methods, including certificates and EAP, enabling mutual authentication. PPTP, L2TP without IPsec, and SSL/TLS VPN with only server-side certificates either lack encryption, integrity, or mutual authentication. Therefore, IPsec with IKEv2 is the correct protocol for this scenario.

Answer

L2TP without IPsec

Answer

PPTP with MS-CHAPv2

Answer

SSL/TLS VPN using only server-side certificates

Question 8

You are an ISSEP leading the security architecture review for a new command-and-control system. The system will process classified information and must support defense in depth. The program manager asks which two principles are most critical to apply when defining the security architecture to ensure resilience against advanced persistent threats. (Choose two.)

Accepted Answer

Separation of duties. Least privilege and separation of duties are fundamental security engineering principles that directly support defense in depth. Least privilege minimizes the access granted to users and processes, reducing the blast radius of a compromise. Separation of duties ensures that critical actions require multiple authorized individuals, preventing single-point failures and insider threats. Together they strengthen resilience against advanced persistent threats.

Answer

Single sign-on (SSO)

Answer

Open network trust

Answer

Security through obscurity

Question 9

An ISSEP is developing a security architecture for a system that will use a service-oriented architecture (SOA) with multiple web services. The system must ensure that messages are protected end-to-end and that services can verify the identity of the sender. Which TWO security standards or specifications should be incorporated into the architecture to meet these requirements? (Choose two.)

Accepted Answer

SAML 2.0. WS-Security and SAML 2.0 together provide message-level security and identity federation for SOA. WS-Security secures SOAP messages with signatures and encryption, ensuring end-to-end protection. SAML 2.0 supplies assertions that verify the sender's identity and attributes. Used together, they allow services to authenticate the sender and maintain message integrity across intermediaries, which is essential for a secure service-oriented architecture.

Answer

OpenID Connect

Answer

OAuth 2.0

Answer

TLS 1.3

Question 10

An ISSEP is leading the security engineering effort for a new cloud-based system that will process sensitive but unclassified information. The system must comply with FedRAMP Moderate baseline. The ISSEP is selecting security controls from NIST SP 800-53 Rev. 5. Which TWO controls are most appropriate to address the risk of unauthorized access to data at rest in the cloud environment? (Choose two.)

Accepted Answer

SC-28 Protection of Information at Rest. SC-28 and SC-13 are the most appropriate controls because they directly address the protection of data at rest through cryptographic means. SC-28 mandates protection of information at rest, while SC-13 ensures the use of validated cryptographic modules. Together, they provide confidentiality and integrity for stored data in a cloud environment, meeting FedRAMP Moderate requirements. Other controls like account management, logging, and configuration settings are supportive but do not directly protect data at rest.

Answer

AC-2 Account Management

Answer

CM-6 Configuration Settings

Answer

AU-2 Event Logging

Question 11

An ISSEP is leading the security engineering effort for a new Department of Defense information system that will process classified data at the Secret level. The system will be deployed on a shared enclave. The program manager asks which NIST publication should be used as the primary source for selecting and specifying security controls for this system.

Accepted Answer

NIST SP 800-53. The primary source for selecting and specifying security controls for a federal information system, including DoD systems processing classified data, is NIST SP 800-53. It provides the control catalog that supports the RMF Select step. SP 800-37 defines the process, SP 800-171 targets nonfederal CUI, and SP 800-160 offers systems security engineering guidance—none of which replace the control catalog.

Answer

NIST SP 800-171

Answer

NIST SP 800-37

Answer

NIST SP 800-160

Question 12

An ISSEP is conducting a security architecture review for a system that will process classified information. The system owner wants to ensure that the architecture includes appropriate boundary defense mechanisms. The ISSEP must recommend controls that provide boundary defense. Which two controls should the ISSEP recommend? (Choose two.)

Accepted Answer

Using access control lists (ACLs) on boundary routers. Boundary defense controls are those that protect the network perimeter, such as firewalls, DMZs, and router ACLs. A DMZ with dual-homed firewalls and ACLs on boundary routers both provide traffic filtering and segmentation at the boundary. HIDS, encryption at rest, and security awareness training are important but do not serve as boundary defense mechanisms. Therefore, the correct recommendations are the DMZ with dual-homed firewalls and the use of ACLs on boundary routers.

Answer

Encrypting all data at rest using AES-256

Answer

Implementing host-based intrusion detection systems (HIDS) on all servers

Answer

Conducting regular security awareness training for all users

Question 13

You are an ISSEP designing a cross-domain solution (CDS) that will allow data to flow from a low-assurance network to a high-assurance network. The security requirement is to ensure that only authorized data transfers occur and that the high side is protected from malicious content. Which architectural approach best meets this requirement?

Accepted Answer

Deploy a cross-domain solution with a content filter and protocol break.. A cross-domain solution with content filtering and protocol break is designed to securely transfer data between security domains of different classifications. The content filter inspects and sanitizes data to remove malicious content and enforce data transfer policies. The protocol break terminates and re-originates protocols, preventing protocol-based attacks. This combination ensures only authorized transfers occur and protects the high side.

Answer

Implement a firewall with strict ACLs between the networks.

Answer

Use a data diode to enforce one-way flow from low to high.

Answer

Use a VPN tunnel to encrypt data in transit between the networks.

Question 14

An ISSEP is reviewing the security architecture of a system that uses a trusted platform module (TPM) for hardware root of trust. The system must ensure that the boot process is measured and that the integrity of the boot components can be verified remotely. Which TPM feature should be used to achieve this?

Accepted Answer

Platform Configuration Registers (PCRs) with remote attestation.. Platform Configuration Registers (PCRs) are used to store measurements of boot components, creating a record of the boot process. Remote attestation allows a remote party to verify these measurements by having the TPM sign them with an Attestation Identity Key. This combination provides a hardware-rooted assurance that the boot process is unmodified, meeting the requirement for measured boot and remote verification.

Answer

Sealed storage using the Storage Root Key (SRK).

Answer

Endorsement Key (EK) for cryptographic operations.

Answer

Attestation Identity Key (AIK) for signing PCR values.

Question 15

An ISSEP is designing a cross-domain solution (CDS) to allow data to flow from a Secret network to an Unclassified network. The CDS must enforce a strict one-way transfer with content filtering. Which security principle is MOST critical to verify during the design review to prevent data leakage from the higher classification to the lower?

Accepted Answer

The CDS enforces a unidirectional data flow using a data diode or equivalent hardware.. For a cross-domain solution that must allow data to flow only from a higher classification to a lower one, the most critical design principle is enforcing a unidirectional data flow, typically through a data diode or hardware-enforced one-way transfer. This physical guarantee prevents any return path or covert channel that could leak data. Content filtering and encryption are supporting mechanisms but do not replace the fundamental one-way property.

Answer

The CDS implements a guard that performs content filtering and protocol break.

Answer

The CDS uses encryption to protect data in transit between the two networks.

Answer

The CDS uses a dual-diode architecture with separate hardware for each direction.