ISC Security Planning And Engineering — Timed 30 Questions

Question 1

When configuring AWS Security Groups for a multi-tier application architecture, an engineer must ensure that the web tier only communicates with the application tier on port 8080. Which configuration best adheres to the principle of Defense in Depth?

30 minute time limit — choose an answer to begin.

Accepted Answer

Set the application tier inbound rule to allow TCP 8080 from the specific Security Group ID of the web tier.. Referencing the Security Group ID of the web tier within the inbound rules of the application tier's Security Group ensures only traffic from authorized instances is accepted, regardless of IP changes.

Answer

Set the application tier inbound rule to allow TCP 8080 from 0.0.0.0/0.

Answer

Use an IP-based rule in the application tier Security Group referencing the private IP of the web tier instances.

Answer

Set the application tier inbound rule to allow TCP 8080 from the CIDR block of the VPC.

Question 2

An ISSEP is conducting a gap analysis between a legacy system and ISO/IEC 27001 requirements. The system lacks automated audit logging. Which control implementation is most effective for meeting the 'Logging and Monitoring' requirements?

Accepted Answer

Implement centralized log aggregation using a SIEM solution with automated alerting.. If the system lacks automated audit logging, implementing a SIEM (Option A) does not solve the root problem of the system not generating the logs in the first place. The ISSEP must first enable or configure the audit logging mechanisms within the OS or application before aggregation can occur.

Answer

Redirect all logs to a local write-only file system on each server.

Answer

Disable unnecessary services to reduce the attack surface.

Answer

Require manual review of system event logs by administrators weekly.

Question 3

A system uses SAML 2.0 for SSO. To prevent SAML assertion tampering, what is the mandatory cryptographic requirement?

Accepted Answer

The IdP must digitally sign the SAML assertion.. While signing is the primary mechanism for integrity, the SAML 2.0 specification allows for either the Assertion or the Response (or both) to be signed. The explanation should clarify that signing the assertion is the standard method to prevent tampering, but the IdP must sign at least one of these elements to ensure integrity.

Answer

Use a shared secret between the IdP and SP.

Answer

Use HTTPS with TLS 1.3 for transport.

Answer

The Service Provider must encrypt the assertion.

Question 4

When designing a secure multi-tenant cloud application, what is the best way to ensure tenant data isolation?

Accepted Answer

Implement row-level security (RLS) in the database for each tenant.. Row-level security (RLS) within a database or using separate database instances per tenant ensures that one tenant cannot access another's data.

Answer

Use a single global admin account for all tenants.

Answer

Rely on application-level filtering.

Answer

Use a shared database with a common schema for all tenants.

Question 5

An ISSEP is configuring an AWS S3 bucket. What policy setting best prevents public access while allowing access from a specific VPC?

Accepted Answer

Bucket Policy with 'Condition' element matching 'aws:SourceVpc'.. Using an S3 Bucket Policy with a 'Condition' block that checks the 'aws:SourceVpc' key is the standard way to restrict access to a private network.

Answer

Enable 'Block Public Access' and ACLs.

Answer

Create an IAM role for every user in the VPC.

Answer

Use an S3 Pre-signed URL.

Question 6

Which TWO controls are recommended under NIST SP 800-53 for protecting data at rest in a high-impact system?

Accepted Answer

Role-Based Access Control (RBAC).. Encryption (AES-256) and strong access controls (RBAC) are standard for high-impact data protection.

Answer

Storing data only in the local cache.

Answer

Disabling all audit logging.

Answer

Using cleartext storage for performance.

Question 7

Which THREE of the following are recognized categories of security controls in NIST SP 800-53?

Accepted Answer

Operational.. NIST SP 800-53 classifies security controls into three families: Management, Operational, and Technical. However, the provided options list 'Physical' as wrong, when in fact Physical is a recognized control class in NIST SP 800-53 (often grouped under Operational or as a distinct category depending on the revision context). More importantly, the provided options A, D, and E are correct, but the labeling in the provided options list is inconsistent with the explanation.

Answer

Physical.

Answer

Financial.

Question 8

Which THREE methods can be used to ensure high availability for a database in a secure architecture?

Accepted Answer

Multi-region deployment.. Active-passive failover, replication (read replicas), and multi-region deployment are the standard HA methods for databases.

Answer

Ignoring error logs.

Answer

Running the database on a single server.

Question 9

Which THREE items should be included in an Incident Response (IR) plan for an information system?

Accepted Answer

Communication and notification procedures.. An IR plan must include roles and responsibilities, specific procedures for different attack types, and communication/reporting protocols.

Answer

The history of the company logo.

Answer

The CEO's personal home phone number.

Question 10

An ISSEP architect is designing a system under NIST SP 800-53 controls and needs to implement an automated mechanism to enforce the principle of least privilege for non-privileged accounts. Which configuration in an AWS environment best aligns with the 'AC-6' control requirement?

Accepted Answer

Apply AWS IAM Permission Boundaries to define the maximum permissions for user roles.. AWS IAM Permission Boundaries allow an architect to set the maximum permissions an identity-based policy can grant, effectively enforcing least privilege at scale without managing individual inline policies.

Answer

Use AWS Trusted Advisor to identify unused IAM credentials.

Answer

Enable AWS CloudTrail organization-level logging.

Answer

Implement AWS Config rules for S3 bucket public access blocks.

Question 11

When mapping security requirements from ISO/IEC 27001 to a cloud-native architecture, you are configuring Azure Policy to ensure all newly created storage accounts have 'Secure transfer required' enabled. What is the most efficient way to achieve this enforcement?

Accepted Answer

Create an Azure Policy assignment with a 'Deny' effect for the 'Storage account secure transfer' definition.. Azure Policy is the native tool for policy enforcement; 'DeployIfNotExists' or 'Deny' effects prevent non-compliant resources from existing.

Answer

Configure Microsoft Defender for Cloud to trigger an alert on insecure storage.

Answer

Set up a Logic App to delete non-compliant storage accounts.

Answer

Use Azure Blueprint to deploy a hardened ARM template.

Question 12

You are conducting a threat modeling exercise using the STRIDE methodology. A specific service-to-service communication path lacks mutual TLS. Which STRIDE category does this vulnerability primarily fall under?

Accepted Answer

Information Disclosure. Lack of mutual TLS (mTLS) primarily allows an attacker to intercept traffic (Information Disclosure) and modify traffic in transit (Tampering). While mTLS provides authentication, the primary vulnerabilities exposed by unencrypted and unauthenticated channels are Tampering and Information Disclosure. In standard STRIDE threat modeling (e.g., Microsoft's guidelines), lack of encryption maps to Information Disclosure, and lack of integrity/signing maps to Tampering. Furthermore, the explanation mentions Tampering and Spoofing interchangeably while C and D are wrong, but Information Disclosure is the standard STRIDE category for lack of encryption (confidentiality).

Answer

Denial of Service

Answer

Spoofing

Answer

Elevation of Privilege

Question 13

An ISSEP is leading the security engineering effort for a new Department of Defense (DoD) information system that will process Controlled Unclassified Information (CUI). The system owner requires that the system be assessed and authorized using the Risk Management Framework (RMF). The ISSEP must determine which set of controls to use as the basis for the security plan. Which document should the ISSEP use to select the security controls?

Accepted Answer

DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD Information Technology (IT). DoD Instruction 8510.01 is the governing document for the RMF within the DoD. It mandates the use of DoD control baselines, which are tailored from NIST SP 800-53 and include overlays for CUI. While NIST SP 800-53 and SP 800-171 provide the foundational controls, the DoD-specific instruction ensures the correct selection and implementation for DoD systems. Thus, the ISSEP must use DoDI 8510.01 to select the appropriate security controls.

Answer

NIST SP 800-53, Security and Privacy Controls for Information Systems and Organizations

Answer

NIST SP 800-171, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Answer

CNSSI 1253, Security Categorization and Control Selection for National Security Systems

Question 14

An ISSEP is defining the security requirements for a new cross-domain solution that will transfer data between a Secret enclave and an Unclassified enclave. The design must enforce a strict information flow policy. Which TWO mechanisms should the ISSEP specify to satisfy this requirement? (Choose two.)

Accepted Answer

A high-assurance guard that enforces a pre-approved, data-type-specific release policy on all transfers. Strict cross-domain information flow requires a mediated release policy plus a physically enforced direction. A high-assurance guard performs the policy-based content release, while a data diode guarantees the transfer direction cannot be reversed. Together they ensure that only approved data types cross and that no covert return path exists, which general-purpose hosts and encrypted channels cannot provide.

Answer

A shared storage area network (SAN) volume mounted read-only by both enclaves

Answer

TLS 1.3 mutual authentication between a client in each enclave and a shared broker

Answer

A demilitarized zone (DMZ) built from general-purpose servers with host-based intrusion prevention systems

Question 15

An ISSEP is conducting a security architecture review for a system that will process Controlled Unclassified Information (CUI) in a cloud environment. The system must comply with NIST SP 800-171. The ISSEP needs to ensure that the cloud provider's shared responsibility model is properly addressed. Which TWO responsibilities remain with the organization under the shared responsibility model for IaaS? (Choose two.)

Accepted Answer

Patch management of the guest operating system. Under the IaaS shared responsibility model, the organization is responsible for securing the guest operating system, including patch management, and for configuring virtual network security groups. The cloud provider is responsible for physical security and hypervisor management. Encryption of data at rest is a shared responsibility, but the organization must ensure it is implemented; however, the provider often supplies the encryption capability. The two clear organizational responsibilities are patching the guest OS and configuring network security groups.

Answer

Encryption of data at rest in the cloud provider's storage

Answer

Management of the hypervisor

Answer

Physical security of the data center

Question 16

An ISSEP is developing a security architecture for a new system that will process Controlled Unclassified Information (CUI) for a federal agency. The system will be hosted in a commercial cloud environment. The agency requires compliance with NIST SP 800-171. Which TWO security requirements from NIST SP 800-171 are MOST directly related to protecting CUI at rest and in transit? (Choose two.)

Accepted Answer

Implement cryptographic mechanisms to protect the confidentiality of CUI at rest.. The two NIST SP 800-171 requirements that most directly protect CUI at rest and in transit are 3.13.16 (cryptographic mechanisms for CUI at rest) and 3.13.8 (cryptographic mechanisms for CUI during transmission). These are core technical controls for data protection in a cloud-hosted system. The other options address mobile device encryption, training, and social media, which are less directly tied to the general protection of CUI at rest and in transit.

Answer

Establish and maintain a security awareness and training program.

Answer

Encrypt CUI on mobile devices and mobile computing platforms.

Answer

Control and manage the use of social media and networking sites.

Question 17

An ISSEP is performing a security architecture review for a system that uses a service-oriented architecture (SOA). The system integrates multiple web services, some of which are exposed to external partners. The ISSEP must ensure that the architecture addresses the risk of injection attacks across service boundaries. Which design approach BEST mitigates this risk?

Accepted Answer

Implement a centralized API gateway that performs input validation and schema validation for all incoming requests.. The best design approach to mitigate injection attacks across service boundaries is to implement a centralized API gateway that performs input validation and schema validation for all incoming requests. This creates a consistent, enforceable security checkpoint that all traffic must pass through, reducing the chance that any single service's validation weaknesses can be exploited. Other options are either too narrow or address different security concerns.

Answer

Use parameterized queries for all database access within each service.

Answer

Require each service to implement its own input validation using a common library.

Answer

Encrypt all service-to-service communication using TLS 1.3.

Question 18

An ISSEP is working on a system that will be authorized under the NIST Risk Management Framework (RMF). The system owner asks when the Plan of Action and Milestones (POA&M) should be initially developed and what its primary purpose is. Which statement accurately describes the POA&M in the RMF process?

Accepted Answer

The POA&M is initiated during the Prepare step and is used to track the status of remediation activities for identified weaknesses.. The POA&M is a living document that is initiated early in the RMF process, often during the Prepare step, and is used to track remediation of identified weaknesses. It is not limited to post-authorization or the Select step. The correct answer reflects that the POA&M supports continuous monitoring and informed risk-based authorization decisions by documenting planned actions and milestones.

Answer

The POA&M is created after authorization and only includes weaknesses that were not remediated before the authorization decision.

Answer

The POA&M is created during the Assess step and documents all identified vulnerabilities for remediation.

Answer

The POA&M is developed during the Select step and identifies controls that cannot be implemented.

Question 19

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Accepted Answer

Transfer the CSR via air-gapped media to the offline Root CA, sign, and return the certificate.. To maintain an offline Root CA, the CSR from the Subordinate CA must be transferred via secure, out-of-band medium to the offline environment, signed, and the resulting certificate returned.

Answer

Expose the Root CA via a restricted management port in the firewall.

Answer

Configure a secure VPN tunnel between the Subordinate CA and the Root CA to exchange the CSR.

Answer

Use an HSM to automatically sign the request from the Subordinate CA.

Question 20

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

Accepted Answer

Authorization Code Flow with PKCE.. The Authorization Code Flow with PKCE (Proof Key for Code Exchange) is the industry-standard security best practice for mobile applications to prevent authorization code interception.

Answer

Client Credentials Flow.

Answer

Resource Owner Password Credentials Flow.

Answer

Implicit Flow.