ISC Systems Security Implementation Verification And Validation — All Questions With Answers

Question 1easymultiple choice

Study the full ACL explanation →

When validating the security implementation of a Cisco ASA firewall, which command provides the most accurate verification of the currently applied Access Control List (ACL) to a specific interface?

Question 2mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a TLS 1.3 configuration on an Nginx server. Which configuration directive must be verified to ensure only secure ciphers are used?

Question 3mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a penetration test of a web application, you identify an insecure direct object reference (IDOR). What is the most effective way to verify that your remediation via access control checks is successful?

Question 4mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a cloud security audit, you need to verify that IAM users do not have overly permissive policies. Which AWS feature provides automated validation of IAM policy adherence to least privilege?

Question 5mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a web service using OAuth 2.0. Which specific verification step ensures that the authorization code is not leaked?

Question 6mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of an Intrusion Detection System (IDS). Which technique is used to ensure the IDS is detecting traffic as expected?

Question 7hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a validation exercise, you need to confirm that an application's logging mechanism is compliant with NIST SP 800-92. Which element must be verified?

Question 8hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the security configuration of an Amazon S3 bucket. Which S3 feature must be enabled to ensure that object deletions are reversible in case of accidental or malicious data loss?

Question 9mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a web application. Which TWO of the following actions verify that input validation is effective against SQL injection?

Question 10hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

During a security audit of a PKI implementation, which TWO of the following must be verified to ensure the integrity of the certificate chain?

Question 11hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification and validation on a Linux-based web server that must comply with the CIS Benchmark. The engineer needs to validate that the SSH service is securely configured. Which TWO of the following validation activities provide direct evidence that the SSH configuration meets the benchmark requirements? (Choose two.)

Question 12hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Security Content Automation Protocol (SCAP) scan on a Windows Server 2022 system. The engineer must ensure the scan results are reliable and can be used for continuous monitoring. Which SCAP component is specifically responsible for expressing and checking configuration requirements in a machine-readable format?

Question 13hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

Question 14mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

Question 15hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?

Question 16easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Question 17mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

Question 18hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Question 19mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating the security of a database implementation, how do you verify that sensitive data at rest is encrypted using Transparent Data Encryption (TDE)?

Question 20easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Question 21hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Question 22hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

Question 23easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

Question 24mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

Question 25easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

Question 26hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Question 27mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A system is undergoing accreditation. You need to verify that automated vulnerability scanning is occurring on a recurring basis. Which artifact provides the best evidence?

Question 28easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

Question 29mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

Question 30hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are performing a security validation of a database to ensure that all administrative actions are captured. Which feature must be checked to confirm that logging is capturing these events?

Question 31mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

Question 32easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

Question 33mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When conducting a security validation of a cloud-based infrastructure, which TWO of the following tasks are essential for verification?

Question 34hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating a server's hardening posture against CIS Benchmarks. Which TWO of the following configurations must be verified for the SSH service?

Question 35hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

As part of an accreditation process, you are validating that the system meets NIST 800-53 requirements for incident response. Which THREE items must be present in the verification evidence?

Question 36mediummulti select

Read the full wireless explanation →

You are validating the security implementation of a wireless network. Which THREE of the following are necessary to verify that WPA3 is properly configured?

Question 37mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a containerized environment (e.g., Docker). Which THREE of the following configurations should be checked for security compliance?

Question 38mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

Question 39easymulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

Question 40hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

During a system validation audit, you must verify the configuration of a hardware security module (HSM). Which THREE of the following are valid validation checks?

Question 41mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

Question 42hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a server's security implementation, which THREE of the following log files or directories should be reviewed to check for unauthorized activity?

Question 43mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

Question 44hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) that issues certificates to internal servers. The validation must confirm that certificate revocation is enforced correctly by relying parties. Which TWO verification activities provide direct evidence that revocation checking is functioning as intended? (Choose two.)

Question 45easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

Question 46mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

Question 47mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is conducting verification and validation for a new Windows Server 2022 deployment on a classified network that must meet DISA STIG requirements. The engineer needs to verify that the audit policy is correctly implemented and that audit records are being generated for a specific security-relevant event. Which action provides the most direct evidence that the audit policy is functioning as intended?

Question 48mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are the security engineer responsible for verifying the implementation of an organization's Public Key Infrastructure (PKI) as part of a system accreditation effort. The Certificate Practice Statement (CPS) states that all end-entity certificates must be issued with a maximum validity of 365 days and must include the Certificate Policies extension. During your validation, you sample issued certificates and find that a subordinate CA has been issuing certificates with a 730-day validity and no Certificate Policies extension. Which validation activity best identifies the root cause of this non-compliance?

Question 49hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

Question 50hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

Question 51mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

Question 52easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a network intrusion prevention system (IPS) in inline mode. The requirement is that the IPS must block malicious traffic without disrupting legitimate business traffic. Which validation test is MOST appropriate to verify this requirement?

Question 53easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that a new web application's authentication mechanism meets the organization's requirement that all passwords must be transmitted and stored using strong cryptography. The application uses HTTPS for transport and stores password hashes in a database. During validation, the engineer inspects the database and finds that passwords are stored as unsalted SHA-256 hashes. Which validation finding is most accurate?

Question 54hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

Question 55hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification of a Linux server, you need to confirm that the implementation of mandatory access control (MAC) is enforcing the intended policy for a custom application. The server uses SELinux in enforcing mode. The application's binary is labeled with a custom type, and the policy includes allow rules for its required operations. However, the application is failing to write to a log directory. Which command should you use to verify whether SELinux is denying the write operation?

Question 56hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification review, an engineer is examining how a web application handles user-supplied input that is used to build a database query. The application uses parameterized statements for most queries, but one legacy module concatenates input directly into a query string. The engineer wants to confirm whether the legacy module is exploitable before recommending remediation. Which verification technique is most appropriate to demonstrate the vulnerability?

Question 57hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a secure software development lifecycle (SDLC) for a critical application. The requirement is that all code must undergo static analysis before deployment. During validation, the engineer finds that the static analysis tool is configured to ignore certain classes of vulnerabilities. Which action should the engineer take to ensure the validation is effective?

Question 58mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is planning verification and validation activities for a new command-and-control system and must decide which techniques constitute dynamic verification rather than static analysis. Which two of the following are dynamic verification techniques? (Choose two.)

Question 59easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

Question 60mediummultiple choice

Read the full VPN explanation →

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Question 61mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Question 62mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A systems security engineer is validating the implementation of security controls for a new federal information system. The system's security plan specifies that the organization will follow NIST RMF guidance and use NIST SP 800-53A for assessment. The engineer must verify that the implemented controls meet the stated security requirements. Which activity BEST represents the verification step in this context?

Question 63mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating a boundary defense implementation and must confirm that the system enforces least privilege for inter-zone traffic. The design states that only approved services may cross from a lower-trust zone to a higher-trust zone. Which verification activity provides the strongest evidence that the enforcement point actually implements this policy?

Question 64hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the implementation of security controls for a database server that stores sensitive customer data. The requirement is to verify that the database enforces encryption at rest and that access is restricted to authorized users. Which TWO of the following verification activities best confirm that these requirements are met? (Choose two.)

Question 65easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a new security information and event management (SIEM) system that aggregates logs from multiple sources. The engineer must verify that the SIEM is correctly ingesting and correlating events according to the designed use cases. Which validation approach is most appropriate for confirming that correlation rules are functioning as intended?

Question 66easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification of a newly deployed intrusion prevention system (IPS) inline on the network perimeter. The goal is to confirm that the IPS is actively blocking malicious traffic rather than only alerting. Which action provides the most direct verification of blocking capability?

Question 67mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A system is undergoing security control assessment before authorization to operate. The assessor must determine whether the implemented audit logging control satisfies the stated requirement that all authentication events, including failures, are recorded with sufficient detail for accountability. Which assessment method yields the most defensible evidence for this determination?

Question 68hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

Question 69hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) used for internal TLS. The validation must confirm that certificate issuance and revocation controls are working as designed. Which TWO of the following verification activities provide direct evidence that these controls are effective? (Choose two.)

Question 70mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of full disk encryption using BitLocker on Windows 11 laptops in an enterprise. The organization requires that BitLocker be enabled with TPM and PIN protector and that recovery keys be escrowed in Active Directory. Which validation activity provides the strongest evidence that the BitLocker configuration meets these requirements?

Question 71hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a verification review of a cryptographic implementation, the engineer must confirm that data at rest on a storage volume is protected with an approved algorithm and key length, and that the protection is genuinely active rather than merely provisioned. Which combination of activities best verifies the implemented state?

Question 72hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

Question 73mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that an implemented boundary device correctly performs deep inspection of allowed application traffic rather than only permitting it based on port and protocol. The requirement states that the device must detect and block protocol anomalies within permitted sessions. Which verification approach provides the strongest evidence that this inspection capability is genuinely operating?

Question 74mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying the implementation of a public key infrastructure (PKI) for a government agency. The agency requires that all digital certificates comply with FIPS 140-2 and are issued by a trusted certificate authority. During validation, the engineer needs to confirm that a server's certificate is valid and has not been revoked. Which mechanism should the engineer use to check the certificate's revocation status in real time?

Question 75hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are finalizing the verification and validation report for a system entering the authorization phase. The approving official requires evidence that the implemented security controls are not only present but operating correctly, and that residual weaknesses are documented. Which TWO activities must be completed to satisfy this requirement? (Choose two.)

Question 76hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

Question 77mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)

Question 1easymultiple choice

Study the full ACL explanation →

When validating the security implementation of a Cisco ASA firewall, which command provides the most accurate verification of the currently applied Access Control List (ACL) to a specific interface?

Question 2mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a TLS 1.3 configuration on an Nginx server. Which configuration directive must be verified to ensure only secure ciphers are used?

Question 3mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a penetration test of a web application, you identify an insecure direct object reference (IDOR). What is the most effective way to verify that your remediation via access control checks is successful?

Question 4mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a cloud security audit, you need to verify that IAM users do not have overly permissive policies. Which AWS feature provides automated validation of IAM policy adherence to least privilege?

Question 5mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a web service using OAuth 2.0. Which specific verification step ensures that the authorization code is not leaked?

Question 6mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of an Intrusion Detection System (IDS). Which technique is used to ensure the IDS is detecting traffic as expected?

Question 7hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a validation exercise, you need to confirm that an application's logging mechanism is compliant with NIST SP 800-92. Which element must be verified?

Question 8hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the security configuration of an Amazon S3 bucket. Which S3 feature must be enabled to ensure that object deletions are reversible in case of accidental or malicious data loss?

Question 9mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a web application. Which TWO of the following actions verify that input validation is effective against SQL injection?

Question 10hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

During a security audit of a PKI implementation, which TWO of the following must be verified to ensure the integrity of the certificate chain?

Question 11hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification and validation on a Linux-based web server that must comply with the CIS Benchmark. The engineer needs to validate that the SSH service is securely configured. Which TWO of the following validation activities provide direct evidence that the SSH configuration meets the benchmark requirements? (Choose two.)

Question 12hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Security Content Automation Protocol (SCAP) scan on a Windows Server 2022 system. The engineer must ensure the scan results are reliable and can be used for continuous monitoring. Which SCAP component is specifically responsible for expressing and checking configuration requirements in a machine-readable format?

Question 13hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

Question 14mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

Question 15hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?

Question 16easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Question 17mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

Question 18hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Question 19mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating the security of a database implementation, how do you verify that sensitive data at rest is encrypted using Transparent Data Encryption (TDE)?

Question 20easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Question 21hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Question 22hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

Question 23easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

Question 24mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

Question 25easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

Question 26hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Question 27mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A system is undergoing accreditation. You need to verify that automated vulnerability scanning is occurring on a recurring basis. Which artifact provides the best evidence?

Question 28easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

Question 29mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

Question 30hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are performing a security validation of a database to ensure that all administrative actions are captured. Which feature must be checked to confirm that logging is capturing these events?

Question 31mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

Question 32easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

Question 33mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When conducting a security validation of a cloud-based infrastructure, which TWO of the following tasks are essential for verification?

Question 34hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating a server's hardening posture against CIS Benchmarks. Which TWO of the following configurations must be verified for the SSH service?

Question 35hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

As part of an accreditation process, you are validating that the system meets NIST 800-53 requirements for incident response. Which THREE items must be present in the verification evidence?

Question 36mediummulti select

Read the full wireless explanation →

You are validating the security implementation of a wireless network. Which THREE of the following are necessary to verify that WPA3 is properly configured?

Question 37mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a containerized environment (e.g., Docker). Which THREE of the following configurations should be checked for security compliance?

Question 38mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

Question 39easymulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

Question 40hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

During a system validation audit, you must verify the configuration of a hardware security module (HSM). Which THREE of the following are valid validation checks?

Question 41mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

Question 42hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

When validating a server's security implementation, which THREE of the following log files or directories should be reviewed to check for unauthorized activity?

Question 43mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

Question 44hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) that issues certificates to internal servers. The validation must confirm that certificate revocation is enforced correctly by relying parties. Which TWO verification activities provide direct evidence that revocation checking is functioning as intended? (Choose two.)

Question 45easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

Question 46mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

Question 47mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is conducting verification and validation for a new Windows Server 2022 deployment on a classified network that must meet DISA STIG requirements. The engineer needs to verify that the audit policy is correctly implemented and that audit records are being generated for a specific security-relevant event. Which action provides the most direct evidence that the audit policy is functioning as intended?

Question 48mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are the security engineer responsible for verifying the implementation of an organization's Public Key Infrastructure (PKI) as part of a system accreditation effort. The Certificate Practice Statement (CPS) states that all end-entity certificates must be issued with a maximum validity of 365 days and must include the Certificate Policies extension. During your validation, you sample issued certificates and find that a subordinate CA has been issuing certificates with a 730-day validity and no Certificate Policies extension. Which validation activity best identifies the root cause of this non-compliance?

Question 49hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

Question 50hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

Question 51mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

Question 52easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a network intrusion prevention system (IPS) in inline mode. The requirement is that the IPS must block malicious traffic without disrupting legitimate business traffic. Which validation test is MOST appropriate to verify this requirement?

Question 53easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that a new web application's authentication mechanism meets the organization's requirement that all passwords must be transmitted and stored using strong cryptography. The application uses HTTPS for transport and stores password hashes in a database. During validation, the engineer inspects the database and finds that passwords are stored as unsalted SHA-256 hashes. Which validation finding is most accurate?

Question 54hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

Question 55hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification of a Linux server, you need to confirm that the implementation of mandatory access control (MAC) is enforcing the intended policy for a custom application. The server uses SELinux in enforcing mode. The application's binary is labeled with a custom type, and the policy includes allow rules for its required operations. However, the application is failing to write to a log directory. Which command should you use to verify whether SELinux is denying the write operation?

Question 56hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a security verification review, an engineer is examining how a web application handles user-supplied input that is used to build a database query. The application uses parameterized statements for most queries, but one legacy module concatenates input directly into a query string. The engineer wants to confirm whether the legacy module is exploitable before recommending remediation. Which verification technique is most appropriate to demonstrate the vulnerability?

Question 57hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a secure software development lifecycle (SDLC) for a critical application. The requirement is that all code must undergo static analysis before deployment. During validation, the engineer finds that the static analysis tool is configured to ignore certain classes of vulnerabilities. Which action should the engineer take to ensure the validation is effective?

Question 58mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is planning verification and validation activities for a new command-and-control system and must decide which techniques constitute dynamic verification rather than static analysis. Which two of the following are dynamic verification techniques? (Choose two.)

Question 59easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

Question 60mediummultiple choice

Read the full VPN explanation →

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Question 61mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Question 62mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A systems security engineer is validating the implementation of security controls for a new federal information system. The system's security plan specifies that the organization will follow NIST RMF guidance and use NIST SP 800-53A for assessment. The engineer must verify that the implemented controls meet the stated security requirements. Which activity BEST represents the verification step in this context?

Question 63mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating a boundary defense implementation and must confirm that the system enforces least privilege for inter-zone traffic. The design states that only approved services may cross from a lower-trust zone to a higher-trust zone. Which verification activity provides the strongest evidence that the enforcement point actually implements this policy?

Question 64hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are validating the implementation of security controls for a database server that stores sensitive customer data. The requirement is to verify that the database enforces encryption at rest and that access is restricted to authorized users. Which TWO of the following verification activities best confirm that these requirements are met? (Choose two.)

Question 65easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a new security information and event management (SIEM) system that aggregates logs from multiple sources. The engineer must verify that the SIEM is correctly ingesting and correlating events according to the designed use cases. Which validation approach is most appropriate for confirming that correlation rules are functioning as intended?

Question 66easymultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is performing verification of a newly deployed intrusion prevention system (IPS) inline on the network perimeter. The goal is to confirm that the IPS is actively blocking malicious traffic rather than only alerting. Which action provides the most direct verification of blocking capability?

Question 67mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A system is undergoing security control assessment before authorization to operate. The assessor must determine whether the implemented audit logging control satisfies the stated requirement that all authentication events, including failures, are recorded with sufficient detail for accountability. Which assessment method yields the most defensible evidence for this determination?

Question 68hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

Question 69hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of a public key infrastructure (PKI) used for internal TLS. The validation must confirm that certificate issuance and revocation controls are working as designed. Which TWO of the following verification activities provide direct evidence that these controls are effective? (Choose two.)

Question 70mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of full disk encryption using BitLocker on Windows 11 laptops in an enterprise. The organization requires that BitLocker be enabled with TPM and PIN protector and that recovery keys be escrowed in Active Directory. Which validation activity provides the strongest evidence that the BitLocker configuration meets these requirements?

Question 71hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

During a verification review of a cryptographic implementation, the engineer must confirm that data at rest on a storage volume is protected with an approved algorithm and key length, and that the protection is genuinely active rather than merely provisioned. Which combination of activities best verifies the implemented state?

Question 72hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

Question 73mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying that an implemented boundary device correctly performs deep inspection of allowed application traffic rather than only permitting it based on port and protocol. The requirement states that the device must detect and block protocol anomalies within permitted sessions. Which verification approach provides the strongest evidence that this inspection capability is genuinely operating?

Question 74mediummultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is verifying the implementation of a public key infrastructure (PKI) for a government agency. The agency requires that all digital certificates comply with FIPS 140-2 and are issued by a trusted certificate authority. During validation, the engineer needs to confirm that a server's certificate is valid and has not been revoked. Which mechanism should the engineer use to check the certificate's revocation status in real time?

Question 75hardmulti select

Read the full Systems Security Implementation Verification And Validation explanation →

You are finalizing the verification and validation report for a system entering the authorization phase. The approving official requires evidence that the implemented security controls are not only present but operating correctly, and that residual weaknesses are documented. Which TWO activities must be completed to satisfy this requirement? (Choose two.)

Question 76hardmultiple choice

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

Question 77mediummulti select

Read the full Systems Security Implementation Verification And Validation explanation →

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)