ISC Systems Security Implementation Verification And Validation Practice Test 2 — 15 Questions

Question 1

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Accepted Answer

manage-bde -status C:. manage-bde is the CLI tool for BitLocker administration.

Answer

cipher /e

Answer

bitlocker-check

Answer

diskpart /info

Question 2

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

Accepted Answer

Verify the use of mutual TLS (mTLS) and log hashing/signing in the syslog configuration.. Log integrity is verified by ensuring the logs are digitally signed or protected from tampering during transit.

Answer

Verify that the SIEM administrative account has read-only permissions.

Answer

Review the firewall logs to see if port 514 is open.

Answer

Check if the SIEM has received a sample log entry via 'tail -f'.

Question 3

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 4

When validating the security of a database implementation, how do you verify that sensitive data at rest is encrypted using Transparent Data Encryption (TDE)?

Accepted Answer

Query the sys.dm_database_encryption_keys dynamic management view.. Verifying the system catalog or dynamic management views is the standard way to confirm TDE status.

Answer

Check if the database folder has the 'encrypted' flag set in Windows File Properties.

Answer

Attempt to open the database file in a text editor.

Answer

Use the 'encrypt' command in the database shell.

Question 5

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Accepted Answer

nmap -p 80 <target_ip>. Nmap is a standard network scanning tool used to verify that specific ports are blocked or filtered.

Answer

nslookup <target_ip>

Answer

netstat -an

Answer

ipconfig /all

Question 6

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Accepted Answer

.xml. In an SCAP-compliant environment, security check definitions for DISA STIGs are typically provided in XML format, specifically using the .xml file extension. SCAP (Security Content Automation Protocol) uses XML-based specifications such as XCCDF (Extensible Configuration Checklist Description Format) and OVAL (Open Vulnerability and Assessment Language) to define and automate security compliance checks. DISA STIGs are commonly distributed as SCAP content in XML files, which can be consumed by SCAP-validated tools for automated assessment.

Answer

.txt

Answer

.stig

Answer

.ovl

Question 7

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

Accepted Answer

Perform ping tests between VMs in different security zones.. Validating microsegmentation requires testing lateral movement between segments that should be isolated.

Answer

Inspect the physical switch port configuration.

Answer

Review the cloud provider's SLA.

Answer

Check the DNS records for the servers.

Question 8

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

Accepted Answer

Attempt to log in with valid credentials and verify that the system prompts for the secondary token.. Successful authentication with a second factor is the ultimate proof of correct implementation.

Answer

Verify that the account has a 'mobile' field populated.

Answer

Review the MFA server logs for daily activity.

Answer

Check the user account settings in the Active Directory console.

Question 9

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

Accepted Answer

Send a flood of requests exceeding the defined rate limit and verify that the API returns a 429 Too Many Requests status code.. The only way to verify that rate limiting actually prevents a DoS-style flood is to test it behaviorally: send requests exceeding the configured limit and confirm the gateway rejects excess traffic with HTTP 429 Too Many Requests. This validates the enforcement path end-to-end, including throttling thresholds, burst limits, and error responses. Configuration review alone cannot prove runtime behavior.

Answer

Use a vulnerability scanner to check for OWASP API vulnerabilities.

Answer

Review the API Gateway configuration files for the 'rate_limit' keyword.

Answer

Monitor the CPU usage of the backend server.

Question 10

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

Accepted Answer

sha256sum. Hashing is the standard method for verifying that a file has not been altered.

Answer

cat <filename>

Answer

grep 'modified' <filename>

Answer

ls -l

Question 11

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

Accepted Answer

Verify that 'Secure Boot' is set to 'Enabled' and the 'Platform Key' (PK) is installed.. Secure Boot validation requires confirming that the UEFI setting is Enabled and that a Platform Key (PK) is installed, because the PK anchors the trust chain that validates bootloader signatures. Without a PK, Secure Boot cannot enforce signature verification even if the toggle appears enabled. TPM version, Legacy Boot status, and NTP synchronization are related security controls but are not the components that prove Secure Boot is functioning.

Answer

Validate the TPM version is 2.0.

Answer

Check that 'Legacy Boot' is set to 'Disabled'.

Answer

Ensure the system clock is synchronized with a secure NTP server.

Question 12

A system is undergoing accreditation. You need to verify that automated vulnerability scanning is occurring on a recurring basis. Which artifact provides the best evidence?

Accepted Answer

A series of scan reports spanning the required frequency interval.. A series of scan reports spanning the required frequency interval provides the best evidence because it demonstrates actual, recurring vulnerability scanning over time. Each report typically includes timestamps, scan targets, and findings, proving that scans were performed at the required intervals. This is concrete, verifiable evidence that an auditor can independently review, unlike policy documents or assertions.

Answer

A copy of the security policy document.

Answer

An email from the security team confirming they run scans.

Answer

A screenshot of the vulnerability scanner dashboard.

Question 13

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

Accepted Answer

That no traffic is allowed unless explicitly permitted.. The implicit deny rule is the final catch-all rule that drops all traffic not explicitly allowed.

Answer

That the firewall is blocking all outgoing traffic.

Answer

That the firewall can handle high traffic volumes.

Answer

That the firewall is correctly logging denied packets.

Question 14

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

Accepted Answer

SCAP Compliance Checker (SCC). SCAP Compliance Checker (SCC) is specifically designed to automate the assessment of systems against Security Content Automation Protocol (SCAP) benchmarks, including DISA STIGs. It efficiently scans OS configurations, compares them to the STIG requirements, and generates detailed compliance reports. Unlike general-purpose tools, SCC directly consumes SCAP content, which is the standardized format for expressing STIG rules, making it the most efficient and accurate tool for this task.

Answer

Wireshark

Answer

Microsoft Baseline Security Analyzer (MBSA)

Answer

Nmap

Question 15

You are performing a security validation of a database to ensure that all administrative actions are captured. Which feature must be checked to confirm that logging is capturing these events?

Accepted Answer

Audit Policy configuration. Audit Policy configuration is the database feature that determines which administrative and user actions are written to audit logs, including privileged operations like GRANT, CREATE USER, and ALTER SYSTEM. To confirm administrative actions are captured, you must verify that the audit policy explicitly includes those statement types and privilege classes. Without a properly scoped audit policy, the database engine will not emit audit records regardless of other settings.

Answer

Database connection pool settings

Answer

Database backup settings

Answer

Database user permissions