ISC Systems Security Implementation Verification And Validation Practice Test 3 — 15 Questions

Question 1

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

Accepted Answer

PermitRootLogin. PermitRootLogin no is a standard hardening requirement for SSH.

Answer

PubkeyAuthentication

Answer

X11Forwarding

Answer

PasswordAuthentication

Question 2

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

Accepted Answer

Identify the assets and the relevant security requirements.. The first step in any security validation process is to identify the assets and the relevant security requirements. Without knowing what systems, applications, and data need protection and what security policies apply, you cannot effectively validate security controls. This foundational step ensures that subsequent actions like logging, patching, or penetration testing are scoped correctly and address the right risks.

Answer

Enable all logging mechanisms.

Answer

Patch the operating system.

Answer

Run a full-scale penetration test.

Question 3

When conducting a security validation of a cloud-based infrastructure, which TWO of the following tasks are essential for verification?

Accepted Answer

Verifying that security group ingress rules are restrictive.. Option A is correct because verifying that security group ingress rules are restrictive directly confirms that network exposure is minimized—only explicitly permitted ports, protocols, and source CIDRs should be allowed, which is a core control in cloud security validation. Option B is correct because reviewing IAM role definitions for least privilege ensures identities are granted only the permissions required for their function, reducing the blast radius of compromised credentials; this is a fundamental cloud access-control verification task. Option C does not belong because auditing billing for cost anomalies is a financial/FinOps activity, not a security validation control. Option D does not belong because in a cloud-based infrastructure the customer typically has no access to physical server hardware, and tamper evidence is the provider's responsibility under the shared responsibility model. Option E does not belong because the underlying host OS is managed by the cloud provider (for IaaS, the hypervisor/host layer), so customers cannot validate its patch level; they would instead validate guest OS patching on their own instances.

Answer

Ensuring the billing account is audited for cost anomalies.

Answer

Checking the physical server hardware for tamper evidence.

Answer

Validating the OS patch level of the underlying host.

Question 4

A security engineer is validating a server's hardening posture against CIS Benchmarks. Which TWO of the following configurations must be verified for the SSH service?

Accepted Answer

Verifying that 'PermitEmptyPasswords' is set to 'no'.. Hardening SSH requires disabling insecure protocols and authentication methods.

Answer

Configuring the service to use only the RSA algorithm.

Answer

Enabling 'AllowTcpForwarding' for all users.

Answer

Setting the default port to 8080.

Question 5

As part of an accreditation process, you are validating that the system meets NIST 800-53 requirements for incident response. Which THREE items must be present in the verification evidence?

Accepted Answer

Records of periodic incident response training/exercises.. NIST 800-53 requires documented procedures, staff training, and test results for incident response validation.

Answer

The physical security badge access logs for the entire building.

Answer

A list of all employees' home addresses.

Question 6

You are validating the security implementation of a wireless network. Which THREE of the following are necessary to verify that WPA3 is properly configured?

Accepted Answer

Check that the network is configured to use AES-GCMP encryption.. WPA3 validation focuses on encryption, authentication method, and management frame protection.

Answer

Ensure that CCMP-128 is the only cipher suite enabled.

Answer

Enable support for WEP as a fallback for older devices.

Question 7

You are validating the security of a containerized environment (e.g., Docker). Which THREE of the following configurations should be checked for security compliance?

Accepted Answer

Ensure the container processes do not run as the root user.. Container security verification requires checking privilege levels, root usage, and image source trust.

Answer

Check that all containers have unlimited CPU and memory allocation.

Answer

Ensure the host OS is Windows 98.

Question 8

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

Accepted Answer

SPF (Sender Policy Framework) record implementation.. SPF, DKIM, and DMARC are the three pillars of email sender verification.

Answer

Disabling TLS for incoming connections to save bandwidth.

Answer

Enabling the 'forward all traffic' rule.

Question 9

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

Accepted Answer

Checking that the audit logging mechanism is active.. Database security verification includes reviewing access controls, encryption, and audit settings.

Answer

Disabling all backups to ensure the database remains small.

Answer

Ensuring the database is configured to accept all remote connections.

Question 10

During a system validation audit, you must verify the configuration of a hardware security module (HSM). Which THREE of the following are valid validation checks?

Accepted Answer

Confirm the HSM is running the latest vendor-signed firmware.. Option A is correct because validating that an HSM runs the latest vendor-signed firmware ensures it has the most recent security patches and that the firmware's cryptographic signature verifies authenticity and integrity, preventing tampered or outdated code from undermining key protection. Option D is correct because HSMs commonly enforce M-of-N quorum or split-knowledge authorization so that no single administrator can perform sensitive operations alone, satisfying separation-of-duties and dual-control requirements during an audit. Option E is correct because physical security controls such as a locked rack protect the HSM from theft, tampering, or unauthorized physical access, which is essential since physical access can bypass logical protections. Option B is incorrect because storing keys in plaintext on a management PC violates core key-protection principles; keys should remain inside the HSM or be wrapped/encrypted. Option C is incorrect because allowing anonymous administrative shell access is a severe misconfiguration, not a valid validation check.

Answer

Ensure all keys are stored in plaintext on the HSM's management PC.

Answer

Check if the HSM allows anonymous access to the administrative shell.

Question 11

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

Accepted Answer

Verify that Security Groups follow the principle of least privilege.. Option A is correct because Security Groups act as stateful virtual firewalls at the instance/ENI level, and verifying that their inbound and outbound rules grant only the minimum required ports, protocols, and source/destination CIDRs confirms least-privilege enforcement at the network boundary. Option B is correct because NACLs are stateless subnet-level filters with numbered allow/deny rules evaluated in order, so auditing their inbound and outbound rules ensures unauthorized traffic is explicitly blocked before reaching subnets. Option E is correct because VPC Flow Logs capture IP traffic metadata (accepted and rejected) for ENIs, subnets, or the VPC, and enabling and reviewing them provides the visibility needed to detect anomalous or unauthorized traffic patterns at the boundary. Option C is incorrect because allowing all inbound traffic from 0.0.0.0/0 removes boundary protection rather than verifying it. Option D is incorrect because disabling firewalls on EC2 instances weakens security and is not a valid verification task.

Answer

Configure the VPC to allow all inbound traffic from 0.0.0.0/0.

Answer

Disable the firewall on all EC2 instances to improve performance.

Question 12

When validating a server's security implementation, which THREE of the following log files or directories should be reviewed to check for unauthorized activity?

Accepted Answer

/var/log/syslog. On Linux, the /var/log/ directory contains critical logs for security verification.

Answer

/tmp/

Answer

/home/

Question 13

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

Accepted Answer

Execute test traffic that attempts each authorized and unauthorized flow across the boundary and observe the device's mediation decisions.. Verification of information flow enforcement requires observing the mechanism in action. Crafted test traffic exercises both permitted and denied paths, exposing rule ordering errors, shadowed rules, and protocol-based bypasses that a documentation review would miss. This dynamic evidence directly ties observed mediation decisions to the approved policy, making it the most defensible proof of correct implementation.

Answer

Confirm that the device firmware is at the vendor-recommended baseline version and that administrative access uses multifactor authentication.

Answer

Collect and review the device's audit logs for the previous 90 days to identify any anomalous traffic patterns.

Answer

Review the device's rule set against the approved information flow policy and confirm that every rule maps to an authorized flow.

Question 14

A security engineer is validating the implementation of a public key infrastructure (PKI) that issues certificates to internal servers. The validation must confirm that certificate revocation is enforced correctly by relying parties. Which TWO verification activities provide direct evidence that revocation checking is functioning as intended? (Choose two.)

Accepted Answer

Revoke a test certificate and confirm that a relying party rejects a TLS connection presenting that certificate.. Direct evidence of revocation enforcement comes from observing relying-party behavior under adverse conditions. Revoking a live certificate and confirming connection rejection exercises the full path from CA publication through relying-party validation. Testing rejection of an OCSP response signed by an unauthorized responder proves the relying party validates responder authorization, closing a spoofing gap that would otherwise let revoked certificates appear valid.

Answer

Verify that the OCSP responder returns a 'good' status for a currently valid, unrevoked certificate.

Answer

Confirm that the certificate authority's CRL distribution point URLs are reachable from the relying party's network segment.

Answer

Inspect the relying party's configuration to confirm that revocation checking is enabled and set to hard-fail.

Question 15

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

Accepted Answer

Run an automated configuration compliance scan against the baseline on a recurring schedule and review deviations.. Ongoing configuration verification depends on repeated, objective comparison of actual settings against the approved baseline. Scheduled automated compliance scans detect drift promptly, produce auditable evidence, and trigger remediation. This approach satisfies the continuous monitoring intent of configuration management controls and is far more reliable than snapshots, attestations, or ticket reviews for confirming sustained adherence.

Answer

Require administrators to sign an attestation stating that they have not modified any server settings since implementation.

Answer

Review the change management ticketing system to confirm that every modification has an approved change request.

Answer

Capture a one-time snapshot of each server's configuration files and archive it with the acceptance documentation.