ISC Systems Security Implementation Verification And Validation Practice Test 4 — 15 Questions

Question 1

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Document the finding as a non-compliance and initiate the risk management process to assess the impact and determine remediation options.. When validation reveals a cryptographic module lacks FIPS 140-3 validation, the immediate step is to document the non-compliance and initiate risk management. This aligns with ISSEP principles of traceability and structured risk handling. Replacement or acceptance without assessment bypasses governance, while penetration testing addresses a different concern. The correct approach ensures the deviation is formally recorded and evaluated for impact and remediation.

Answer

Immediately replace the database encryption module with a FIPS 140-3 validated alternative without further analysis.

Answer

Accept the risk because AES-256 is cryptographically strong regardless of FIPS validation status.

Answer

Conduct a penetration test to see if the non-validated module can be exploited before taking any other action.

Question 2

A security engineer is conducting verification and validation for a new Windows Server 2022 deployment on a classified network that must meet DISA STIG requirements. The engineer needs to verify that the audit policy is correctly implemented and that audit records are being generated for a specific security-relevant event. Which action provides the most direct evidence that the audit policy is functioning as intended?

Accepted Answer

Trigger the security-relevant event and confirm that a corresponding entry appears in the Security event log with the expected Event ID.. The most direct evidence that an audit policy is functioning is observing the audit record that results from the audited event. Triggering the event and confirming the expected Event ID in the Security log validates the entire auditing chain from policy application through record generation. Configuration reviews and policy displays confirm intent but cannot prove that audit records are actually produced.

Answer

Check that the Security event log file size is configured to at least 196 MB and that log retention is set to overwrite as needed.

Answer

Run auditpol /get /category:* to display the current audit policy settings and confirm the expected subcategories are enabled.

Answer

Review the Group Policy Object that configures Advanced Audit Policy Configuration to confirm the settings match the STIG requirement.

Question 3

You are the security engineer responsible for verifying the implementation of an organization's Public Key Infrastructure (PKI) as part of a system accreditation effort. The Certificate Practice Statement (CPS) states that all end-entity certificates must be issued with a maximum validity of 365 days and must include the Certificate Policies extension. During your validation, you sample issued certificates and find that a subordinate CA has been issuing certificates with a 730-day validity and no Certificate Policies extension. Which validation activity best identifies the root cause of this non-compliance?

Accepted Answer

Review the subordinate CA's certificate template and policy configuration against the CPS requirements.. The non-compliance is a deviation between the CPS and the actual certificates issued by the subordinate CA. Verifying the CA's certificate template and policy configuration directly tests whether the implementation enforces the required validity period and Certificate Policies extension. This root-cause analysis is more effective than scanning for vulnerabilities, checking revocation lists, or reviewing authentication logs, none of which examine issuance parameters.

Answer

Inspect the Certificate Revocation List (CRL) for expired or revoked end-entity certificates.

Answer

Audit the CA's audit logs for failed authentication attempts against the CA management interface.

Answer

Run a vulnerability scan against the subordinate CA server to identify missing security patches.

Question 4

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

Accepted Answer

Compare the raw log output from a critical server with the events received by the SIEM for the same time period.. The most effective technique is to compare raw logs from the source with events in the SIEM. This end-to-end verification pinpoints where in the pipeline events are lost, whether at generation, forwarding, or ingestion. Other options address only parts of the system and do not provide definitive evidence of the root cause. This method aligns with ISSEP validation principles of tracing data flow and verifying each component.

Answer

Run a vulnerability scan on the critical servers to check for logging-related CVEs.

Answer

Check the SIEM's storage capacity to ensure it is not dropping events due to full disks.

Answer

Review the SIEM's correlation rules to ensure they include all authentication event IDs.

Question 5

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

Accepted Answer

Revoke a test certificate, attempt authentication with the corresponding smart card, and confirm that authentication is denied with a revocation-related error.. The strongest assurance that revoked certificates are rejected comes from an end-to-end test: revoke a certificate, attempt authentication, and confirm denial. This validates the relying party's revocation checking behavior, which is the actual security control. CA-side checks and CRL signature verification confirm that revocation data exists and is trustworthy but do not prove that authentication systems enforce it.

Answer

Confirm that the Certification Authority has a valid CRL Distribution Point extension in issued certificates and that the CRL is published on schedule.

Answer

Verify that the CA's certificate revocation list is signed with the CA's private key and that the signature validates using the CA's public key.

Answer

Review the CA's audit logs to confirm that the revocation request was processed and that the certificate serial number was added to the CRL.

Question 6

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

Accepted Answer

Run an authenticated configuration scan against the live system and manually inspect the resulting service, audit, and file permission settings.. Verification and validation require objective evidence that controls are implemented as specified. Inspecting the live system through an authenticated configuration scan, supplemented by manual review of the output, directly measures the service state, audit configuration, and file permissions. Documentation, interviews, and image hashes reflect intent or artifact integrity rather than the actual operational configuration, so they cannot confirm the baseline is met on the running server.

Answer

Compare the server's build image hash against the hash recorded in the configuration management database.

Answer

Interview the system administrator who built the server and obtain a signed attestation of compliance.

Answer

Review the signed configuration management plan and the change advisory board approval records.

Question 7

A security engineer is validating the implementation of a network intrusion prevention system (IPS) in inline mode. The requirement is that the IPS must block malicious traffic without disrupting legitimate business traffic. Which validation test is MOST appropriate to verify this requirement?

Accepted Answer

Use a traffic generator to send known malicious payloads and legitimate traffic simultaneously, then verify that malicious packets are dropped and legitimate packets pass.. The most appropriate validation is to simulate both malicious and legitimate traffic and verify that the IPS blocks the former while allowing the latter. This dynamic test confirms inline blocking capability and ensures no disruption to business traffic. Other options are either static checks or passive monitoring, which do not fully validate the requirement. This approach aligns with ISSEP principles of testing security controls under realistic conditions.

Answer

Review the IPS signature database to ensure it contains the latest signatures for known threats.

Answer

Check the IPS logs for alerts generated during normal business hours to see if any malicious traffic was detected.

Answer

Run a vulnerability scan against a test server behind the IPS to see if exploits are blocked.

Question 8

A security engineer is verifying that a new web application's authentication mechanism meets the organization's requirement that all passwords must be transmitted and stored using strong cryptography. The application uses HTTPS for transport and stores password hashes in a database. During validation, the engineer inspects the database and finds that passwords are stored as unsalted SHA-256 hashes. Which validation finding is most accurate?

Accepted Answer

The storage mechanism is non-compliant because unsalted SHA-256 hashes are vulnerable to rainbow table attacks and do not meet the requirement for strong cryptographic protection.. Password storage requires a slow, salted key-derivation function to resist offline attacks. Unsalted SHA-256 is fast and deterministic, making it vulnerable to rainbow tables and parallel brute-force. Transport encryption and access controls do not compensate for weak storage. The accurate finding is that the unsalted SHA-256 storage is non-compliant with the strong cryptography requirement.

Answer

The storage mechanism is non-compliant only because the hashes are not encrypted with a symmetric key before storage.

Answer

The storage mechanism is compliant because HTTPS encrypts passwords in transit, and the database is access-controlled.

Answer

The storage mechanism is compliant because SHA-256 is a strong cryptographic hash algorithm approved for password storage.

Question 9

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

Accepted Answer

The Requirements Traceability Matrix (RTM). Verification that security requirements flow from concept into design depends on bidirectional traceability. The Requirements Traceability Matrix is the engineering artifact that records each requirement's source and its allocated design, implementation, and verification artifacts. An SSP, configuration audit, or risk report serves different purposes and cannot demonstrate allocation. Reviewing the RTM lets the engineer confirm that no security requirement is orphaned and that each has an accountable component owner, which is the precise evidence the scenario requires.

Answer

The system security plan (SSP)

Answer

The functional baseline configuration audit report

Answer

The risk assessment report

Question 10

During a security verification of a Linux server, you need to confirm that the implementation of mandatory access control (MAC) is enforcing the intended policy for a custom application. The server uses SELinux in enforcing mode. The application's binary is labeled with a custom type, and the policy includes allow rules for its required operations. However, the application is failing to write to a log directory. Which command should you use to verify whether SELinux is denying the write operation?

Accepted Answer

ausearch -m avc -ts recent. To verify whether SELinux is denying a specific operation, you must inspect the audit logs for AVC denial messages. The ausearch command with the avc message type and a recent time filter retrieves exactly those events, showing the denied permission and contexts. Other commands either display configuration, attempt remediation, or report global mode, none of which confirm a runtime denial.

Answer

getenforce

Answer

semanage fcontext -l | grep log

Answer

restorecon -Rv /var/log

Question 11

During a security verification review, an engineer is examining how a web application handles user-supplied input that is used to build a database query. The application uses parameterized statements for most queries, but one legacy module concatenates input directly into a query string. The engineer wants to confirm whether the legacy module is exploitable before recommending remediation. Which verification technique is most appropriate to demonstrate the vulnerability?

Accepted Answer

Run a dynamic application security test that submits crafted input to the legacy module and observes the database response.. Demonstrating that the legacy module is actually exploitable requires exercising the deployed code with crafted input and observing the outcome. Dynamic application security testing submits payloads through the real request path and reveals whether concatenation leads to unintended query execution. Static review, log inspection, and firewall rule checks provide context or compensating controls but cannot confirm runtime exploitability, which is the specific verification objective.

Answer

Review the database server's audit logs for previously executed queries containing unusual syntax.

Answer

Perform a source code review of the legacy module to trace how the input reaches the query construction.

Answer

Inspect the web application firewall rules to confirm they block common injection patterns.

Question 12

A security engineer is validating the implementation of a secure software development lifecycle (SDLC) for a critical application. The requirement is that all code must undergo static analysis before deployment. During validation, the engineer finds that the static analysis tool is configured to ignore certain classes of vulnerabilities. Which action should the engineer take to ensure the validation is effective?

Accepted Answer

Review the tool's configuration and compare the ignored vulnerability classes against the organization's secure coding standards to determine if the exclusions are justified.. The effective action is to review the exclusions against secure coding standards to determine if they are justified. This ensures that the static analysis remains aligned with policy and that any unjustified exclusions are corrected. Disabling all exclusions or switching tools bypasses proper validation, while accepting without review ignores potential risks. This approach maintains the integrity of the SDLC validation.

Answer

Run a dynamic analysis tool instead, since static analysis is clearly not reliable.

Answer

Document the exclusions as a risk and accept them without further action, since the tool is still performing some analysis.

Answer

Immediately disable all exclusions in the static analysis tool to ensure no vulnerabilities are missed.

Question 13

A security engineer is planning verification and validation activities for a new command-and-control system and must decide which techniques constitute dynamic verification rather than static analysis. Which two of the following are dynamic verification techniques? (Choose two.)

Accepted Answer

Fuzz testing of network protocol parsers. Dynamic verification requires executing the system and observing real behavior, while static techniques inspect artifacts without running them. Penetration testing and fuzz testing both drive the live system with adversarial or malformed input and record actual outcomes, so they are dynamic. Manual code review, SAST, and software composition analysis all examine source, binaries, or dependency metadata without execution, so they are static. A balanced verification program uses both categories because each finds defect classes the other misses.

Answer

Manual source code review against secure coding standards

Answer

Static application security testing (SAST) scanning

Answer

Software composition analysis of third-party libraries

Question 14

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

Accepted Answer

Conducting a packet capture or flow test across each approved and denied path to observe actual enforcement behavior. Verification of an implemented boundary control must produce evidence that the deployed mechanism enforces the approved policy, not merely that documentation or personnel claim it does. Exercising approved and denied traffic paths demonstrates the actual behavior of the rule set, exposing ordering defects and unintended permits. This dynamic testing is the strongest form of implementation verification for access control enforcement.

Answer

Comparing the device's running configuration against the vendor's recommended hardening benchmark

Answer

Interviewing the network administrators who performed the installation to confirm they followed the build guide

Answer

Reviewing the vendor's default rule set documentation to confirm it matches the approved flow matrix

Question 15

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Accepted Answer

Connect as an authorized user, inspect the assigned routes and the negotiated cipher, and confirm no local network access is permitted.. Validating policy enforcement requires observing real session behavior against each requirement. Establishing an authorized session and inspecting the routes, negotiated cipher, and local network reachability confirms group enforcement, absence of split tunneling, and AES-256 encryption simultaneously. Configuration review, authentication logs, and a single negative test each cover only part of the policy and cannot demonstrate full enforcement.

Answer

Check the concentrator's authentication logs to confirm that only 'Remote Users' group members have connected recently.

Answer

Review the VPN concentrator's configuration file to confirm the group, split tunneling, and encryption settings are present.

Answer

Attempt to connect as a user who is not in the 'Remote Users' group and confirm the connection is rejected.