ISC Systems Security Implementation Verification And Validation Practice Test 5 — 15 Questions

Question 1

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The NIPS interface pair is configured in inline mode with fail-open or fail-closed settings and the policy action is set to block.. The primary reason an inline NIPS alerts but does not block is that the policy is set to alert-only or the interface is not truly inline. Verifying the interface pair mode and the policy action ensures the system is configured to enforce. Other items such as signature updates, SIEM alerts, and management VLANs affect detection or management, not the blocking capability.

Answer

The NIPS management interface is on a separate VLAN.

Answer

The NIPS signature database is updated to the latest version.

Answer

The NIPS is configured to send alerts to the SIEM.

Question 2

A systems security engineer is validating the implementation of security controls for a new federal information system. The system's security plan specifies that the organization will follow NIST RMF guidance and use NIST SP 800-53A for assessment. The engineer must verify that the implemented controls meet the stated security requirements. Which activity BEST represents the verification step in this context?

Accepted Answer

Performing a control assessment using NIST SP 800-53A assessment procedures to examine evidence and determine control effectiveness.. The verification step in the RMF involves assessing implemented controls against security requirements using structured procedures. NIST SP 800-53A assessment procedures guide the engineer to examine, interview, and test controls to determine if they are effective. This systematic approach ensures that each control is evaluated against its specification, providing objective evidence that the system's security posture meets the stated requirements and supports authorization decisions.

Answer

Interviewing system administrators about their security practices and documenting their responses.

Answer

Reviewing the system security plan to ensure it includes all required controls.

Answer

Conducting a penetration test to identify exploitable vulnerabilities in the system.

Question 3

A security engineer is validating a boundary defense implementation and must confirm that the system enforces least privilege for inter-zone traffic. The design states that only approved services may cross from a lower-trust zone to a higher-trust zone. Which verification activity provides the strongest evidence that the enforcement point actually implements this policy?

Accepted Answer

Executing test traffic from each lower-trust zone to each higher-trust zone and confirming that only approved services succeed. Enforcement claims must be tested against live behavior. Sending representative traffic between every lower-trust and higher-trust zone pair and verifying that only approved services complete demonstrates the actual policy decision path, including rule order and implicit denies. Document review, interviews, and vulnerability scans describe intent, process, or device hygiene, none of which proves that unauthorized services are blocked. Direct traffic testing is therefore the strongest evidence for least-privilege boundary enforcement.

Answer

Reviewing the firewall rule base export and confirming that each rule maps to an approved service request

Answer

Reviewing the last vulnerability scan report for the boundary devices

Answer

Interviewing the firewall administrators about how they apply the least-privilege policy

Question 4

You are validating the implementation of security controls for a database server that stores sensitive customer data. The requirement is to verify that the database enforces encryption at rest and that access is restricted to authorized users. Which TWO of the following verification activities best confirm that these requirements are met? (Choose two.)

Accepted Answer

Review database user accounts and roles to confirm that only authorized personnel have access and that least privilege is enforced.. Encryption at rest is verified by confirming TDE and secure key storage, while access restriction is verified by reviewing user accounts and roles for least privilege. Network scanning, backup tape encryption, and audit logging address other security aspects but do not directly confirm the two stated requirements. The combination of TDE/HSM and role review provides the most direct evidence.

Answer

Confirm that the database audit log records all SELECT statements on sensitive tables.

Answer

Verify that database backups are stored on encrypted tape media.

Answer

Run a network vulnerability scan against the database server to identify open ports and missing patches.

Question 5

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Generate a controlled sequence of events that should trigger a specific correlation rule and confirm that the SIEM produces the expected alert.. The most appropriate validation for correlation rules is to generate a controlled event sequence that should trigger a specific rule and confirm the expected alert. This tests the complete correlation pipeline from event ingestion through rule evaluation to alert generation. Documentation review, connectivity checks, and capacity verification are supporting activities but do not prove that correlation logic functions correctly.

Answer

Check the SIEM's licensing and storage capacity to ensure it can handle the volume of events from all sources.

Answer

Verify that all log sources are configured to send events to the SIEM and that the SIEM is receiving events from each source.

Answer

Review the SIEM's correlation rule documentation and confirm that each rule maps to a documented use case.

Question 6

A security engineer is performing verification of a newly deployed intrusion prevention system (IPS) inline on the network perimeter. The goal is to confirm that the IPS is actively blocking malicious traffic rather than only alerting. Which action provides the most direct verification of blocking capability?

Accepted Answer

Send a controlled test exploit through the IPS toward a target host and confirm the traffic is dropped and the session fails.. Confirming prevention requires observing the device stop malicious traffic in the live path. Sending a controlled exploit and verifying it is dropped while the target remains unaffected tests signature matching and the blocking action together. Alerts, signature currency, and topology documentation each cover only part of the picture and cannot prove that attacks are actually prevented.

Answer

Review the IPS event dashboard to confirm that signature alerts are being generated for known attack patterns.

Answer

Confirm that the IPS is deployed inline rather than in tap or span mode by reviewing the network diagram.

Answer

Verify that the IPS signature database is current and that automatic updates are enabled.

Question 7

A system is undergoing security control assessment before authorization to operate. The assessor must determine whether the implemented audit logging control satisfies the stated requirement that all authentication events, including failures, are recorded with sufficient detail for accountability. Which assessment method yields the most defensible evidence for this determination?

Accepted Answer

Generating both successful and failed authentication attempts, then examining the resulting log entries for required detail. Assessment methods fall into interview, examine, and test categories, and control effectiveness claims need the strongest applicable evidence. Triggering real authentication successes and failures and then reading the resulting records both demonstrates event capture and reveals entry detail. This directly addresses the requirement for complete, accountable authentication logging and produces artifacts that can be independently re-verified.

Answer

Interviewing the system administrator about how logging was configured during deployment

Answer

Reviewing the vendor's product documentation describing which authentication events the platform can log

Answer

Confirming that the log retention policy specifies a period consistent with the organization's records schedule

Question 8

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

Accepted Answer

An automated configuration baseline monitor that checks servers on a scheduled interval and alerts on drift. The requirement is about detection latency for unauthorized configuration changes. Only an automated baseline monitor running at least hourly compares live settings to the approved baseline and raises alerts, producing evidence that deviations are caught inside the one-hour window. Quarterly audits and weekly ticket reviews are too infrequent and inspect process records rather than server state. Narrowly scoped file integrity monitoring lacks the coverage of security-relevant settings, so it cannot satisfy the requirement either.

Answer

Reviewing the change management ticketing system for approved change requests each week

Answer

A quarterly manual configuration audit performed by the security team

Answer

File integrity monitoring configured to watch only the operating system kernel binaries

Question 9

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Revoke a test certificate and confirm that a relying party rejects a connection using that certificate.. Direct evidence of issuance and revocation control effectiveness comes from exercising the controls. Rejecting a non-compliant certificate request proves the issuance policy is enforced, and rejecting a connection after revocation proves the revocation information is published and checked. Documentation, asset tracking, and time synchronization are supporting activities that do not demonstrate the controls actually function.

Answer

Review the certificate practice statement to confirm it documents the issuance and revocation procedures.

Answer

Verify that the CA server's clock is synchronized with an authoritative time source.

Answer

Confirm that the root certificate is stored in the organization's configuration management database with a current owner.

Question 10

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

On a sample laptop, confirm that manage-bde -status shows TPM and PIN protectors and that the recovery password is present in Active Directory.. The strongest evidence combines checking the actual BitLocker configuration on a laptop with verifying that the recovery key is escrowed in Active Directory. The manage-bde -status output confirms the TPM and PIN protectors are active, while the Active Directory check confirms escrow. Together they validate both the local encryption configuration and the centralized recovery requirement.

Answer

Run manage-bde -status on a sample laptop and confirm that the protection status is On and the key protector includes TPM and PIN.

Answer

Review the Group Policy Object that configures BitLocker requirements and confirm that it specifies TPM and PIN and requires recovery key escrow.

Answer

Verify in Active Directory Users and Computers that the BitLocker recovery information attribute is populated for a sample of laptops.

Question 11

During a verification review of a cryptographic implementation, the engineer must confirm that data at rest on a storage volume is protected with an approved algorithm and key length, and that the protection is genuinely active rather than merely provisioned. Which combination of activities best verifies the implemented state?

Accepted Answer

Inspect the volume's cryptographic metadata to identify the active algorithm and key length, then confirm the mapped device is inaccessible without the key. Verifying implemented cryptography requires observing the actual security parameters in force and demonstrating the protective mechanism operates. Reading the volume metadata reveals the algorithm and key length, while a keyless access attempt proves the data is genuinely inaccessible without the cryptographic material. This pair of activities distinguishes active protection from provisioned capability and satisfies the verification objective.

Answer

Verify that the key management service stores keys in a hardware security module and that key rotation is scheduled

Answer

Review the change record showing the encryption was applied during the last maintenance window and was approved

Answer

Confirm the encryption license is installed and the management console shows the volume as encrypted-capable

Question 12

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

Accepted Answer

Confirming the module holds a current FIPS 140-3 validation certificate at the required security level and reviewing the associated test evidence. The requirement has two parts: independent testing and tamper-resistant key protection. A FIPS 140-3 validation certificate from an accredited laboratory, matched to the correct module version and security level, is the standard evidence for both. Vendor documentation is self-attested, organization-run tests are not independent and do not assess physical security, and algorithm selection alone ignores key protection entirely. Reviewing the certificate and validation report therefore yields the most defensible verification result.

Answer

Running the organization's own known-answer tests and entropy assessments against the module

Answer

Verifying that the module uses only NIST-approved algorithms such as AES-256 and SHA-384

Answer

Reviewing the vendor's internal cryptographic design specification and algorithm test results

Question 13

A security engineer is verifying that an implemented boundary device correctly performs deep inspection of allowed application traffic rather than only permitting it based on port and protocol. The requirement states that the device must detect and block protocol anomalies within permitted sessions. Which verification approach provides the strongest evidence that this inspection capability is genuinely operating?

Accepted Answer

Send crafted traffic containing a known protocol anomaly inside an otherwise permitted session and confirm the device blocks or alerts. Deep inspection requirements demand evidence that the engine examines content within permitted sessions, not merely that the feature is licensed or referenced. Crafting a known protocol anomaly inside an allowed flow and observing the block or alert exercises the full inspection path. This dynamic verification confirms the capability is bound to the policy and functioning, which configuration review and logging alone cannot establish.

Answer

Review the rule base to confirm that inspection profiles are referenced by the rules permitting the application traffic

Answer

Verify that the device logs all permitted sessions with source and destination information for audit purposes

Answer

Confirm the device's feature list includes application inspection modules and that the relevant licenses are active

Question 14

A security engineer is verifying the implementation of a public key infrastructure (PKI) for a government agency. The agency requires that all digital certificates comply with FIPS 140-2 and are issued by a trusted certificate authority. During validation, the engineer needs to confirm that a server's certificate is valid and has not been revoked. Which mechanism should the engineer use to check the certificate's revocation status in real time?

Accepted Answer

Online Certificate Status Protocol (OCSP). OCSP is designed for real-time certificate revocation checking. It allows a client to send a request to an OCSP responder, which returns the current revocation status of the certificate. This meets the requirement for real-time validation. CRLs are updated periodically and may not reflect recent revocations. CT logs and SCEP serve different purposes in PKI. Using OCSP ensures that the server's certificate is checked against the latest revocation information, which is critical for maintaining trust in the PKI.

Answer

Certificate Revocation List (CRL)

Answer

Certificate Transparency (CT) logs

Answer

Simple Certificate Enrollment Protocol (SCEP)

Question 15

You are finalizing the verification and validation report for a system entering the authorization phase. The approving official requires evidence that the implemented security controls are not only present but operating correctly, and that residual weaknesses are documented. Which TWO activities must be completed to satisfy this requirement? (Choose two.)

Accepted Answer

Document identified deficiencies, their assessed risk, and the planned remediation or acceptance rationale in a residual risk statement. The approving official needs two things: proof that controls operate as intended and an honest accounting of what remains weak. Executing test and evaluation procedures against expected results supplies the operational evidence, while documenting deficiencies with risk and remediation or acceptance rationale supplies the residual risk picture. Together they let the authorizing official make an informed, defensible decision rather than relying on design intent.

Answer

Compile the original design specification documents and confirm they are stored in the configuration management repository

Answer

Schedule the next periodic vulnerability scan and confirm the scanning credentials will be available to the operations team

Answer

Obtain a vendor letter confirming the product version is supported under an active maintenance agreement