ISC Systems Security Implementation Verification And Validation — Timed 20 Questions

Question 1

When validating the security implementation of a Cisco ASA firewall, which command provides the most accurate verification of the currently applied Access Control List (ACL) to a specific interface?

Accepted Answer

show access-list. While 'show access-list' displays all configured access lists and their hit counts, the 'show access-group' command (or examining the specific interface configuration via 'show run interface') is required to see which ACL is actually applied to a specific interface. However, looking at the standard Cisco ASA command set, to see the applied access groups, 'show access-group' is used. If sticking strictly to the provided options, 'show run interface' actually shows the applied access-group for that specific interface, making the current correct answer and explanation inaccurate for the specific wording of the question.

Answer

show run interface

Answer

show version

Answer

show interface status

Question 2

A security engineer is validating the implementation of a TLS 1.3 configuration on an Nginx server. Which configuration directive must be verified to ensure only secure ciphers are used?

Accepted Answer

ssl_prefer_server_ciphers on;. To ensure that specific secure ciphers are used in Nginx, the 'ssl_ciphers' directive must be configured. Note that in TLS 1.3, cipher suites cannot be selected individually using 'ssl_ciphers' in older configurations in the same way as TLS 1.2, but 'ssl_ciphers' is the standard Nginx directive associated with cipher configuration.

Answer

ssl_session_cache shared:SSL:10m;

Answer

ssl_verify_client on;

Answer

ssl_protocols TLSv1.3;

Question 3

During a penetration test of a web application, you identify an insecure direct object reference (IDOR). What is the most effective way to verify that your remediation via access control checks is successful?

Accepted Answer

Execute automated authorization testing using a tool like Burp Suite Intruder to verify that non-authorized users receive a 403 Forbidden response.. Regression testing ensures that the fix addresses the vulnerability without breaking functionality.

Answer

Review the source code to ensure that the developer used a random UUID instead of sequential integers.

Answer

Run a vulnerability scanner to check for OWASP Top 10 compliance.

Answer

Perform a manual cross-site scripting (XSS) payload injection to confirm input sanitization.

Question 4

During a cloud security audit, you need to verify that IAM users do not have overly permissive policies. Which AWS feature provides automated validation of IAM policy adherence to least privilege?

Accepted Answer

AWS IAM Access Analyzer. AWS IAM Access Analyzer uses automated reasoning to analyze resource-based policies and IAM policies to identify resources that can be accessed from outside the account or identify unused permissions, which directly supports the principle of least privilege.

Answer

AWS Security Hub

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 5

You are validating the security of a web service using OAuth 2.0. Which specific verification step ensures that the authorization code is not leaked?

Accepted Answer

Verify that the redirect_uri is strictly validated against a whitelist on the authorization server.. Strictly validating the 'redirect_uri' on the authorization server ensures that authorization codes are only sent to legitimate, pre-registered endpoints belonging to the client application, preventing attackers from registering malicious URIs to intercept or leak the code.

Answer

Check the HTTP header for 'X-Frame-Options'.

Answer

Verify that the client secret is stored in the database.

Answer

Ensure the application uses HTTPS.

Question 6

You are verifying the implementation of an Intrusion Detection System (IDS). Which technique is used to ensure the IDS is detecting traffic as expected?

Accepted Answer

Replay a known malicious packet capture (PCAP) through the network segment.. Simulated attacks (using tools like Metasploit or Nmap) are the only way to verify detection capability.

Answer

Review the last update date of the signature database.

Answer

Check the IDS management console for 'Up' status.

Answer

Verify that the IDS is configured in 'Inline' mode.

Question 7

During a validation exercise, you need to confirm that an application's logging mechanism is compliant with NIST SP 800-92. Which element must be verified?

Accepted Answer

Ensure every log entry contains a user ID, timestamp, and event outcome.. NIST SP 800-92 emphasizes that logs must include user IDs, timestamps, and success/failure status.

Answer

Check if logs are printed to the console.

Answer

Confirm that the logging level is set to 'DEBUG'.

Answer

Verify that all logs are stored in a database.

Question 8

You are verifying the security configuration of an Amazon S3 bucket. Which S3 feature must be enabled to ensure that object deletions are reversible in case of accidental or malicious data loss?

Accepted Answer

S3 Object Lock. S3 Object Lock enables you to store objects using a 'Write Once, Read Many' (WORM) model. It helps prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely, ensuring data loss protection against accidental or malicious deletions. While S3 Versioning keeps previous versions, a standard versioned object can still be permanently deleted by removing all versions or using a delete marker (unless MFA Delete is enabled). Object Lock provides the definitive safeguard against deletion.

Answer

S3 Block Public Access

Answer

S3 Versioning

Answer

S3 Lifecycle Policies

Question 9

You are validating the security of a web application. Which TWO of the following actions verify that input validation is effective against SQL injection?

Accepted Answer

Attempting to input common SQL injection characters (e.g., ') in application fields.. Using parameterized queries and reviewing input filter logic are the two most effective ways to verify SQLi defenses.

Answer

Verifying that the database administrator account has full system access.

Answer

Ensuring the website uses SSL/TLS for all traffic.

Answer

Checking that the web server is running on the latest patch version.

Question 10

During a security audit of a PKI implementation, which TWO of the following must be verified to ensure the integrity of the certificate chain?

Accepted Answer

The Certificate Revocation List (CRL) is updated and accessible.. Option D is correct because a current, reachable CRL (or OCSP responder) is essential for chain integrity validation: relying parties must be able to confirm that no certificate in the chain has been revoked, and a stale or unreachable CRL breaks path validation and can cause clients to reject or improperly trust certificates. Option E is correct because the Root CA private key is the ultimate trust anchor for the entire chain; storing it in a FIPS 140-2/140-3 validated HSM with strict access controls and offline protection prevents key compromise, which would otherwise allow an attacker to forge certificates and invalidate the integrity of every chain. Option A is incorrect because serial numbers must be unique per issuer, not identical across all server certificates; duplicate serials would actually indicate a serious CA defect. Option B is incorrect because domain membership of the CA server is irrelevant to cryptographic chain integrity and is not required for a standalone or offline Root CA. Option C is incorrect because 1024-bit RSA is deprecated and weak; modern PKI requires at least 2048-bit RSA (or ECDSA P-256/P-384), so mandating 1024-bit keys would undermine, not ensure, integrity.

Answer

All server certificates have the same serial number.

Answer

The CA server is joined to the domain.

Answer

All certificates are issued with 1024-bit RSA keys.

Question 11

A security engineer is performing verification and validation on a Linux-based web server that must comply with the CIS Benchmark. The engineer needs to validate that the SSH service is securely configured. Which TWO of the following validation activities provide direct evidence that the SSH configuration meets the benchmark requirements? (Choose two.)

Accepted Answer

Run sshd -T and confirm that PermitRootLogin is set to no, Protocol is 2, and weak ciphers are not listed.. Direct evidence of SSH configuration compliance comes from examining the effective running configuration and testing actual behavior. Running sshd -T reveals the effective settings after all overrides, and attempting root authentication confirms enforcement. File permission checks and service enablement are supporting controls but do not validate the specific SSH security directives required by the benchmark.

Answer

Verify that the SSH service is enabled to start at boot using systemctl is-enabled sshd.

Answer

Review the /etc/ssh/sshd_config file and confirm that the required directives are present and not commented out.

Answer

Check the file permissions on /etc/ssh/sshd_config and confirm they are set to 600 or more restrictive.

Question 12

A security engineer is validating the implementation of a Security Content Automation Protocol (SCAP) scan on a Windows Server 2022 system. The engineer must ensure the scan results are reliable and can be used for continuous monitoring. Which SCAP component is specifically responsible for expressing and checking configuration requirements in a machine-readable format?

Accepted Answer

Open Vulnerability and Assessment Language (OVAL). OVAL is the SCAP component that enables machine-readable expression of system state and assessment of configuration requirements. It defines checks that can be automatically evaluated against a system, producing precise results. While XCCDF organizes checklists and ARF packages results, OVAL provides the underlying logic for checking configurations. Using OVAL ensures that the scan is standardized and repeatable, which is essential for reliable continuous monitoring and validation of the Windows Server 2022 configuration.

Answer

Asset Reporting Format (ARF)

Answer

Common Configuration Enumeration (CCE)

Answer

Extensible Configuration Checklist Description Format (XCCDF)

Question 13

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

Accepted Answer

Run 'kube-bench --targets etcd' to perform the automated audit.. kube-bench is the CIS-certified tool that automates Kubernetes CIS Benchmark checks, and its --targets etcd flag runs only the etcd-specific controls (e.g., ensuring etcd data dir permissions, peer/client cert authentication, and encryption at rest). It reads the etcd manifest and configuration files directly on the control plane node to produce pass/fail results mapped to CIS control IDs. This is the standard automated audit method for etcd hardening.

Answer

Use 'kubectl get pods' to check the etcd pod configuration.

Answer

Perform a manual audit using 'etcdctl get --prefix /'.

Answer

Use the 'kubectl describe nodes' command to check for node hardening.

Question 14

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

Accepted Answer

Deploy an AWS Config custom rule using an AWS Lambda function to evaluate resource configurations.. AWS Config custom rules allow you to define your own compliance logic using AWS Lambda functions that evaluate resource configurations against your specific security policy. This enables continuous monitoring because AWS Config automatically triggers the Lambda function whenever a relevant resource changes or on a periodic schedule, and it records compliance results. Unlike built-in managed rules, custom rules give you the flexibility to enforce bespoke policies that aren't covered out-of-the-box.

Answer

Configure Amazon GuardDuty to alert on unauthorized resource modifications.

Answer

Use AWS Trusted Advisor to scan for unencrypted S3 buckets.

Answer

Enable AWS CloudTrail to log all API calls and review the logs for policy violations.

Question 15

You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?

Accepted Answer

Run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1.. The correct command is to run 'cat /proc/sys/crypto/fips_enabled' and confirm the output is 1. This virtual file reflects the kernel's FIPS mode status. When FIPS mode is enabled, the value is 1; otherwise, it is 0. This is the standard method to verify FIPS mode on Linux systems that use the kernel crypto API.

Answer

Inspect '/etc/fips.conf' for the FIPS_ENABLED=true directive.

Answer

Check the status using 'systemctl status crypto-policy'.

Answer

Execute 'openssl verify -CApath /etc/ssl/certs' to validate certificate chains.

Question 16

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Accepted Answer

manage-bde -status C:. manage-bde is the CLI tool for BitLocker administration.

Answer

cipher /e

Answer

bitlocker-check

Answer

diskpart /info

Question 17

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

Accepted Answer

Verify the use of mutual TLS (mTLS) and log hashing/signing in the syslog configuration.. Log integrity is verified by ensuring the logs are digitally signed or protected from tampering during transit.

Answer

Verify that the SIEM administrative account has read-only permissions.

Answer

Review the firewall logs to see if port 514 is open.

Answer

Check if the SIEM has received a sample log entry via 'tail -f'.

Question 18

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

Accepted Answer

Verify the presence and integrity of tamper-evident seals on the chassis.. Physical tamper evidence is a critical component of HSM security validation.

Answer

Perform an audit of the HSM's internal log files.

Answer

Verify the HSM firmware version against the manufacturer's website.

Answer

Test the HSM's response to an incorrect PIN retry threshold.

Question 19

When validating the security of a database implementation, how do you verify that sensitive data at rest is encrypted using Transparent Data Encryption (TDE)?

Accepted Answer

Query the sys.dm_database_encryption_keys dynamic management view.. Verifying the system catalog or dynamic management views is the standard way to confirm TDE status.

Answer

Check if the database folder has the 'encrypted' flag set in Windows File Properties.

Answer

Attempt to open the database file in a text editor.

Answer

Use the 'encrypt' command in the database shell.

Question 20

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

Accepted Answer

nmap -p 80 <target_ip>. Nmap is a standard network scanning tool used to verify that specific ports are blocked or filtered.

Answer

nslookup <target_ip>

Answer

netstat -an

Answer

ipconfig /all