(ISC)2 Information Systems Security Engineering Professional (CISSP-ISSEP, Aug 2025 blueprint) (ISC) (ISC) — Questions 301–332

Querying the `sys.dm_database_encryption_keys` dynamic management view directly satisfies the requirement to verify Transparent Data Encryption for data at rest by exposing real-time operational states and encryption algorithm details for databases within an instance. This specific diagnostic interface reveals the precise encryption state—such as encrypted or unencrypted—along with the protector type and certificate thumbprint, providing definitive cryptographic proof rather than relying on configuration assumptions or theoretical policy definitions.

A security impact analysis is the mechanism for determining whether a change affects the security posture, the implemented controls, or the risk determination. In a continuous authorization approach, this analysis feeds the ongoing assessment and authorization decision. Without it, the organization cannot know whether the authorization remains valid or whether additional action is needed.

Verifying that no new vulnerabilities were introduced directly satisfies the Post-Implementation Review (PIR) requirement to validate the security posture after a modification. This technical assessment involves performing vulnerability scanning and configuration audits on the newly deployed components to ensure that misconfigurations, outdated dependencies, or insecure protocol implementations have not been inadvertently integrated into the environment. Confirming the absence of residual security gaps guarantees that the implemented change maintains the organisation's risk threshold before sign-off.

Revoking a certificate and then verifying that a client or server rejects it confirms the revocation information is published and consumed by relying parties. This tests the full chain from revocation action to enforcement at connection time, which is the core objective of revocation validation. It produces direct evidence that the control functions end to end.

The simple security property, often called no read up, prevents a subject from reading data classified above its clearance. This directly addresses unauthorized disclosure because a lower-cleared subject cannot access higher-classified objects. Enforcing this rule is essential to the confidentiality goal of Bell-LaPadula, and omitting it would allow a subject to read information it is not authorized to see, which is precisely the disclosure the model is designed to prevent.

Segmenting the DMZ with a firewall that enforces least privilege ensures that only required traffic can reach the internal network. This limits the blast radius if the web server is compromised. The firewall acts as a control point, and rules should be as restrictive as possible. This design aligns with DoD and NIST guidance for DMZ architectures.

A cross-domain solution that includes a content filter and protocol break ensures that data is inspected and sanitized before crossing the boundary. The protocol break terminates the protocol on the low side and re-originates it on the high side, preventing protocol-based attacks. This directly meets the requirement to allow only authorized transfers and protect the high side.

Biometric verification relies on intrinsic physiological or behavioural characteristics, satisfying the core authentication factor category of inherent traits. This mechanism captures unique physical attributes—such as fingerprint ridges, retinal patterns, or facial geometry—via specialized hardware sensors, converts the scanned analogue data into a digital template through feature extraction algorithms, and compares it against a previously enrolled reference template using a fuzzy matching threshold. Because this approach validates identity through biological uniqueness rather than memorised secrets or physical tokens, it successfully fulfils the specific criterion of "something you are."

A guard is a key component of a cross-domain solution that enforces security policies, sanitizes data, and validates formats to prevent leakage of sensitive information. It operates on a trusted path and applies rules that determine what data can pass between security domains, making it the appropriate architectural choice for this scenario.

An air gap eliminates direct network connectivity but leaves other vectors. Insiders, compromised software updates, and removable media can introduce malware or exfiltrate data. A full risk assessment must evaluate these threats, along with vulnerabilities in the software and hardware supply chain. The ISSEP should ensure the assessment covers all realistic attack paths, not just network-based ones, to support an accurate risk determination.

Reading the volume's cryptographic metadata establishes which algorithm and key length are actually in force, and attempting access without the key confirms the protection is functioning rather than dormant. Together these provide direct evidence of both the approved parameters and active enforcement, which is the defensible basis for verifying data-at-rest protection in an implemented system.

Cryptographic key management requires that keys be generated, stored, distributed, and destroyed in a manner that protects them from unauthorized disclosure. Storing a signing key in plaintext in a configuration file alongside the application means anyone who reads the file can forge messages, completely undermining the digital signature. The design therefore violates the key management principle that keys must be protected independently of the data they secure.

Documenting the risk and implementing compensating controls addresses the fundamental constraint of legacy system incompatibility with TLS 1.3. Since the legacy architecture cannot natively support modern cryptographic suites, an ISSE must isolate the system behind a reverse proxy or a secure gateway that terminates TLS 1.3 connections externally. This approach maintains the required security posture without necessitating a full system replacement, while potentially integrating with modern identity providers like Microsoft Entra ID to enforce robust authentication and traffic inspection at the perimeter.

Shredding physically reduces media to small particles, ensuring data is unrecoverable even against laboratory attacks. NIST SP 800-88 lists shredding as a Destroy method suitable for both SSDs and HDDs. This meets the most stringent sanitization level for media that cannot be reused or where the highest assurance is required.

The Security Target functions as the definitive implementation-specific document that establishes the precise security claims for a product. By detailing the security functional and assurance requirements, it provides the formal baseline against which the evaluator performs their assessment. This document acts as the binding agreement between the vendor and the evaluation facility, ensuring both parties agree on the specific scope and security boundaries before the certification process commences, thereby satisfying the Common Criteria requirement for a verifiable, vendor-defined security specification.

NIST SP 800-137 provides guidance on developing and implementing an ISCM strategy, including defining metrics, establishing monitoring frequencies, and integrating automated tools to support ongoing authorization. It directly enables near real-time risk determination by aligning monitoring activities with organizational risk tolerance and the RMF steps.

A requirements traceability matrix (RTM) explicitly maps each security requirement to its source (stakeholder needs, policies, regulations), design components, implementation, and verification methods. This ensures that every requirement is addressed and validated, supporting compliance with NIST SP 800-53 and enabling impact analysis for changes. It is the standard mechanism for achieving the required traceability.

NIST SP 800-53A provides assessment procedures specifically designed to verify that controls are implemented correctly, operating as intended, and producing the desired outcome. Using these procedures, the engineer examines evidence such as configurations, logs, and interviews to determine effectiveness. This directly fulfills the verification step in the RMF, ensuring controls meet the security requirements stated in the security plan and applicable baselines.

Running container processes as a non-privileged user adheres to the principle of least privilege, directly satisfying the security compliance requirement for containerised environments. By preventing the container from executing as root, you mitigate the risk of container breakout attacks where a compromised process could gain host-level administrative access. This configuration ensures that even if an application vulnerability is exploited, the attacker remains confined by the restricted permissions of the user account, thereby limiting the potential impact on the underlying host operating system.

Hardcoding API keys within mobile application binaries exposes credentials to static analysis, as compiled code remains accessible to anyone who decompiles the package. Attackers can easily extract these plaintext strings using standard reverse engineering tools, bypassing any obfuscation attempts. This vulnerability directly addresses the constraint of third-party service integration, as compromised keys allow unauthorised access to external resources. Organisations should instead utilise secure identity providers like Microsoft Entra ID or managed key vaults to authenticate requests dynamically rather than embedding static secrets.

Hashing ensures data authenticity by detecting unauthorised modifications, while off-loading logs to a write-only destination prevents attackers from tampering with or deleting evidence after a compromise. This combination satisfies the 'Log Integrity' constraint by establishing a verifiable chain of custody and an immutable storage architecture. By decoupling the log generation from the storage environment, administrators ensure that audit trails remain intact and forensic analysis remains reliable, even if the primary production system is fully compromised by an adversary.

Attribute-Based Access Control (ABAC) satisfies the principle of Least Privilege in microservices by evaluating policies based on dynamic environmental and subject attributes rather than static roles. This granular evaluation allows services to restrict access according to real-time context, such as time-of-day or resource sensitivity, which is essential for decoupling security logic from service code. By leveraging identity providers like Microsoft Entra ID to supply these claims, organisations can enforce fine-grained authorisation policies that adapt to the distributed nature of microservices without the administrative overhead of managing thousands of individual roles.

Independent third-party evaluation, such as Common Criteria (ISO/IEC 15408), provides objective evidence that the product meets specified security functional and assurance requirements. The evaluation assurance level (EAL) indicates the depth of testing and analysis. For classified systems, such certification is often mandatory. It offers a structured, repeatable basis for trust, unlike vendor claims or reputation.

The NIST Cryptographic Module Validation Program maintains the authoritative registry of FIPS 140-3 validated modules, listing each certificate, its validation level and tested operational environment. Checking this registry confirms whether the load balancer's TLS module actually holds the required physical security validation.

A FIPS 140-3 certificate issued through the Cryptographic Module Validation Program is independent, third-party evidence that the module was tested against defined requirements for cryptographic functions and, at higher levels, physical tamper resistance. Matching the certificate to the exact module version and security level, and reviewing the validation report, gives defensible proof of independent testing and tamper-resistant key protection.

Unsalted SHA-256 hashes are fast to compute and vulnerable to precomputed rainbow table attacks, making them unsuitable for password storage under a strong cryptography requirement. The absence of a salt also allows identical passwords to produce identical hashes, enabling correlation. This finding correctly identifies a non-compliant storage implementation even though transport encryption is properly configured.

The system's identities at the external provider remain valid until explicitly revoked. Failing to revoke client credentials or service accounts leaves a dormant but usable access path into the provider and potentially into other federated resources. Including this activity in the disposal plan ensures the trust relationship is terminated as part of system shutdown.

SAML 2.0 is an XML-based standard for exchanging authentication and authorization data between parties. In an SOA, SAML assertions can be used to convey the identity of the sender and their attributes, which services can then trust. Combined with WS-Security, SAML tokens can be embedded in SOAP messages to provide end-to-end identity verification and enable single sign-on across services.

Documenting the data sanitisation method satisfies the requirement to ensure information confidentiality during the end-of-life phase. By specifying the cryptographic erasure or physical destruction technique, organisations verify that residual data is rendered unrecoverable, preventing unauthorised access after hardware disposal. This process is essential for maintaining compliance with data protection standards, particularly when managing identities within Microsoft Entra ID or decommissioning physical storage media that previously held sensitive system configurations and user credentials.

Solid-state drives rely on NAND flash memory, which stores data as electrical charges within floating-gate transistors rather than through magnetic polarity. Because these devices lack the magnetic storage medium that degaussing targets, the process fails to alter the stored binary states. Degaussing is designed exclusively for magnetic media like hard disk drives or tapes; consequently, it cannot sanitise an SSD, leaving the PII intact and accessible despite the application of a high-intensity magnetic field.

Selecting security controls directly satisfies the requirement to identify safeguards based on the system’s determined impact level, as defined in NIST SP 800-53. During this phase, organisations map the categorisation results—Low, Moderate, or High—to a baseline of controls. This process ensures that the chosen security measures are proportional to the identified risk, allowing practitioners to tailor the baseline to specific operational needs while maintaining compliance with the overarching NIST RMF framework requirements for system protection.

The audit shows findings are not consistently reviewed or remediated, indicating missing process ownership and accountability. A formal risk management process with assigned roles, scheduled reviews, and escalation paths directly addresses this root cause. It ensures findings are triaged, prioritized, and tracked to closure, which is the essence of effective continuous monitoring under an ISSEP risk framework.