Scenario practice questions

An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)

Trap 1: Replace all legacy PLCs with new models that support patching.

While replacement is a long-term solution, it is not a compensating control and may be cost-prohibitive or disruptive to operations. The question asks for compensating controls to reduce risk in the current state. Replacement is a risk avoidance strategy, not a compensating control, and may take years to implement.

Trap 2: Deploy host-based antivirus software directly on the PLCs.

Legacy PLCs typically run real-time operating systems that do not support host-based antivirus software. Installing such software could disrupt control processes and is often technically infeasible. Antivirus is not a viable compensating control for PLCs; instead, network-level protections are more appropriate.

Trap 3: Require all operators to use multi-factor authentication (MFA) when…

Legacy PLCs often lack support for MFA and may not have user authentication at all. Even if MFA could be added, it does not address network-based attacks or physical tampering. MFA is a good practice for human-machine interfaces (HMIs) but is not the most effective compensating control for the PLCs themselves.

A
Replace all legacy PLCs with new models that support patching.
Why it fails: While replacement is a long-term solution, it is not a compensating control and may be cost-prohibitive or disruptive to operations. The question asks for compensating controls to reduce risk in the current state. Replacement is a risk avoidance strategy, not a compensating control, and may take years to implement.
B
Implement network segmentation with industrial firewalls to isolate the PLCs from the corporate network and the internet.
Network segmentation with industrial firewalls limits lateral movement and blocks unauthorized access to legacy PLCs. Since patching is not possible, isolating the devices reduces exposure to external threats. This is a fundamental compensating control for unpatched ICS components, as it prevents attackers from reaching the PLCs directly.
C
Deploy host-based antivirus software directly on the PLCs.
Why it fails: Legacy PLCs typically run real-time operating systems that do not support host-based antivirus software. Installing such software could disrupt control processes and is often technically infeasible. Antivirus is not a viable compensating control for PLCs; instead, network-level protections are more appropriate.
D
Establish strict physical access controls and monitoring for the control room and PLC cabinets.
Physical access controls prevent unauthorized individuals from directly connecting to or tampering with PLCs. Since many ICS attacks require physical proximity, restricting access and monitoring entry points significantly reduces risk. This is a highly effective compensating control when patching is not possible.
E
Require all operators to use multi-factor authentication (MFA) when logging into the PLCs.
Why it fails: Legacy PLCs often lack support for MFA and may not have user authentication at all. Even if MFA could be added, it does not address network-based attacks or physical tampering. MFA is a good practice for human-machine interfaces (HMIs) but is not the most effective compensating control for the PLCs themselves.

Read the full VPN explanation →

Question 2hardmultiple choice

An ISSEP is designing a secure network architecture for a system that must support remote users accessing sensitive data. The system owner has mandated the use of a VPN to protect data in transit. The ISSEP must select a VPN protocol that provides confidentiality, integrity, and mutual authentication. Which protocol should the ISSEP choose?

Trap 1: L2TP without IPsec

L2TP without IPsec does not provide encryption or confidentiality; it only tunnels PPP sessions. Without IPsec, data is transmitted in cleartext, and there is no integrity or mutual authentication. This would violate the requirement to protect sensitive data in transit. Therefore, L2TP alone is not suitable.

Trap 2: PPTP with MS-CHAPv2

PPTP with MS-CHAPv2 is obsolete and has known vulnerabilities, including weak authentication and encryption. It does not provide strong confidentiality or integrity, and mutual authentication is not robust. Using PPTP would expose sensitive data to interception and tampering. Thus, it fails to meet the security requirements for this system.

Trap 3: SSL/TLS VPN using only server-side certificates

An SSL/TLS VPN using only server-side certificates provides confidentiality and integrity, but it does not provide mutual authentication because the client is not authenticated with a certificate. The server authenticates to the client, but the client may only use a password, which is weaker. The requirement explicitly states mutual authentication, so this option fails.

A
L2TP without IPsec
Why it fails: L2TP without IPsec does not provide encryption or confidentiality; it only tunnels PPP sessions. Without IPsec, data is transmitted in cleartext, and there is no integrity or mutual authentication. This would violate the requirement to protect sensitive data in transit. Therefore, L2TP alone is not suitable.
B
IPsec in tunnel mode with IKEv2
IPsec in tunnel mode with IKEv2 provides confidentiality, integrity, and mutual authentication through the use of ESP and AH, and IKEv2 supports strong authentication methods such as certificates. It is a standard for site-to-site and remote access VPNs, and meets the requirements for protecting sensitive data in transit. Therefore, it is the correct choice for this scenario.
C
PPTP with MS-CHAPv2
Why it fails: PPTP with MS-CHAPv2 is obsolete and has known vulnerabilities, including weak authentication and encryption. It does not provide strong confidentiality or integrity, and mutual authentication is not robust. Using PPTP would expose sensitive data to interception and tampering. Thus, it fails to meet the security requirements for this system.
D
SSL/TLS VPN using only server-side certificates
Why it fails: An SSL/TLS VPN using only server-side certificates provides confidentiality and integrity, but it does not provide mutual authentication because the client is not authenticated with a certificate. The server authenticates to the client, but the client may only use a password, which is weaker. The requirement explicitly states mutual authentication, so this option fails.

Question 3hardmultiple choice

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

Trap 1: Clark-Wilson model

The Clark-Wilson model focuses on commercial integrity through well-formed transactions and separation of duties. It does not define a lattice of sensitivity levels or a no-write-down rule for confidentiality. While it can enforce constraints on how data is modified, it does not directly address the MLS confidentiality requirement of preventing a higher-level subject from writing to a lower-level object.

Trap 2: Graham-Denning model

The Graham-Denning model specifies a set of primitive operations for secure access control, such as creating and deleting objects and subjects, but it does not define a confidentiality lattice or a no-write-down property. It is a generic access control model rather than a multi-level confidentiality model. It would not inherently prevent a Top Secret subject from writing to a Secret object.

Trap 3: Biba integrity model

The Biba model addresses integrity, not confidentiality. It prevents subjects from reading lower-integrity data or writing to higher-integrity objects, which is the opposite direction of the no-write-down confidentiality rule. Applying Biba here would not stop a Top Secret subject from writing to a Secret object; it would instead focus on preventing contamination of higher-integrity data by lower-integrity sources.

A
Clark-Wilson model
Why it fails: The Clark-Wilson model focuses on commercial integrity through well-formed transactions and separation of duties. It does not define a lattice of sensitivity levels or a no-write-down rule for confidentiality. While it can enforce constraints on how data is modified, it does not directly address the MLS confidentiality requirement of preventing a higher-level subject from writing to a lower-level object.
B
Graham-Denning model
Why it fails: The Graham-Denning model specifies a set of primitive operations for secure access control, such as creating and deleting objects and subjects, but it does not define a confidentiality lattice or a no-write-down property. It is a generic access control model rather than a multi-level confidentiality model. It would not inherently prevent a Top Secret subject from writing to a Secret object.
C
Bell-LaPadula model
The Bell-LaPadula model's *-property (star property) states that a subject at a higher sensitivity level cannot write down to an object at a lower sensitivity level. This directly prevents a Top Secret subject from writing to a Secret object, preserving confidentiality. It is the classic model for MLS confidentiality enforcement and matches the no-write-down requirement in the scenario.
D
Biba integrity model
Why it fails: The Biba model addresses integrity, not confidentiality. It prevents subjects from reading lower-integrity data or writing to higher-integrity objects, which is the opposite direction of the no-write-down confidentiality rule. Applying Biba here would not stop a Top Secret subject from writing to a Secret object; it would instead focus on preventing contamination of higher-integrity data by lower-integrity sources.

Question 4hardmultiple choice

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

Trap 1: Conducting a penetration test after each deployment.

Penetration testing is a point-in-time assessment that simulates attacks to identify exploitable vulnerabilities. It does not provide continuous verification of configuration against a baseline. While it can reveal security weaknesses, it is not designed to detect configuration drift or ensure ongoing compliance. Therefore, it does not meet the requirement for continuous verification of the deployed environment against the security baseline.

Trap 2: Periodic vulnerability scans of the cloud environment.

Vulnerability scans identify security weaknesses but do not verify configuration against a security baseline. They focus on known vulnerabilities rather than configuration compliance. While useful, they do not provide continuous verification of configuration drift. The requirement is to ensure the deployed environment matches the approved baseline, which requires configuration monitoring, not just vulnerability assessment.

Trap 3: Manual review of the IaC templates before deployment.

Manual review of IaC templates verifies the intended configuration but does not confirm what is actually deployed. It cannot detect drift that occurs after deployment due to manual changes or external factors. Continuous verification requires monitoring the live environment, not just the templates. Therefore, this approach fails to provide ongoing assurance that the deployed configuration remains compliant with the security baseline.

A
Conducting a penetration test after each deployment.
Why it fails: Penetration testing is a point-in-time assessment that simulates attacks to identify exploitable vulnerabilities. It does not provide continuous verification of configuration against a baseline. While it can reveal security weaknesses, it is not designed to detect configuration drift or ensure ongoing compliance. Therefore, it does not meet the requirement for continuous verification of the deployed environment against the security baseline.
B
Periodic vulnerability scans of the cloud environment.
Why it fails: Vulnerability scans identify security weaknesses but do not verify configuration against a security baseline. They focus on known vulnerabilities rather than configuration compliance. While useful, they do not provide continuous verification of configuration drift. The requirement is to ensure the deployed environment matches the approved baseline, which requires configuration monitoring, not just vulnerability assessment.
C
Manual review of the IaC templates before deployment.
Why it fails: Manual review of IaC templates verifies the intended configuration but does not confirm what is actually deployed. It cannot detect drift that occurs after deployment due to manual changes or external factors. Continuous verification requires monitoring the live environment, not just the templates. Therefore, this approach fails to provide ongoing assurance that the deployed configuration remains compliant with the security baseline.
D
Implementing a cloud security posture management (CSPM) tool that continuously monitors for configuration drift.
CSPM tools continuously monitor cloud environments for misconfigurations and drift from security baselines. They automatically assess deployed resources against predefined policies and alert on deviations. This provides ongoing verification that the environment remains compliant with the approved baseline. In this scenario, CSPM is the best approach because it offers continuous, automated detection of configuration changes, enabling timely remediation and ensuring the deployed state matches the intended secure state.

Question 5easymultiple choice

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

Trap 1: Separation of duties

Separation of duties requires that critical tasks be divided among multiple people or roles to prevent fraud or error. The scenario does not involve a single person controlling an entire critical process. The issue is architectural reliance on obscurity, not a lack of divided responsibilities among personnel.

Trap 2: Defense in depth

Defense in depth is the layering of multiple security controls so that if one fails, others still protect the system. The scenario describes a single point of failure based on secrecy, which is the opposite of defense in depth. However, the specific principle being violated by assuming attackers will not discover the protocol is security through obscurity, not defense in depth itself.

Trap 3: Least privilege

Least privilege means granting users and processes only the minimum access necessary to perform their tasks. The scenario does not describe excessive permissions or broad access; it describes reliance on secrecy of a protocol. While least privilege is important, it does not address the flaw of assuming a design detail will remain hidden from adversaries.

A
Separation of duties
Why it fails: Separation of duties requires that critical tasks be divided among multiple people or roles to prevent fraud or error. The scenario does not involve a single person controlling an entire critical process. The issue is architectural reliance on obscurity, not a lack of divided responsibilities among personnel.
B
Security through obscurity
Security through obscurity is the practice of relying on secrecy of design, implementation, or protocol details as the primary security mechanism. The ISSE objects because once the proprietary protocol is reverse-engineered or leaked, the security fails. Proper systems security engineering requires that security not depend on attackers remaining ignorant of the design, but rather on robust, open, and testable controls.
C
Defense in depth
Why it fails: Defense in depth is the layering of multiple security controls so that if one fails, others still protect the system. The scenario describes a single point of failure based on secrecy, which is the opposite of defense in depth. However, the specific principle being violated by assuming attackers will not discover the protocol is security through obscurity, not defense in depth itself.
D
Least privilege
Why it fails: Least privilege means granting users and processes only the minimum access necessary to perform their tasks. The scenario does not describe excessive permissions or broad access; it describes reliance on secrecy of a protocol. While least privilege is important, it does not address the flaw of assuming a design detail will remain hidden from adversaries.

Question 6hardmultiple choice

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

Trap 1: The system security plan (SSP)

An SSP describes the security controls implemented, their owners, and the authorization boundary, but it typically does not map each requirement to a specific system component. It is a control-centric document used for authorization, not a bidirectional trace of requirements through design. While useful context, it cannot by itself prove that every security requirement has been allocated to a component.

Trap 2: The functional baseline configuration audit report

A functional baseline audit verifies that the as-built system matches the functional baseline specification at a point in time. It addresses configuration conformity, not requirement-to-component allocation. It will not reveal whether a specific security requirement was traced into design; that linkage lives in the traceability record, so this artifact is insufficient evidence for the stated verification objective.

Trap 3: The risk assessment report

A risk assessment identifies threats, vulnerabilities, likelihood, and impact, and it informs requirement selection. It does not track where those requirements land in the design. Using it to prove allocation would conflate risk analysis with requirements management. The scenario asks for evidence of traceability, and a risk report provides none of the bidirectional mapping needed.

A
The system security plan (SSP)
Why it fails: An SSP describes the security controls implemented, their owners, and the authorization boundary, but it typically does not map each requirement to a specific system component. It is a control-centric document used for authorization, not a bidirectional trace of requirements through design. While useful context, it cannot by itself prove that every security requirement has been allocated to a component.
B
The functional baseline configuration audit report
Why it fails: A functional baseline audit verifies that the as-built system matches the functional baseline specification at a point in time. It addresses configuration conformity, not requirement-to-component allocation. It will not reveal whether a specific security requirement was traced into design; that linkage lives in the traceability record, so this artifact is insufficient evidence for the stated verification objective.
C
The Requirements Traceability Matrix (RTM)
An RTM maps each security requirement to its source and to the design, implementation, and test artifacts that satisfy it. In verification and validation of a systems security engineering effort, the RTM is the authoritative evidence that allocation has occurred and that no requirement is orphaned. Reviewing it confirms bidirectional traceability from stakeholder needs down to component-level specifications, which is exactly what this scenario demands.
D
The risk assessment report
Why it fails: A risk assessment identifies threats, vulnerabilities, likelihood, and impact, and it informs requirement selection. It does not track where those requirements land in the design. Using it to prove allocation would conflate risk analysis with requirements management. The scenario asks for evidence of traceability, and a risk report provides none of the bidirectional mapping needed.

Question 7mediummultiple choice

An ISSE is leading the initial security architecture for a new Department of Defense (DoD) command-and-control system. The program manager asks how the ISSE plans to address the risk of a single component failure cascading to a mission-critical function. Which engineering principle should the ISSE apply to reduce the likelihood that one component's failure causes a total loss of the security function?

Trap 1: Increase the security awareness training frequency for all system…

Security awareness training reduces human error and improves response, but it does not change the system architecture. A well-trained administrator cannot prevent a hardware fault or a software defect in a single component from taking down a mission-critical function. The question asks for an engineering principle applied during design, not a personnel or training control.

Trap 2: Rely on a single, highly certified cryptographic module to protect…

A single cryptographic module, even one that is highly certified, creates a single point of failure. If that module is compromised, misconfigured, or fails, all protected traffic is exposed or lost. Certification addresses assurance of the module's correctness but does not provide the redundancy needed to prevent a component failure from cascading to a mission-critical function.

Trap 3: Document all security controls in the system security plan and…

Documentation and periodic review are important for governance and accreditation, but they do not reduce the technical likelihood that a single component failure cascades to a mission-critical function. Paperwork cannot substitute for architectural redundancy. The scenario asks for an engineering principle that addresses failure propagation, not an administrative control that records what was built.

A
Increase the security awareness training frequency for all system administrators.
Why it fails: Security awareness training reduces human error and improves response, but it does not change the system architecture. A well-trained administrator cannot prevent a hardware fault or a software defect in a single component from taking down a mission-critical function. The question asks for an engineering principle applied during design, not a personnel or training control.
B
Rely on a single, highly certified cryptographic module to protect all command-and-control traffic.
Why it fails: A single cryptographic module, even one that is highly certified, creates a single point of failure. If that module is compromised, misconfigured, or fails, all protected traffic is exposed or lost. Certification addresses assurance of the module's correctness but does not provide the redundancy needed to prevent a component failure from cascading to a mission-critical function.
C
Document all security controls in the system security plan and require annual reviews.
Why it fails: Documentation and periodic review are important for governance and accreditation, but they do not reduce the technical likelihood that a single component failure cascades to a mission-critical function. Paperwork cannot substitute for architectural redundancy. The scenario asks for an engineering principle that addresses failure propagation, not an administrative control that records what was built.
D
Implement redundant security mechanisms and diverse implementations so no single point of failure exists.
Redundancy and diversity ensure that if one security control fails or is bypassed, another independent mechanism continues to enforce the security policy. In a DoD command-and-control system, this directly supports mission assurance by eliminating single points of failure. The ISSE should design overlapping controls with different failure modes so an adversary cannot disable the entire security function through one exploit.

Question 8mediummultiple choice

An ISSEP is performing a system-level risk assessment for a new payroll processing system that will operate in a shared datacenter. The system owner insists on using a qualitative risk matrix because the organization lacks reliable historical incident data. During validation, the ISSEP notes that two different assessors assigned the same threat scenario to different likelihood categories, and the risk scores diverged significantly. Which action best addresses this inconsistency while preserving the qualitative approach?

Trap 1: Replace the qualitative matrix with a purely quantitative…

Switching to quantitative ALE does not resolve the root cause, which is inconsistent interpretation of likelihood. It also contradicts the stated constraint that reliable historical data is unavailable, so the ALE inputs would be speculative. The scenario requires improving the qualitative method's reliability, not abandoning it for a technique whose data prerequisites cannot be met.

Trap 2: Escalate every disputed scenario to the Authorizing Official for a…

Escalation to the Authorizing Official is appropriate for risk acceptance decisions, not for routine assessor calibration. Using escalation for every disagreement would stall the assessment and does not build a repeatable method. It also leaves the ambiguous scale definitions in place, so the same inconsistency would recur on future assessments.

Trap 3: Average the two assessors' likelihood ratings for every scenario…

Averaging ordinal ratings is mathematically invalid because the categories are not equally spaced intervals. The mean of two categories may fall between defined levels, producing a rating that has no meaning in the scale. This masks the disagreement rather than resolving the underlying definitional ambiguity that caused the divergence.

A
Replace the qualitative matrix with a purely quantitative Annualized Loss Expectancy (ALE) calculation using industry-average exposure factors.
Why it fails: Switching to quantitative ALE does not resolve the root cause, which is inconsistent interpretation of likelihood. It also contradicts the stated constraint that reliable historical data is unavailable, so the ALE inputs would be speculative. The scenario requires improving the qualitative method's reliability, not abandoning it for a technique whose data prerequisites cannot be met.
B
Escalate every disputed scenario to the Authorizing Official for a final risk determination before the assessment can continue.
Why it fails: Escalation to the Authorizing Official is appropriate for risk acceptance decisions, not for routine assessor calibration. Using escalation for every disagreement would stall the assessment and does not build a repeatable method. It also leaves the ambiguous scale definitions in place, so the same inconsistency would recur on future assessments.
C
Define explicit ordinal scales with documented criteria and anchor examples for each likelihood and impact level, then calibrate assessors against them.
Documented ordinal scales with anchor examples give assessors a shared reference, reducing subjective drift. Calibration exercises further align judgments, so the same scenario maps to the same category. This preserves the qualitative approach while directly fixing the observed inconsistency, which is the specific problem described in the scenario.
D
Average the two assessors' likelihood ratings for every scenario and use the mean value as the final likelihood category.
Why it fails: Averaging ordinal ratings is mathematically invalid because the categories are not equally spaced intervals. The mean of two categories may fall between defined levels, producing a rating that has no meaning in the scale. This masks the disagreement rather than resolving the underlying definitional ambiguity that caused the divergence.

Question 9easymultiple choice

An ISSE is reviewing the security architecture of a system that uses a layered defense strategy. The system includes firewalls, intrusion detection systems, and host-based antivirus. The ISSE wants to ensure that the compromise of a single component does not lead to a total system breach. Which principle is the ISSE applying?

Trap 1: Fail-safe defaults

Fail-safe defaults dictate that access decisions should default to denial unless explicitly allowed. This principle is about default deny postures, not about layering multiple independent security controls. The scenario's emphasis on multiple layers protecting against single-component failure aligns with defense in depth.

Trap 2: Least privilege

Least privilege restricts user and process access rights to the minimum necessary. While important, it does not describe the layering of multiple diverse security mechanisms to prevent a single compromise from causing total failure. The scenario focuses on layered controls, not access minimization.

Trap 3: Separation of duties

Separation of duties divides critical functions among multiple individuals to prevent fraud or error. It is an administrative control, not a technical layering strategy. The scenario describes technical controls like firewalls and antivirus, which relate to defense in depth rather than separation of duties.

A
Fail-safe defaults
Why it fails: Fail-safe defaults dictate that access decisions should default to denial unless explicitly allowed. This principle is about default deny postures, not about layering multiple independent security controls. The scenario's emphasis on multiple layers protecting against single-component failure aligns with defense in depth.
B
Defense in depth
Defense in depth involves layering multiple security controls so that if one fails, others continue to protect the system. The scenario describes firewalls, IDS, and antivirus as independent layers, which is the essence of defense in depth, ensuring no single point of failure leads to a breach.
C
Least privilege
Why it fails: Least privilege restricts user and process access rights to the minimum necessary. While important, it does not describe the layering of multiple diverse security mechanisms to prevent a single compromise from causing total failure. The scenario focuses on layered controls, not access minimization.
D
Separation of duties
Why it fails: Separation of duties divides critical functions among multiple individuals to prevent fraud or error. It is an administrative control, not a technical layering strategy. The scenario describes technical controls like firewalls and antivirus, which relate to defense in depth rather than separation of duties.