Security — CPA ISC practice questions

Insurers underwriting cybersecurity insurance policies typically assess an applicant's:

1. Office furniture style and interior design preferences
2. Security controls maturity (e.g., MFA usage, patch management, backup practices, incident response planning) as part of determining coverage terms and premiums
3. Only the size of the applicant's marketing budget
4. Nothing related to actual security practices, relying solely on random chance

Answer: B — Security controls maturity (e.g., MFA usage, patch management, backup practices, incident response planning) as part of determining coverage terms and premiums

A) Office furniture/design has no bearing on cyber risk underwriting. B) Correct — insurers commonly assess an applicant's security control maturity (MFA adoption, patch cadence, backup and recovery practices, incident response readiness) as key underwriting inputs affecting coverage terms and premium pricing, since stronger controls generally correlate with lower expected losses. C) Marketing budget size is unrelated to an organization's actual cyber risk profile. D) Underwriting is a risk-based assessment process grounded in actual security practices, not left to random chance.

A comprehensive ISC synthesis scenario asks a candidate to evaluate an organization's overall resilience using vulnerability management maturity, backup/immutability practices, SOAR capability, threat modeling rigor, passwordless authentication adoption, and breach notification readiness together. The BEST approach is to:

1. Evaluate each area in isolation with no attempt to connect findings into an overall resilience assessment
2. Synthesize findings across all six areas — for example, recognizing that strong vulnerability management and passwordless authentication reduce the likelihood of compromise, SOAR and immutable backups improve response speed and recoverability if compromise nonetheless occurs, and breach notification readiness ensures legal obligations are met regardless of how well prevention worked
3. Focus only on whichever area is cheapest to assess and ignore the rest
4. Conclude the six areas are entirely unrelated and cannot inform one overall resilience assessment

Answer: B — Synthesize findings across all six areas — for example, recognizing that strong vulnerability management and passwordless authentication reduce the likelihood of compromise, SOAR and immutable backups improve response speed and recoverability if compromise nonetheless occurs, and breach notification readiness ensures legal obligations are met regardless of how well prevention worked

A) Isolated single-area review misses the exam's clear intent to test integrated judgment across prevention, detection/response, and legal/compliance readiness dimensions together. B) Correct — the ISC exam (and real-world resilience assessment) rewards synthesizing findings across the full spectrum: PREVENTION (vulnerability management, passwordless auth reducing compromise likelihood), RESPONSE/RECOVERY (SOAR speed, immutable backup recoverability), and LEGAL READINESS (breach notification preparedness), recognizing that genuine organizational resilience requires strength across all these complementary layers. C) Focusing only on the cheapest-to-assess area while ignoring the others risks missing the organization's actual most pressing resilience gap. D) These six areas are interconnected across the full incident lifecycle (before, during, and after a potential compromise), and a well-reasoned synthesis integrating all of them is both possible and expected.

The main security risk of failing to deprovision terminated employees is that:

1. Payroll may continue paying the former employee's paycheck indefinitely each cycle
2. The employee's workstation may consume power on the corporate network overnight
3. Help-desk ticket volume rises as former employees call in for password resets
4. Retained credentials allow unauthorized access, insider threats, and audit findings

Answer: D — Retained credentials allow unauthorized access, insider threats, and audit findings

A) That is a payroll issue, not the primary security risk. D) Correct — orphaned accounts enable unauthorized access and are audit findings. C) That is a help-desk workload issue, not a security risk. B) That is a facilities issue, not security.

A primary use case for asymmetric encryption is:

1. Bulk encryption of terabyte-scale databases at rest for high throughput
2. Producing a fixed-length one-way digest for password storage integrity
3. Securely exchanging a symmetric session key between two parties online
4. Compressing large media files to reduce storage costs across the fleet

Answer: C — Securely exchanging a symmetric session key between two parties online

A) Asymmetric is too slow for bulk encryption — symmetric is used instead. C) Correct — asymmetric is used for key exchange and digital signatures. B) That is hashing, not asymmetric encryption. D) That is compression, not encryption.

An organization encrypts all data transmitted over its network using TLS but stores sensitive customer records in its database without encryption. A risk assessment of this configuration should conclude that:

1. The organization has fully mitigated data confidentiality risk since data is encrypted at some point in its lifecycle
2. A meaningful residual risk remains: encryption in transit protects data from network interception, but the UNENCRYPTED data at rest remains exposed to unauthorized access via compromised storage systems, database breaches, or improper physical/logical access to the database itself
3. Encryption in transit is unnecessary once data reaches storage, making the missing at-rest encryption immaterial
4. TLS encryption in transit automatically also encrypts the same data at rest without any additional configuration

Answer: B — A meaningful residual risk remains: encryption in transit protects data from network interception, but the UNENCRYPTED data at rest remains exposed to unauthorized access via compromised storage systems, database breaches, or improper physical/logical access to the database itself

A) Incorrect — protecting data only during transmission leaves the storage layer as a real, distinct attack surface; full lifecycle protection requires addressing both transit AND rest. B) Correct — encryption in transit (TLS) and encryption at rest address genuinely different threat vectors (network interception vs. unauthorized access to stored data), so the absence of at-rest encryption represents a real, meaningful residual risk to the confidentiality of the stored sensitive records, independent of the transit protection already in place. C) Incorrect — this backwards reasoning ignores that storage-layer threats (database compromise, insider access, stolen backup media) are just as real as network-layer threats. D) Incorrect — TLS is strictly a transit-layer protocol; it has no effect on how data is protected once it is written to persistent storage, which requires its own separate encryption-at-rest implementation.

Envelope encryption, a technique often used alongside a KMS, involves:

1. Encrypting a data encryption key (DEK) itself with a separate key encryption key (KEK) managed by the KMS, so the DEK can be safely stored alongside the encrypted data without exposing it in plaintext
2. Physically mailing an encrypted USB drive to the recipient
3. Using no encryption keys at all, relying solely on physical security
4. A method exclusively for encrypting paper documents, not digital data

Answer: A — Encrypting a data encryption key (DEK) itself with a separate key encryption key (KEK) managed by the KMS, so the DEK can be safely stored alongside the encrypted data without exposing it in plaintext

A) Correct — envelope encryption encrypts the data encryption key (DEK) with a key encryption key (KEK) held/managed by the KMS, allowing the encrypted DEK to be stored safely alongside the encrypted data while the KEK itself remains centrally protected, an efficient and common cloud KMS pattern. B) Physical mailing of hardware has nothing to do with the envelope encryption technique. C) Envelope encryption is fundamentally a cryptographic key-layering technique, not an absence of encryption relying on physical security alone. D) Envelope encryption is a digital cryptographic technique applied to electronic data, not a method for paper documents.

Reflecting on the full breadth of ISC content covered across this catalog's Parts 18-23 (ISO 27001/COBIT, privacy engineering, AI/ML governance, cloud/network/application security, identity governance, forensics, IoT/OT, BCP/DR, SDLC, encryption key management, API security, MDM, physical security, privacy regulation, cross-border transfer, threat actors, supply chain, blockchain, cloud IAM, vulnerability management, backup strategy, SOAR, threat modeling, passwordless authentication, and breach notification), a candidate should recognize that:

1. The ISC exam tests an unusually narrow slice of technology risk topics with little real-world breadth
2. The ISC Discipline exam reflects the genuinely broad, cross-disciplinary nature of modern information systems and controls work, spanning governance, technical security architecture, data privacy/protection, emerging technology, and assurance/audit-adjacent skills together
3. Only governance frameworks like COBIT are ever tested, with no technical security content
4. These topics have no practical relationship to the CPA profession's evolving scope of practice

Answer: B — The ISC Discipline exam reflects the genuinely broad, cross-disciplinary nature of modern information systems and controls work, spanning governance, technical security architecture, data privacy/protection, emerging technology, and assurance/audit-adjacent skills together

A) Correct — the breadth of topics covered across these Parts is intentionally extensive rather than narrow, mirroring the genuinely wide scope of modern IT/security risk work; option A understates that breadth. B) Correct — this reflects that the ISC Discipline captures the true cross-disciplinary breadth of modern information systems and controls practice: governance frameworks, technical security architecture, data privacy and protection law, emerging technologies, and assurance-adjacent skills (SOC engagements, audit sampling) all together, mirroring how CPAs increasingly engage with technology risk in practice. C) Substantial TECHNICAL security content (network, application, cloud, identity, cryptography, threat modeling) is tested extensively alongside governance frameworks, not to the exclusion of technical topics. D) These topics directly reflect the CPA profession's genuinely expanding scope of practice into technology risk, assurance, and advisory services, which is precisely why the CPA Evolution initiative created the ISC Discipline in the first place.

An organization's threat model (using STRIDE) for a new system identifies a significant 'repudiation' risk — the concern that a user could deny having performed a sensitive action. Combined with audit trail integrity concepts, an appropriate mitigation would be:

1. Implementing robust, tamper-resistant logging (e.g., with WORM/immutable storage) that reliably records which authenticated user performed the sensitive action and when, providing non-repudiation evidence
2. Removing all logging entirely to simplify the system architecture
3. Allowing users to log in anonymously with no identity verification
4. Ignoring the repudiation risk since STRIDE findings require no follow-up action

Answer: A — Implementing robust, tamper-resistant logging (e.g., with WORM/immutable storage) that reliably records which authenticated user performed the sensitive action and when, providing non-repudiation evidence

A) Correct — addressing a repudiation risk directly calls for robust, tamper-resistant audit logging (potentially leveraging immutable/WORM storage) that reliably attributes sensitive actions to authenticated users, providing non-repudiation evidence that counters a user's ability to credibly deny having performed the action. B) Removing logging entirely would make the repudiation risk WORSE, not better, since there would be no record to counter a denial claim. C) Anonymous login with no identity verification would exacerbate, not mitigate, a repudiation risk, since there'd be no reliable way to attribute actions to a specific accountable user. D) STRIDE-identified risks are meant to inform concrete mitigation decisions, not be dismissed without follow-up action.

Static Application Security Testing (SAST) differs from Dynamic Application Security Testing (DAST) in that SAST:

1. Analyzes running application behavior in a live production environment
2. Analyzes source code, bytecode, or binaries without executing the application, typically earlier in the development pipeline
3. Can only be performed after the application has been fully deployed to end users
4. Is identical in methodology to penetration testing performed by external red teams

Answer: B — Analyzes source code, bytecode, or binaries without executing the application, typically earlier in the development pipeline

A) Analyzing a running application in a live environment describes DAST, not SAST. B) Correct — SAST examines code, bytecode, or binaries statically (without execution), typically integrated earlier in the pipeline (shifting left), identifying potential vulnerabilities before runtime. C) SAST can be run early, well before deployment, unlike this option's claim. D) SAST and external penetration testing are distinct methodologies — SAST is typically automated static code analysis, not manual external red-team testing.

OAuth 2.0, commonly used for API authorization, primarily allows:

1. A user to grant a third-party application limited access to their resources on another service, without sharing their actual password with that third-party application
2. An application to directly view and store a user's plaintext password for that user's convenience
3. The complete elimination of any need for access tokens
4. Physical door access control for a corporate office

Answer: A — A user to grant a third-party application limited access to their resources on another service, without sharing their actual password with that third-party application

A) Correct — OAuth 2.0 enables delegated authorization, letting a user grant a third-party application scoped access to specific resources (e.g., a calendar or contact list) via tokens, without ever exposing the user's actual account password to that third-party app. B) OAuth is specifically designed to AVOID third-party applications ever handling the user's actual password, the opposite of this option. C) OAuth's core mechanism relies on issuing and validating access tokens; it doesn't eliminate the need for them. D) OAuth is an authorization framework for digital/API access, unrelated to physical office door access control.

AAA in security?

Authentication (who you are), Authorization (what you can do), Accounting/Auditing (logging what you did).

What do insurers assess when underwriting cyber policies?

Security controls maturity — MFA usage, patch management, backup practices, incident response planning.

Why can't standard IT patch management tools always manage OT systems directly?

OT systems often require specialized patch approaches given uptime, safety, and legacy-protocol constraints distinct from standard IT.

Phishing?

Fraudulent communication tricking user into revealing credentials or installing malware. Spear-phishing: targeted to specific person.