ISSEP Practice Questions

The Cyber Security Bulletin, a product of the National Cyber Awareness System (NCAS) from the Cybersecurity and Infrastructure Security Agency (CISA), is specifically designed as a weekly summary. It consolidates information on new vulnerabilities from the preceding week for a technical audience. The content includes potential impacts, available patches, workarounds, and recommended mitigation actions, which directly matches the description provided in the question. This contrasts with Alerts, which are for immediate threats, and Tips, which are for non-technical users.

A. Cyber Security Tip: These are intended for a general, non-technical audience, providing simple, actionable advice on common security practices, not detailed vulnerability summaries.

B. Cyber Security Alert: These are released in response to current, high-impact security issues, vulnerabilities, or exploits that require immediate attention, not as a scheduled weekly summary.

D. Technical Cyber Security Alert: This is not a standard publication category from CISA/US-CERT. The official designation is "Alert," which is event-driven rather than a periodic summary.

---

1. Cybersecurity and Infrastructure Security Agency (CISA). "National Cyber Awareness System." CISA.gov. This official page defines the different publication types. It states

"Bulletins provide weekly summaries of new vulnerabilities. Each bulletin contains a list of the new vulnerabilities

their potential impact

and information about patches and workarounds."

Reference: cisa.gov/uscert/ncas (Accessed under the descriptions for Alerts

Bulletins

and Tips).

2. National Institute of Standards and Technology (NIST). (2012). NIST Special Publication 800-61 Revision 2: Computer Security Incident Handling Guide. U.S. Department of Commerce.

Reference: Page 2-8

Section 2.4.3

"Coordinating Centers." This section describes the role of US-CERT (now integrated into CISA) and its various information products

including the distinct purposes of alerts

bulletins

and tips for information dissemination within the cybersecurity community. (DOI: https://doi.org/10.6028/NIST.SP.800-61r2)

DoD Directive (DoDD) 8500.1, "Information Assurance (IA)," is the foundational policy document that establishes the DoD's overarching strategy for IA. The purpose statement within this directive explicitly states that it "Establishes policy and assigns responsibilities...to achieve information assurance (IA) through a defense-in-depth approach that integrates the capabilities of personnel, operations, and technology, and supports the evolution to network centric warfare." This wording directly matches the description provided in the question, identifying it as the correct high-level policy document. While this directive has been superseded, it remains a key historical document within the ISSEP body of knowledge.

A. DoD 8500.2 Information Assurance Implementation: This is an instruction that provides specific procedures and controls for implementing the high-level policy established in DoDD 8500.1, not the policy itself.

B. DoD 8510.1-M DITSCAP: This was the application manual for the DoD Information Technology Security Certification and Accreditation Process (DITSCAP), detailing a specific process, not the overarching IA policy.

C. DoDI 5200.40: This instruction formally established the DITSCAP framework. It is focused specifically on the Certification and Accreditation (C&A) process, which is only one component of the broader IA program.

1. U.S. Department of Defense. (2002

October 24). DoD Directive 8500.1: Information Assurance (IA). Washington

D.C.: DoD Chief Information Officer. Section 2

"PURPOSE

" states the directive's goal is to "achieve information assurance (IA) through a defense-in-depth approach that integrates the capabilities of personnel

operations

and technology

and supports the evolution to network centric warfare."

2. U.S. Department of Defense. (2003

February 6). DoD Instruction 8500.2: Information Assurance (IA) Implementation. Washington

D.C.: DoD Chief Information Officer. Section 2

"PURPOSE

" clarifies that the instruction "implements policy

assigns responsibilities

and prescribes procedures...under DoDD 8500.1."

3. Wilson

I. D. (2005). A Comparative Analysis of the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) and the National Information Assurance Certification and Accreditation Process (NIACAP) (Master's thesis

Naval Postgraduate School). Chapter II

Section B

"DoD IA Policy

" pp. 9-11. This thesis describes the hierarchy of DoD IA policy

identifying DoDD 8500.1 as the primary policy document and DITSCAP (established by DoDI 5200.40) as the C&A process used to enforce it. (Available via NPS Calhoun institutional repository).

4. U.S. Department of Defense. (1997

December 30). DoD Instruction 5200.40: DoD Information Technology Security Certification and Accreditation Process (DITSCAP). Washington

D.C.: Assistant Secretary of Defense. This document's purpose is to establish the C&A process

not the entire IA policy framework.

The NIST SP 800-37 Certification and Accreditation (C&A) methodology is structured into four phases. The Initiation Phase is the first phase, where the groundwork for the C&A process is established. A fundamental task within this phase is the security categorization of the information system. This is performed in accordance with FIPS 199, which involves determining the potential impact (low, moderate, or high) on organizational operations and assets should the confidentiality, integrity, or availability of the information be compromised. This categorization is a critical first step as it directly influences the selection of the appropriate security control baseline for the system in subsequent phases.

A. Continuous Monitoring: This is the final phase, which involves ongoing monitoring of security controls after the system has been accredited, not the initial categorization.

C. Security Certification: This phase involves the assessment of security controls that were selected based on the security categorization determined during the Initiation phase.

D. Security Accreditation: This is the official management decision to authorize system operation, which occurs after the certification activities are complete and risk is evaluated.

1. National Institute of Standards and Technology (NIST). (May 2004). Special Publication 800-37

Guide for the Security Certification and Accreditation of Federal Information Systems. Section 3.1

"Phase 1: Initiation Phase

" Task 1-2 Security Categorization

p. 16. "The security categorization for the information system is determined in accordance with FIPS 199."

2. National Institute of Standards and Technology (NIST). (February 2004). Federal Information Processing Standards Publication 199 (FIPS PUB 199)

Standards for Security Categorization of Federal Information and Information Systems. Section 3

"Security Categorization

" p. 3. This document defines the process of categorization that is executed during the Initiation phase of the C&A process.

3. Ross

R.

Katzke

S.

Johnson

A.

Swanson

M.

& Stoneburner

G. (April 2010). NIST Special Publication 800-37

Revision 1

Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach. Figure 2-1

"The Risk Management Framework

" p. 11. While this is a later revision

it clearly shows "Categorize Information System" as the first step in the RMF

which evolved from the C&A process's Initiation phase.

These three U.S. federal laws form a foundational legal framework for prosecuting hacking and related cybercrimes.

18 U.S.C. § 1030, the Computer Fraud and Abuse Act (CFAA), is the primary U.S. anti-hacking statute, directly criminalizing unauthorized access to computer systems.

18 U.S.C. § 1029 targets fraud involving "access devices," which include passwords, account numbers, and other credentials frequently stolen or used during hacking activities to gain illicit access.

18 U.S.C. § 2510 provides the definitions for the Wiretap Act, which makes it illegal to intercept electronic communications without authorization. This directly relates to hacking techniques like network sniffing and man-in-the-middle attacks.

D. 18 U.S.C. 1028: This statute primarily addresses fraud involving identification documents (e.g., passports, driver's licenses) and is less directly related to the technical act of unauthorized computer access than the other options.

1. United States Department of Justice. (2015). Prosecuting Computer Crimes. Office of Legal Education Executive Office for United States Attorneys.

Chapter 1: 18 U.S.C. § 1030 - The Computer Fraud and Abuse Act (p. 3) explicitly identifies this as the main statute for prosecuting hacking cases.

Chapter 2: 18 U.S.C. § 1029 - Access Device Fraud (p. 69) details how this statute is used to prosecute crimes involving stolen credit card numbers

telecommunications access codes

and computer passwords obtained through hacking.

Chapter 3: The Wiretap Act (p. 93) explains that the act

defined in part by § 2510

applies to the interception of electronic data communications

a common element of sophisticated hacking.

2. United States Code. (2023). Title 18 - Crimes and Criminal Procedure. Office of the Law Revision Counsel

U.S. House of Representatives.

18 U.S.C. § 1030: "Fraud and related activity in connection with computers."

18 U.S.C. § 1029: "Fraud and related activity in connection with access devices."

18 U.S.C. § 2510: "Definitions" for chapter 119

which governs the interception of communications.

3. Kerr

O. S. (2003). Cybercrime's Scope: Interpreting "Access" and "Authorization" in Computer Misuse Statutes. New York University Law Review

78(5)

1596-1668. This academic article provides a detailed legal analysis of the CFAA (18 U.S.C. § 1030) and its central role in defining the legality of computer access

which is the core of hacking. It frequently contrasts the CFAA with related statutes like the Wiretap Act.

The Information Assurance Technical Framework (IATF) is a model developed by the U.S. National Security Agency (NSA) that applies systems engineering principles to information assurance. Three core principles of this model are the distinct definitions and separation of the "problem space" and the "solution space." The problem space is explicitly defined by the customer's mission or business requirements. The solution space, which is driven by and must address the problem space, is where engineers define the technical system. A foundational tenet of the IATF methodology is to maintain a strict separation between these two spaces to prevent developing solutions that do not align with actual mission needs.

A. This statement defines the goal or measure of security effectiveness (assurance), not a foundational methodological principle of the IATF model itself.

1. National Security Agency (NSA). (2002). Information Assurance Technical Framework (IATF) Release 3.1.

Section 2.2

"A Problem-Solving Approach

" Page 2-2: "The problem space is defined by the customer’s mission or business needs... The solution space is defined by the systems engineer and the information systems security engineer... It is important to keep the problem and solution spaces separate." This single section directly supports the correctness of options B

C

and D.

2. Ross

R.

McEvilley

M.

& Oren

J. (2016). NIST Special Publication (SP) 800-160

Volume 1: Systems Security Engineering. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-160v1

Appendix F.2.1

"Problem and Solution Space

" Page F-3: "The problem space is defined by the stakeholders’ needs

wants

and desires... The solution space is defined by the set of one or more system solutions that can satisfy the problem space." This NIST publication

which builds upon foundational concepts like the IATF

reinforces the principles outlined in options B and C.

3. Naval Postgraduate School. (2013). Systems Engineering Fundamentals. Defense Acquisition University Press.

Chapter 2

"The Systems Engineering Process

" Page 14: "The systems engineering process begins in the 'problem space'... Once the problem is fully characterized

the process moves to the 'solution space' to translate the 'what' into the 'how'." This university-level text on systems engineering confirms the fundamental separation and definition of problem and solution spaces

a core concept adopted by the IATF.

The Trusted Computer System Evaluation Criteria (TCSEC), often called the "Orange Book," is a U.S. Department of Defense (DoD) standard published in 1983. Its primary purpose was to provide a framework for evaluating the effectiveness of security controls built into computer systems. It established a series of hierarchical security classifications (e.g., D, C1, C2, B1, B2, B3, A1) based on the system's ability to enforce a security policy, provide assurance, and implement specific security features. TCSEC was the foundational standard for assessing and rating the trust and security level of computer operating systems.

A. SSAA: A System Security Authorization Agreement (SSAA) is a procedural document used in the U.S. government's former C&A process, not a standard for evaluating technical controls.

C. FIPS: Federal Information Processing Standards (FIPS) are a series of diverse standards for U.S. non-military government agencies. It is a family of standards, not a single standard for this specific purpose.

D. FITSAF: The Federal Information Technology Security Assessment Framework (FITSAF) was a high-level framework for agencies to assess risk, not a standard for evaluating the effectiveness of built-in system controls.

1. National Institute of Standards and Technology (NIST). (n.d.). Trusted Computer System Evaluation Criteria (TCSEC). In Glossary. Computer Security Resource Center (CSRC). Retrieved from https://csrc.nist.gov/glossary/term/tcsec. The glossary entry states

"A U.S. Government Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system."

2. Department of Defense. (1985

December 26). DoD 5200.28-STD: Trusted Computer System Evaluation Criteria. National Computer Security Center. This is the original standard document. The abstract states its purpose is to provide "a basis for the evaluation of effectiveness of security controls built into automatic data processing system products."

3. Anderson

R. J. (2008). Security Engineering: A Guide to Building Dependable Distributed Systems (2nd ed.). Wiley. Chapter 24

"Evaluation and Certification

" discusses the history of evaluation criteria

starting with TCSEC (p. 825)

describing it as the first comprehensive attempt to provide criteria for designing and evaluating secure systems.

4. Evans

D. (2011). CS 6501: Trustworthy Computing - Lecture 3: The Orange Book. University of Virginia

Department of Computer Science. Course materials describe TCSEC as the "first standard for computer security" and detail its evaluation classes for assessing security controls.

The Baldrige National Quality Program, managed by the National Institute of Standards and Technology (NIST), is a public-private partnership dedicated to improving the performance and competitiveness of U.S. organizations. It establishes the Baldrige Performance Excellence Framework, a set of criteria used to evaluate organizational performance across six categories: manufacturing, service, small business, education, health care, and nonprofit. The program's primary goal is to recognize and promote performance excellence, making it the correct answer that aligns with all aspects of the question.

A. Manufacturing Extension Partnership: This NIST program focuses specifically on providing technical and business assistance to small and medium-sized U.S. manufacturers, not the broader sectors mentioned.

C. Advanced Technology Program: This was a former NIST program that provided cost-sharing grants for high-risk, high-payoff technology research and development, not a broad performance excellence initiative.

D. NIST Laboratories: These are the core research and measurement facilities within NIST; they are an organizational component, not a specific cooperative program for awarding performance excellence.

1. National Institute of Standards and Technology (NIST). (n.d.). About the Baldrige Performance Excellence Program. NIST.gov. Retrieved from https://www.nist.gov/baldrige/about-baldrige. (This page explicitly states the program's purpose and lists the six eligibility categories

including manufacturing

service

education

and healthcare.)

2. National Institute of Standards and Technology (NIST). (n.d.). About the Hollings Manufacturing Extension Partnership (MEP). NIST.gov. Retrieved from https://www.nist.gov/mep/about-nist-mep. (This source defines the MEP's mission as serving "small and medium-sized manufacturers.")

3. National Institute of Standards and Technology (NIST). (2014). Advanced Technology Program (ATP) General Information. NIST.gov. Retrieved from https://www.nist.gov/advanced-technology-program. (This official page describes the ATP's focus on co-funding R&D partnerships

distinguishing it from the Baldrige program's mission.)

4. Slaper

T. F. (2011). The Triple Bottom Line and the Baldrige Framework. Indiana Business Review

86(2)

10-12. Indiana University Kelley School of Business. Retrieved from https://www.ibrc.indiana.edu/ibr/2011/summer/article3.html. (This university publication discusses the Baldrige Framework's application in promoting excellence across various sectors.)

The National Information Assurance Certification and Accreditation Process (NIACAP) was established to provide a minimum standard framework for certifying and accrediting the security of national security systems across the U.S. government. It defined a standard set of activities, general tasks, and a management structure to ensure systems maintained a consistent information assurance (IA) posture. NIACAP's purpose was to create a common foundation for the C&A process, promoting reciprocity and a uniform approach to managing risk for systems that store, process, or communicate sensitive information.

A. ASSET (Automated Security Self-Evaluation Tool) was a software tool used for self-assessment against security policies, not a comprehensive C&A management process.

B. NSA-IAM (National Security Agency Information Assurance Methodology) is a methodology for evaluating the IA posture of a network, not a complete C&A process with a defined management structure.

D. DITSCAP (DoD Information Technology Security Certification and Accreditation Process) was a C&A process specific to the Department of Defense, whereas NIACAP was the broader standard for all national security systems.

---

1. National Security Telecommunications and Information Systems Security Committee. (2000). National Information Assurance Certification and Accreditation Process (NIACAP) (NSTISSI No. 1000). The abstract and Section 3

"Policy

" state that the instruction establishes a standard national process for C&A

defining its activities and structure.

2. National Institute of Standards and Technology. (2014). Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (NIST Special Publication 800-37

Revision 1). Appendix G

page G-1

describes the historical evolution from legacy C&A processes

explicitly identifying NIACAP as the "National Information Assurance Certification and Accreditation Process."

3. Ross

R.

et al. (2008). Security Assessment and Authorization for U.S. Information Systems. IEEE Security & Privacy

6(3)

17-19. https://doi.org/10.1109/MSP.2008.73. The article discusses the evolution of C&A processes

mentioning NIACAP as a key predecessor to the unified Risk Management Framework (RMF).

The National Information Assurance Certification and Accreditation Process (NIACAP) defined four distinct levels of effort for the certification analysis phase. These levels allowed the certifier to recommend a degree of rigor appropriate to the system's mission criticality and operational environment. The levels, in increasing order of intensity, are: Minimum Analysis, Basic Security Review, Detailed Analysis, and Comprehensive Analysis. Each level builds upon the previous one, requiring progressively more in-depth examination of the system's security posture, documentation, and implementation. These options represent the complete and official set of NIACAP certification analysis levels.

A. Basic System Review: This is incorrect. The official NIACAP term is "Basic Security Review," which has a specific focus on security controls rather than a general system overview.

C. Maximum Analysis: This is not an official NIACAP term. The highest and most rigorous level of effort defined within the NIACAP framework is "Comprehensive Analysis."

1. National Security Telecommunications and Information Systems Security Committee (NSTISSC). (2000

October). National Information Assurance Certification and Accreditation Process (NIACAP). NSTISSP No. 11. Appendix C

"Certification Levels of Effort

" pages C-1 through C-4

explicitly defines and details the four levels: Minimum Analysis

Basic Security Review

Detailed Analysis

and Comprehensive Analysis.

2. Wilson

M.

& Hash

J. (2003). Building an Information Technology Security Awareness and Training Program. National Institute of Standards and Technology (NIST) Special Publication 800-50. Page 57 (Appendix F) references the NIACAP process and its role in federal C&A prior to the establishment of newer frameworks.

3. University of Idaho

Department of Computer Science. (n.d.). CS 442/542: Computer Security - Lecture 25: Security Planning. Slide 16

"NIACAP (cont.)

" lists the four levels of certification effort: Minimum Analysis

Basic Security Review

Detailed Analysis

and Comprehensive Analysis. Retrieved from https://www.webpages.uidaho.edu/jff/classes/CS442/CS442L25SecurityPlanning.pdf.

Phase 4 of the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP), "Maintain Authorization to Operate and Conduct Reviews," is where residual risk is analyzed on an ongoing basis. This phase encompasses continuous monitoring of the information system's security controls and posture throughout its lifecycle. Activities include performing annual reviews, assessing the impact of system changes, and responding to new threats or vulnerabilities. Each of these activities requires a re-analysis of the residual risk to ensure it remains at an acceptable level as determined by the Authorizing Official (AO), thereby maintaining the system's security authorization.

A. Phase 2: This phase focuses on implementing and validating controls. It generates the data for the residual risk calculation, but the primary analysis occurs later.

B. Phase 3: This phase involves the Authorizing Official's final review of the certification package and the documented residual risk to make an accreditation decision, not the ongoing analysis.

C. Phase 5: This phase concerns the secure shutdown and disposal of a system; risk analysis here focuses on data remanence and media sanitization, not operational risk.

D. Phase 1: This phase involves the initial planning and high-level risk assessment to scope the effort, not the detailed analysis of residual risk after controls are implemented.

1. Department of Defense Instruction (DoDI) 8510.01

"Information Assurance (IA) Certification and Accreditation (C&A) Process (DIACAP)" (November 28

2007). Enclosure 4

Section E4.4

"Phase 4 - Maintain Authorization to Operate and Conduct Reviews

" states: "The system IA posture shall be reassessed to determine if the risk is still acceptable... The review shall include... an updated risk assessment of the system." This explicitly places ongoing risk assessment and analysis in Phase 4.

2. O'Neal

M. S. (2009). A Systems Engineering Approach to the Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) [Master's thesis

Naval Postgraduate School]. In Chapter IV

Section D

"Phase 4: Maintain Authorization to Operate and Conduct Reviews

" the author states

"Phase 4 is the continuous monitoring of the system’s security posture... This requires periodic risk assessments to re-evaluate the system’s security posture and determine if the residual risk is still acceptable." (p. 41).

3. NIST Special Publication 800-37

Revision 2

Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy (December 2018). While describing the RMF which superseded DIACAP

its principles are foundational. Step 6

"Monitor

" which directly maps to DIACAP Phase 4

is defined by "maintaining ongoing situational awareness of the security and privacy posture of the system... to determine if the risk... remains acceptable." (Section 2.8

p. 21). This reinforces the concept of continuous risk analysis in the maintenance phase.