Systems Security Engineering Foundations

When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

What is the primary benefit of modularity in secure systems design?

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

Which of the following is an example of an 'Administrative' security control?

What is the primary function of an 'API Gateway' in a microservices security architecture?

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

What is the primary objective of a 'Security Design Review' early in the lifecycle?

When designing a system for 'Non-repudiation', which technical control is essential?

Which THREE of the following are valid 'Authentication' factors?

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

What is the primary risk of a 'Privileged User' who lacks proper oversight?

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

When engineering a 'Secure Boot' sequence, what is the primary security objective?

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

What is the primary advantage of 'Defense in Depth'?

An ISSE is reviewing a system architecture where the design team plans to mitigate a spoofing threat to an external interface by adding a digital signature to each message. During the design review, the ISSE notes that the signing key is stored in plaintext in the same configuration file as the application. Which security engineering principle is most directly violated by this design decision?

An ISSE is defining the protection profile for a new multi-level secure system that must enforce the Bell-LaPadula model. The design team asks which rules must be enforced to prevent unauthorized disclosure of classified information. (Choose two.)

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

An ISSE is developing a security architecture for a new payroll processing system that handles PII and financial data. The system will be deployed on a private cloud and must comply with NIST SP 800-53 controls. The ISSE needs to ensure that the system's security requirements are traceable from initial stakeholder needs through design, implementation, and testing. Which systems security engineering activity best supports this traceability?

An ISSE is defining the boundary of a system under development and must document which components are inside the trusted computing base (TCB) versus outside it. The system includes a commercial hypervisor, guest virtual machines, a management console, and a hardware security module (HSM). Which criterion most directly determines whether a component belongs inside the TCB?

During a security architecture review, the ISSE must evaluate the system's ability to enforce the *-property (no write down) as defined in the Bell-LaPadula model. The system currently allows a process at the Secret level to write to an object at the Unclassified level. Which design change should the ISSE recommend to satisfy the *-property?

A systems security engineer is selecting controls for a new federal information system and must ensure the design meets the minimum security requirements defined in NIST SP 800-53. Which concept describes the set of controls determined to be necessary to protect the system based on its security categorization?

An ISSE is leading the initial security architecture for a new Department of Defense (DoD) command-and-control system. The program manager asks how the ISSE plans to address the risk of a single component failure cascading to a mission-critical function. Which engineering principle should the ISSE apply to reduce the likelihood that one component's failure causes a total loss of the security function?

During early requirements definition for a new mission system, stakeholders agree that the system must remain effective even if several individual components are compromised. The ISSE must select a design principle that best supports this objective while keeping the architecture affordable. Which principle should be applied?

An ISSE is leading the security design for a system that will process Controlled Unclassified Information (CUI). The system must comply with NIST SP 800-171. The ISSE needs to ensure that the design includes mechanisms to protect the confidentiality of CUI at rest and in transit. Which set of controls from SP 800-171 should the ISSE prioritize?

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

During a security architecture review, an ISSE observes that the design separates the trusted computing base into distinct, isolated modules with explicit interfaces, and that no module can access another's internal data structures directly. Which design principle is primarily being applied to limit the propagation of a compromise?

An ISSE is evaluating a commercial off-the-shelf (COTS) product for use in a system that processes classified information. The vendor claims the product is 'secure by design' but provides no formal evaluation. The ISSE must determine the level of assurance that can be placed in the product's security features. Which factor is most critical in assessing the product's assurance level?

An ISSE is reviewing a proposed architecture for a cross-domain transfer system. The design uses a reference monitor concept to mediate all access between security domains. During review, the ISSE must confirm the design satisfies the properties required of a reference monitor implementation. Which set of properties should the ISSE verify?

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

An ISSE is reviewing a system architecture that uses a trusted path for security-critical operations. The developer proposes implementing the trusted path as a software-only mechanism within the general-purpose operating system. Which characteristic of a trusted path is most important for the ISSE to verify in this design?

A systems security engineer is conducting a design review for a new web application that will handle sensitive customer data. The architecture includes a web server, application server, and database server. The engineer notices that the application server directly connects to the database using a hard-coded administrative account with full privileges. Which security principle is most directly violated by this design?

An ISSE is reviewing the security architecture of a system that uses a layered defense strategy. The system includes firewalls, intrusion detection systems, and host-based antivirus. The ISSE wants to ensure that the compromise of a single component does not lead to a total system breach. Which principle is the ISSE applying?

An ISSE is drafting the security architecture description for a system that will undergo an assessment against the ISO/IEC 21827 (SSE-CMM) process areas. The assessor asks which work products demonstrate that the risk process area is being performed. Which TWO work products best provide that evidence? (Choose two.)

An ISSE is evaluating a proposed change to an accredited system that will introduce a new external interface. The change is classified as significant. According to the Risk Management Framework (RMF) process, which activity must the ISSE perform before the change can be approved?

An ISSE is defining the security requirements for a new system that will be developed using a systems security engineering approach. The ISSE must ensure that the requirements address the system's ability to protect against, detect, and respond to security incidents. Which TWO activities should the ISSE perform to derive these requirements? (Choose two.)

An ISSE is tasked with evaluating the security architecture of a new system that will process top secret information. The system will use a combination of commercial and government-off-the-shelf components. The ISSE must ensure that the architecture supports the required security objectives. Which two security architecture principles are most critical to address when integrating COTS and GOTS components into a high-assurance system? (Choose two.)

An ISSE is defining the trustworthiness requirements for a new high-assurance system that will process classified information. The program manager asks which security engineering principles should be explicitly applied to the system architecture to ensure it can enforce its security policy under attack. (Choose two.)

A systems security engineer is performing a functional decomposition of a new command-and-control system. The chief engineer insists that every allocated security control be traceable back to an approved stakeholder requirement before the preliminary design review. Which artifact should the ISSE produce to satisfy this demand?

An ISSE is helping a program office plan a certification and accreditation effort for a system that will process controlled unclassified information. The program director wants to know how an assurance case differs from a traditional security test report. Which description best characterizes the purpose of an assurance case in this context?

An ISSE is evaluating a proposed architecture that uses a trusted computing base (TCB) to enforce security policy. The developer argues that because the TCB is small, it does not need to be evaluated against any protection profile. How should the ISSE respond?

An ISSE is developing a security architecture for a new system that must support multiple independent levels of security. The ISSE needs to ensure that the architecture enforces the principles of isolation and non-interference. Which two design techniques should the ISSE require? (Choose two.)

A program office is planning a new logistics system and the ISSE must determine which security engineering activities belong in the concept stage versus later stages. The chief engineer asks which activity should occur earliest, before any system requirements baseline is established. Which activity is most appropriate at that point?

An ISSE is reviewing a design that layers network segmentation, host-based firewalls, application input validation, and database encryption. A reviewer argues this duplication is wasteful and proposes collapsing to a single strong control. How should the ISSE justify the layered approach using established security engineering principles?

An ISSE is leading a design review of a new identity management subsystem that must support separation of duties for administrative functions. The review board asks which design characteristics directly enforce separation of duties within the subsystem. (Choose two.)