Systems Security Engineering Foundations

When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

Which engineering document should be created during the early stages of the system lifecycle to define the security-relevant mission goals and constraints?

What is the primary benefit of modularity in secure systems design?

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

In the context of the NIST Cybersecurity Framework, which function is specifically supported by the 'Systems Security Engineering' process during the 'Identify' stage?

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

Which THREE of the following are considered 'Common Criteria' (ISO/IEC 15408) elements for evaluating the security functionality of a product?

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

You are performing an audit of a new system's 'Trusted Computing Base' (TCB). Which observation would indicate a violation of the 'Separation of Duties' principle?

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

Which of the following is an example of an 'Administrative' security control?

When designing a system for 'High Integrity' (using the Biba model), which THREE rules must be enforced?

What is the primary function of an 'API Gateway' in a microservices security architecture?

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

What is the primary objective of a 'Security Design Review' early in the lifecycle?

When designing a system for 'Non-repudiation', which technical control is essential?

Which THREE of the following are valid 'Authentication' factors?

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

What is the primary risk of a 'Privileged User' who lacks proper oversight?

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

When engineering a 'Secure Boot' sequence, what is the primary security objective?

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

What is the primary advantage of 'Defense in Depth'?