ISC Systems Security Engineering Foundations — 40 Questions

Question 1

Which engineering document should be created during the early stages of the system lifecycle to define the security-relevant mission goals and constraints?

Answer

Patch Management Policy

Answer

System Security Plan (SSP)

Answer

Incident Response Plan

Answer

Vulnerability Assessment Report

Question 2

In the context of the NIST Cybersecurity Framework, which function is specifically supported by the 'Systems Security Engineering' process during the 'Identify' stage?

Accepted Answer

Risk Assessment (ID.RA). The NIST CSF is a framework of outcomes, not a process standard like NIST SP 800-160 (Systems Security Engineering). While Risk Assessment (ID.RA) is indeed a category within the Identify function, the justification provided in the explanation is conceptually flawed as it conflates engineering processes with framework functions.

Answer

Recovery Planning (RC.RP)

Answer

Access Control (PR.AC)

Answer

Detection Processes (DE.DP)

Question 3

Which THREE of the following are considered 'Common Criteria' (ISO/IEC 15408) elements for evaluating the security functionality of a product?

Accepted Answer

Protection Profile (PP). Common Criteria uses Protection Profiles and Security Targets to define and evaluate security requirements.

Answer

Sales and Marketing Specification

Answer

Employee Training Records

Question 4

You are performing an audit of a new system's 'Trusted Computing Base' (TCB). Which observation would indicate a violation of the 'Separation of Duties' principle?

Accepted Answer

The same person who requests a system access change also approves it. Separation of Duties ensures that no single individual has the authority to perform all steps of a critical security task.

Answer

The administrator configures the firewall rules

Answer

Two administrators are required for root access

Answer

The security team monitors logs

Question 5

When designing a system for 'High Integrity' (using the Biba model), which THREE rules must be enforced?

Accepted Answer

Simple Integrity Axiom (No Read Down). The three classical rules of the Biba integrity model are: 1. Simple Integrity Axiom (No Read Down), 2. Integrity Star (*) Axiom (No Write Up), and 3. Invocation Property. The current options list A, B, and D as correct, but the explanation only mentions two rules. Furthermore, options C and E are Bell-LaPadula rules. The JSON needs to validate the three Biba axioms correctly.

Answer

No Write Down

Answer

No Read Up

Question 6

An ISSE is performing requirements analysis for a new federal system. The system must be accredited under the RMF. The ISSE needs to ensure that security requirements are derived from the organization's mission and business needs, and that they are traceable throughout the lifecycle. Which document should the ISSE use as the primary source for control selection?

Accepted Answer

NIST SP 800-53 Revision 5 control catalog. The RMF Select step requires deriving security controls from the system's categorization and organizational risk management. NIST SP 800-53 Revision 5 is the authoritative catalog of controls, providing the specific control identifiers and enhancement details that ISSEs use to build the security requirements baseline. Using it ensures traceability from mission needs to implemented controls.

Answer

NIST SP 800-160 Volume 1 Systems Security Engineering

Answer

NIST SP 800-30 Revision 1 Guide for Conducting Risk Assessments

Answer

NIST SP 800-37 Revision 2 Risk Management Framework

Question 7

A security engineer is designing a system that must enforce the Bell-LaPadula model. The system processes data at multiple sensitivity levels and must prevent unauthorized disclosure. Which rule is fundamental to the Bell-LaPadula model?

Accepted Answer

No read up (simple security property).. The Bell-LaPadula model enforces confidentiality through two main rules: the simple security property (no read up) and the *-property (no write down). The simple security property prevents a subject from reading data at a higher classification level, directly addressing unauthorized disclosure. The other options either misattribute rules or belong to the Biba integrity model.

Answer

No read down (simple integrity property).

Answer

No write up (*-property).

Answer

No write down (simple security property).

Question 8

An ISSE is defining the security requirements for a new command-and-control system. The program manager wants to know how the ISSE will ensure that the system's security controls are correct and complete before the system is fielded. Which activity should the ISSE use to provide this assurance?

Accepted Answer

Perform a functional decomposition of the system to allocate security requirements to specific system components and interfaces.. Functional decomposition and requirements allocation are core systems security engineering activities that ensure security requirements are flowed down to components and interfaces, making the control set complete and consistent before design and implementation. Post-implementation assessments and documentation artifacts verify or describe controls but do not establish that the requirements themselves are correct and complete at the point where the program manager needs that assurance.

Answer

Develop a system security plan that documents the implemented controls and their configuration settings.

Answer

Conduct a vulnerability assessment of the system after it is deployed to identify any missing security controls.

Answer

Conduct a security control assessment to verify that the implemented controls meet the specified security requirements.

Question 9

An ISSE is participating in a design review for a new system. The lead engineer proposes using a reference monitor concept to enforce access control. Which design property must the reference monitor satisfy to be effective?

Accepted Answer

It must mediate every access between subjects and objects and be tamperproof.. The reference monitor abstraction requires that it mediate all accesses, be tamperproof, and be small enough to be verified. Mediating every access ensures no bypass, and tamperproofness ensures the policy cannot be altered by untrusted code. Logging and policy flexibility are useful but secondary to these core enforcement properties.

Answer

It must be able to enforce both discretionary and mandatory access control policies simultaneously.

Answer

It must be small enough to be thoroughly analyzed and tested.

Answer

It must log all access attempts to an immutable audit trail for later review.

Question 10

An ISSE is evaluating a proposed architecture for a multi-level secure system that must prevent any information flow from a Secret enclave to an Unclassified enclave, even through covert channels. The design team proposes a reference monitor concept. Which property must the reference monitor guarantee to satisfy this mandatory flow restriction?

Accepted Answer

It must mediate every access between subjects and objects and be tamperproof and verifiable. A reference monitor enforces mandatory access control by mediating every subject-object access, resisting modification, and being small enough to verify. Those properties are what guarantee the no-read-up and no-write-down rules that stop Secret information from reaching Unclassified objects, including via covert channels. Encryption, authentication, and auditing are supporting controls, but none of them enforce flow direction on every access, so they cannot satisfy the mandatory restriction.

Answer

It must log all access attempts to a write-once audit trail for later review

Answer

It must authenticate all users with multifactor credentials before granting any access

Answer

It must encrypt all data at rest using FIPS 140-3 validated modules

Question 11

When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?

Accepted Answer

Applying security controls at multiple architectural layers. Defense in depth relies on layering security controls so that a single failure does not result in a total system compromise.

Answer

Relying solely on perimeter authentication

Answer

Maximizing system throughput by minimizing encryption

Answer

Implementing a single high-availability firewall

Question 12

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

Accepted Answer

Requirements Analysis. In the Systems Engineering V-Model, the left side represents decomposition and definition phases. Requirements Analysis is the stage where stakeholder needs are translated into system-level requirements, including security functional requirements. Defining security requirements here ensures they are allocated to the system architecture and can be traced through design, implementation, and testing. This early definition is critical for traceability and for avoiding costly rework later.

Answer

Detailed Design

Answer

System Integration and Testing

Answer

Operational Maintenance

Question 13

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

Accepted Answer

SAST (Static Application Security Testing). Static Application Security Testing (SAST) tools analyze source code for security vulnerabilities without executing the code, making them ideal for the build stage.

Answer

DAST (Dynamic Application Security Testing)

Answer

IDS (Intrusion Detection System)

Answer

SIEM (Security Information and Event Management)

Question 14

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

Accepted Answer

Document the risk and implement compensating controls. The ISSE should perform a gap analysis to determine if a compensating control can mitigate the risk until the legacy system can be upgraded or replaced.

Answer

Forcibly inject TLS 1.3 into the binary

Answer

Ignore the finding because it is a legacy system

Answer

Immediately shut down the system

Question 15

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

Accepted Answer

Identifying security-relevant system components. System design involves defining architectural components, securing interfaces, and establishing trust boundaries.

Answer

Developing incident response plans

Answer

Performing final penetration testing

Question 16

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

Accepted Answer

Integrity. Tampering threats target the Integrity aspect of the CIA triad by attempting to modify data or system configurations.

Answer

Confidentiality

Answer

Availability

Answer

Non-repudiation

Question 17

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

Accepted Answer

To define the minimum security requirements for a system category. A baseline establishes the minimum set of security controls required to protect the system based on its impact level.

Answer

To replace the need for a risk assessment

Answer

To audit employee performance

Answer

To automate the deployment of security patches

Question 18

What is the primary benefit of modularity in secure systems design?

Accepted Answer

Facilitates security analysis and component isolation. Modularity allows for fault isolation and easier security verification of individual components.

Answer

Reduces the total number of lines of code

Answer

Eliminates the need for API gateways

Answer

Guarantees the system cannot be hacked

Question 19

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

Accepted Answer

Attribute-Based Access Control (ABAC). ABAC evaluates access decisions dynamically against attributes of the subject, resource, action, and environment (e.g., user department, data classification, time of day, request origin). In a microservices architecture, where hundreds of services call each other with varying contexts and fine-grained data scopes, ABAC's policy-driven, context-aware model enforces least privilege far more precisely than static role assignments. This granularity is essential when roles proliferate across services and environments.

Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Question 20

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Accepted Answer

Its role in processing sensitive information. Security-critical components are those that enforce policy, handle sensitive data, or provide security functions.

Answer

Its location in the physical facility

Answer

Its cost of procurement