ISC Systems Security Engineering Foundations Practice Test 3 — 15 Questions

Question 1

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

Accepted Answer

Assigning security requirements to developers. An SDL integrates security into every phase of development: planning, design, implementation, testing, and release.

Answer

Physical security of the office parking lot

Answer

Hiring external marketing staff

Question 2

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

Accepted Answer

Fail-over systems can introduce insecure states or bypasses. Fail-over mechanisms often create race conditions or temporary bypasses that attackers can exploit to gain unauthorized access.

Answer

Fail-over systems are too expensive

Answer

The fail-over process might be too slow

Answer

Fail-over systems use too much power

Question 3

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

Accepted Answer

To prevent data recovery after asset disposal. Sanitization is the process of removing data from storage media such that the data cannot be reconstructed by any forensic means.

Answer

To format the disk for reuse

Answer

To clean the hardware of dust

Answer

To update the operating system

Question 4

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

Accepted Answer

Zero-trust network architecture. Cloud security relies on zero-trust and defense-in-depth principles implemented through infrastructure-as-code and micro-segmentation.

Answer

Hardcoded credentials in application code

Answer

Public access to all S3 buckets

Answer

Monolithic application architecture

Question 5

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

Accepted Answer

It serves as the contract between the vendor and the evaluator. The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.

Answer

It replaces the need for a threat model

Answer

It is a marketing document for end users

Answer

It defines the operating system kernel

Question 6

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

Accepted Answer

Implementing a Software Bill of Materials (SBOM). Software Bill of Materials (SBOM) allows organizations to track and manage the components in their software, facilitating the identification of vulnerable third-party dependencies.

Answer

Limiting the number of developers

Answer

Enforcing password complexity

Answer

Using only open-source software

Question 7

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

Accepted Answer

Conducting the security control assessment. The Assess step focuses on determining the effectiveness of the security controls implemented in the system.

Answer

Authorizing the system for operation

Answer

Disposing of the system components

Question 8

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

Accepted Answer

It provides redundancy and DoS mitigation. Load balancers distribute traffic, preventing any single instance from being overwhelmed (a form of DoS mitigation) and allowing for maintenance without downtime.

Answer

It caches all static content

Answer

It replaces the need for a firewall

Answer

It encrypts all traffic

Question 9

Which of the following is an example of an 'Administrative' security control?

Accepted Answer

Incident Response Plan. Administrative controls focus on policies, procedures, and guidelines, such as an incident response plan.

Answer

Security guard

Answer

Biometric scanner

Answer

Firewall rules

Question 10

What is the primary function of an 'API Gateway' in a microservices security architecture?

Accepted Answer

To provide centralized authentication and rate limiting. An API Gateway acts as a single entry point that handles authentication, rate limiting, and request routing for microservices.

Answer

To compile the source code

Answer

To store the application database

Answer

To act as a physical firewall

Question 11

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Accepted Answer

Graceful degradation. Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.

Answer

Maximal feature set

Answer

Hardware redundancy only

Answer

Complete system lockdown upon error

Question 12

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

Accepted Answer

Hashing and off-loading logs to a secure, write-only destination. Logs must be protected from tampering; hashing and secure remote storage are standard methods to ensure they remain trustworthy.

Answer

Including as much noise as possible

Answer

Storing logs only on the local server

Answer

Storing logs in plain text

Question 13

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

Accepted Answer

System boundary description. An SSP describes the system, its security boundaries, the controls applied, and the risk management strategy.

Answer

Office breakroom rules

Answer

Personal employee salary data

Question 14

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

Accepted Answer

SOC 2 Type II or equivalent audit reports. Assessing a CSP involves reviewing their security certifications, physical controls, and logical security isolation capabilities.

Answer

Employee cafeteria menu

Answer

Office interior design plans

Question 15

What is the primary objective of a 'Security Design Review' early in the lifecycle?

Accepted Answer

To catch design-level security flaws early. A design review aims to identify security flaws before they are implemented, as it is much cheaper to fix them in the design phase than during production.

Answer

To finalize the user interface layout

Answer

To conduct penetration testing

Answer

To verify the system's performance metrics