ISC Systems Security Engineering Foundations Practice Test 4 — 15 Questions

Question 1

When designing a system for 'Non-repudiation', which technical control is essential?

Accepted Answer

Digital signatures. Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.

Answer

Basic username/password authentication

Answer

Hashing only

Answer

Symmetric encryption

Question 2

Which THREE of the following are valid 'Authentication' factors?

Accepted Answer

Something you are (e.g., fingerprint). Authentication factors fall into categories: something you know, something you have, and something you are.

Answer

Where you sit in the office

Answer

Your mood at the time of login

Question 3

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

Accepted Answer

Real-time incident detection. Option A (Real-time incident detection) is correct because ConMon depends on continuous telemetry and alerting (e.g., SIEM correlation, IDS/IPS, EDR) to identify threats as they occur rather than at a point-in-time assessment. Option D (Established incident response procedures) is correct because detection has value only when paired with documented, tested IR playbooks that define triage, escalation, containment, eradication, and recovery actions. Option E (Automated security control status monitoring) is correct because ConMon, per NIST SP 800-137, requires ongoing automated assessment of control effectiveness (e.g., SCAP, continuous diagnostics and mitigation) to maintain an accurate, near-real-time authorization posture. Option B (Quarterly hardware refresh) is not a ConMon factor—hardware lifecycle management is a separate asset management concern and does not provide continuous visibility into security control status or incidents. Option C (Manual annual log review) is not appropriate because annual, manual review is periodic and retrospective, contradicting the continuous, automated nature of an effective ConMon program.

Answer

Quarterly hardware refresh

Answer

Manual annual log review

Question 4

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

Accepted Answer

It is a component that strictly applies security policies. A security-enforcing component is one that actively mandates security policies, such as a reference monitor or a gatekeeper.

Answer

It can be easily bypassed by users

Answer

It is a component that only audits traffic

Answer

It is a component that is optional for performance

Question 5

What is the primary risk of a 'Privileged User' who lacks proper oversight?

Accepted Answer

They can bypass security controls and abuse access. Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.

Answer

They will slow down system performance

Answer

They cannot do their job

Answer

They will always be hackers

Question 6

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

Accepted Answer

It provides no actual protection against determined attackers. Obscurity is not a reliable control; if the design is discovered (which it eventually will be), the system has no remaining security.

Answer

It makes the code too complex

Answer

It increases hardware costs

Answer

It prevents auditing

Question 7

When engineering a 'Secure Boot' sequence, what is the primary security objective?

Accepted Answer

To ensure only trusted, signed code is executed. Secure Boot ensures that every piece of software loaded during the boot process is digitally signed by a trusted entity, preventing rootkits from loading early.

Answer

To allow for easy BIOS updates

Answer

To bypass the need for an OS

Answer

To speed up the boot process

Question 8

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

Accepted Answer

Standards and procedures. Policies must define the 'what' (High-level), the 'how' (Standards/Procedures), and the 'how-to' (Guidelines).

Answer

Office cleaning schedule

Answer

Employee salary structure

Question 9

What is the primary advantage of 'Defense in Depth'?

Accepted Answer

It provides multiple layers of security to mitigate single point failures. Defense in depth ensures that if one control fails, others are present to stop an attacker, creating a more robust overall system.

Answer

It makes the system faster

Answer

It simplifies system maintenance

Answer

It removes the need for firewalls

Question 10

An ISSE is reviewing a system architecture where the design team plans to mitigate a spoofing threat to an external interface by adding a digital signature to each message. During the design review, the ISSE notes that the signing key is stored in plaintext in the same configuration file as the application. Which security engineering principle is most directly violated by this design decision?

Accepted Answer

Cryptographic key management. Digital signatures only provide authenticity and integrity if the private signing key remains secret. Placing that key in plaintext in a configuration file exposes it to anyone with file read access, allowing message forgery and defeating the control. Proper cryptographic key management demands that keys be stored in protected locations such as hardware security modules or encrypted keystores, separate from application code and configuration.

Answer

Separation of duties

Answer

Least common mechanism

Answer

Defense in depth

Question 11

An ISSE is defining the protection profile for a new multi-level secure system that must enforce the Bell-LaPadula model. The design team asks which rules must be enforced to prevent unauthorized disclosure of classified information. (Choose two.)

Accepted Answer

The simple security property: a subject at a given security level may not read an object at a higher security level.. Bell-LaPadula is a confidentiality model whose two mandatory rules are the simple security property, which forbids reading up, and the star property, which forbids writing down. Together these rules prevent a subject from accessing higher-classified data and from leaking it to lower levels. The other options describe supporting concepts or a different model entirely, so they do not satisfy the requirement to prevent unauthorized disclosure.

Answer

The tranquility principle: security labels may not be changed while the system is processing data.

Answer

The weak tranquility principle: subjects may change their security level only after re-authentication.

Answer

The Biba integrity property: a subject may not read an object at a lower integrity level.

Question 12

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

Accepted Answer

Security requirements identified early can be allocated to system components and traced through design, reducing costly rework later.. Systems security engineering is most effective when it begins with concept and requirements definition, because security requirements can then be derived, allocated, and traced through the lifecycle. This early allocation lets designers build controls into the architecture instead of retrofitting them, which reduces cost and schedule risk. The other statements either overstate what early involvement guarantees or misdescribe the purpose of early security work.

Answer

Starting early guarantees that the system will be certified and accredited without any residual risk.

Answer

Early involvement allows the ISSE to defer all security control selection until the operations and maintenance phase.

Answer

Early security engineering eliminates the need for security testing because threats are addressed during requirements analysis.

Question 13

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

Accepted Answer

Bell-LaPadula model. The requirement is a mandatory confidentiality flow control across sensitivity labels, which is the defining purpose of the Bell-LaPadula model. Its simple security property blocks reading above one's clearance, and its star property blocks writing below the object's classification. Together they ensure TOP SECRET data cannot reach UNCLASSIFIED subjects, satisfying the command-and-control system's multilevel security mandate.

Answer

Brewer-Nash (Chinese Wall) model

Answer

Clark-Wilson integrity model

Answer

Biba integrity model

Question 14

An ISSE is developing a security architecture for a new payroll processing system that handles PII and financial data. The system will be deployed on a private cloud and must comply with NIST SP 800-53 controls. The ISSE needs to ensure that the system's security requirements are traceable from initial stakeholder needs through design, implementation, and testing. Which systems security engineering activity best supports this traceability?

Accepted Answer

Establishing a requirements traceability matrix (RTM) that links security requirements to design, code, and test cases.. A requirements traceability matrix provides a structured, auditable link from each security requirement to its origins, design, implementation, and verification. This supports compliance, impact analysis, and verification that all requirements are met. Other activities like threat modeling, security impact analysis, or CMDB maintenance are important but do not fulfill the need for end-to-end requirements traceability in systems security engineering.

Answer

Performing a security impact analysis for each proposed change to the system.

Answer

Conducting a threat modeling exercise using STRIDE during the design phase.

Answer

Implementing a configuration management database (CMDB) to track all hardware and software components.

Question 15

An ISSE is defining the boundary of a system under development and must document which components are inside the trusted computing base (TCB) versus outside it. The system includes a commercial hypervisor, guest virtual machines, a management console, and a hardware security module (HSM). Which criterion most directly determines whether a component belongs inside the TCB?

Accepted Answer

Whether failure or subversion of the component could cause the system to violate its security policy.. The TCB comprises all hardware, firmware, and software whose correct operation is necessary to enforce the system security policy. A component belongs inside the boundary when its failure or subversion would allow a policy violation, regardless of vendor, data classification, or physical location. Applying that criterion keeps the boundary defensible and keeps the evaluation scope manageable.

Answer

Whether the component is supplied by a third-party vendor rather than developed in-house.

Answer

Whether the component resides on the same physical host as the security kernel.

Answer

Whether the component processes data classified above the system's accreditation level.