ISC Systems Security Engineering Foundations Practice Test 5 — 15 Questions

Question 1

During a security architecture review, the ISSE must evaluate the system's ability to enforce the *-property (no write down) as defined in the Bell-LaPadula model. The system currently allows a process at the Secret level to write to an object at the Unclassified level. Which design change should the ISSE recommend to satisfy the *-property?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enforce a mandatory access control policy that prevents subjects from writing to objects at a lower sensitivity level.. The *-property, or no-write-down rule, is a core Bell-LaPadula requirement that prevents subjects at a higher sensitivity level from writing to objects at a lower level. Enforcing mandatory access control that blocks such writes directly satisfies this property. This protects confidentiality by preventing high-level information from leaking to lower levels, even if the subject is malicious.

Answer

Apply the simple security property by restricting read access to objects at the same or lower level.

Answer

Implement the Biba integrity model to prevent unauthorized modification of low-integrity data.

Answer

Implement a trusted process that can temporarily downgrade the classification of the object.

Question 2

A systems security engineer is selecting controls for a new federal information system and must ensure the design meets the minimum security requirements defined in NIST SP 800-53. Which concept describes the set of controls determined to be necessary to protect the system based on its security categorization?

Accepted Answer

Security control baseline. The security control baseline is derived from NIST SP 800-53 based on the system's FIPS 199 categorization and represents the minimum controls necessary for protection. Engineers then tailor this baseline to the specific system, documenting implementation in the system security plan and managing gaps through a plan of action and milestones.

Answer

Plan of action and milestones

Answer

System security plan

Answer

Authority to operate

Question 3

An ISSE is leading the initial security architecture for a new Department of Defense (DoD) command-and-control system. The program manager asks how the ISSE plans to address the risk of a single component failure cascading to a mission-critical function. Which engineering principle should the ISSE apply to reduce the likelihood that one component's failure causes a total loss of the security function?

Accepted Answer

Implement redundant security mechanisms and diverse implementations so no single point of failure exists.. The scenario calls for an architectural principle that prevents a single failure from cascading to mission loss. Redundant and diverse security mechanisms eliminate single points of failure by ensuring independent controls can cover for one another. This is a foundational tenet of systems security engineering for high-assurance systems. Documentation, training, and single certified modules do not provide the same architectural fault tolerance.

Answer

Increase the security awareness training frequency for all system administrators.

Answer

Rely on a single, highly certified cryptographic module to protect all command-and-control traffic.

Answer

Document all security controls in the system security plan and require annual reviews.

Question 4

During early requirements definition for a new mission system, stakeholders agree that the system must remain effective even if several individual components are compromised. The ISSE must select a design principle that best supports this objective while keeping the architecture affordable. Which principle should be applied?

Accepted Answer

Defense in depth, layering independent protective mechanisms across the architecture.. Defense in depth layers independent controls so no single compromise yields full access, directly supporting the requirement that the system remain effective when multiple components are lost. It also permits incremental investment, which helps with affordability. The other principles either centralize risk, depend on secrecy, or trade away protection for availability.

Answer

Single point of enforcement, where all security decisions are made by one hardened component.

Answer

Security through obscurity, hiding internal design details from potential adversaries.

Answer

Fail-open behavior, ensuring availability by bypassing controls when components fail.

Question 5

An ISSE is leading the security design for a system that will process Controlled Unclassified Information (CUI). The system must comply with NIST SP 800-171. The ISSE needs to ensure that the design includes mechanisms to protect the confidentiality of CUI at rest and in transit. Which set of controls from SP 800-171 should the ISSE prioritize?

Accepted Answer

System and Communications Protection (SC) and Media Protection (MP). To protect CUI confidentiality at rest and in transit under SP 800-171, the ISSE should prioritize System and Communications Protection (SC) for encryption and secure communications, and Media Protection (MP) for safeguarding media that store CUI. These families provide the technical and physical safeguards that directly address the stated requirement.

Answer

Awareness and Training (AT) and Personnel Security (PS)

Answer

Media Protection (MP) and Physical Protection (PE)

Answer

Access Control (AC) and Identification and Authentication (IA)

Question 6

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

Accepted Answer

Bell-LaPadula model. The Bell-LaPadula model is designed for confidentiality in multi-level security systems. Its no-write-down rule, known as the *-property, ensures that subjects at higher sensitivity levels cannot write to objects at lower sensitivity levels. This directly satisfies the scenario's requirement to prevent a Top Secret subject from writing to a Secret object. The other models address integrity or generic access control, not MLS confidentiality.

Answer

Clark-Wilson model

Answer

Graham-Denning model

Answer

Biba integrity model

Question 7

During a security architecture review, an ISSE observes that the design separates the trusted computing base into distinct, isolated modules with explicit interfaces, and that no module can access another's internal data structures directly. Which design principle is primarily being applied to limit the propagation of a compromise?

Accepted Answer

Encapsulation and modularity. Encapsulation and modularity partition the trusted computing base into isolated components that interact only through explicit interfaces. This structure limits the blast radius of a compromise because a faulty or subverted module cannot directly manipulate another module's internal state, which is exactly the propagation-limiting property the ISSE observed.

Answer

Least common mechanism

Answer

Complete mediation

Answer

Fail-safe defaults

Question 8

An ISSE is evaluating a commercial off-the-shelf (COTS) product for use in a system that processes classified information. The vendor claims the product is 'secure by design' but provides no formal evaluation. The ISSE must determine the level of assurance that can be placed in the product's security features. Which factor is most critical in assessing the product's assurance level?

Accepted Answer

The presence of independent third-party evaluation and certification, such as Common Criteria.. Assurance in a COTS product for classified use is best determined by independent third-party evaluation, such as Common Criteria, which provides a standardized, rigorous assessment of security functionality and assurance. Vendor reputation, marketing features, and cost are not reliable substitutes for objective evidence. Common Criteria certification indicates the product has been tested against a protection profile and achieved a specific EAL.

Answer

The product's price and licensing cost compared to competitors.

Answer

The number of security features listed in the product's marketing materials.

Answer

The vendor's reputation and market share in the security industry.

Question 9

An ISSE is reviewing a proposed architecture for a cross-domain transfer system. The design uses a reference monitor concept to mediate all access between security domains. During review, the ISSE must confirm the design satisfies the properties required of a reference monitor implementation. Which set of properties should the ISSE verify?

Accepted Answer

Complete mediation, tamper resistance, and small enough to be analyzed and verified.. A reference monitor must mediate every access, resist tampering, and be small enough to analyze and verify. Those properties are what allow an evaluator to trust that no information flow bypasses the enforcement mechanism. Objectives like confidentiality or authentication describe what the system should achieve, not the structural guarantees the reference monitor must provide.

Answer

Confidentiality, integrity, and availability of all data crossing the boundary.

Answer

Identification, authentication, and authorization of every user on the system.

Answer

Non-repudiation, auditability, and least common mechanism across all domains.

Question 10

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

Accepted Answer

Security through obscurity. Security through obscurity is the flawed practice of relying on secrecy of design or implementation as the main protection. In this scenario, the system assumes attackers will not discover the proprietary protocol, so the security would collapse if that assumption fails. Sound systems security engineering instead demands that security be based on robust, verifiable mechanisms that do not depend on adversary ignorance.

Answer

Separation of duties

Answer

Defense in depth

Answer

Least privilege

Question 11

An ISSE is reviewing a system architecture that uses a trusted path for security-critical operations. The developer proposes implementing the trusted path as a software-only mechanism within the general-purpose operating system. Which characteristic of a trusted path is most important for the ISSE to verify in this design?

Accepted Answer

The trusted path must be isolated from untrusted software so that it cannot be intercepted, modified, or spoofed.. A trusted path is trusted because untrusted software cannot intercept, modify, or spoof it. When the path is implemented in software within a general-purpose OS, the ISSE must verify that the path is isolated from untrusted processes, often through a secure attention sequence and TCB mediation. Authentication, encryption, and hardware implementation may support the path but do not by themselves establish the trust property.

Answer

The trusted path must encrypt all communications between the user and the system to protect against network eavesdropping.

Answer

The trusted path must be implemented in hardware to guarantee that it cannot be bypassed by any software.

Answer

The trusted path must be able to authenticate the user before any security-critical operation is allowed.

Question 12

A systems security engineer is conducting a design review for a new web application that will handle sensitive customer data. The architecture includes a web server, application server, and database server. The engineer notices that the application server directly connects to the database using a hard-coded administrative account with full privileges. Which security principle is most directly violated by this design?

Accepted Answer

Least privilege. Least privilege is violated because the application server is using a hard-coded administrative account with full privileges, which exceeds the rights needed for its function. This creates a significant risk if the application server is compromised, as the attacker gains full database control. The design should instead use a service account with only the necessary permissions, adhering to the principle of least privilege.

Answer

Separation of duties

Answer

Fail-safe defaults

Answer

Defense in depth

Question 13

An ISSE is reviewing the security architecture of a system that uses a layered defense strategy. The system includes firewalls, intrusion detection systems, and host-based antivirus. The ISSE wants to ensure that the compromise of a single component does not lead to a total system breach. Which principle is the ISSE applying?

Accepted Answer

Defense in depth. Defense in depth is the practice of using multiple, overlapping security controls so that the failure of one control does not compromise the entire system. The scenario's combination of firewalls, IDS, and antivirus represents independent layers that collectively reduce risk and provide redundancy against attacks.

Answer

Fail-safe defaults

Answer

Least privilege

Answer

Separation of duties

Question 14

An ISSE is drafting the security architecture description for a system that will undergo an assessment against the ISO/IEC 21827 (SSE-CMM) process areas. The assessor asks which work products demonstrate that the risk process area is being performed. Which TWO work products best provide that evidence? (Choose two.)

Accepted Answer

A risk management plan that defines the organization's risk tolerance, assessment methodology, and monitoring approach.. The risk process area is demonstrated by a governing risk management plan and the resulting risk assessment reports. Together they show that an organization defined how risk is handled and then actually analyzed threats, vulnerabilities, and impacts. The other artifacts belong to configuration management, security requirements, or training process areas and would be assessed under those headings.

Answer

A configuration management plan listing baselines and change control board procedures.

Answer

A training record showing that developers completed secure coding awareness courses.

Answer

A system security plan describing the operational environment and control implementation.

Question 15

An ISSE is evaluating a proposed change to an accredited system that will introduce a new external interface. The change is classified as significant. According to the Risk Management Framework (RMF) process, which activity must the ISSE perform before the change can be approved?

Accepted Answer

Conduct a security impact analysis to determine the effect on the system's security posture.. A significant change under RMF triggers a security impact analysis to evaluate how the modification affects the system's risk posture. This analysis examines the new interface's threats, vulnerabilities, and potential control impacts. Only after this assessment can the authorizing official decide whether to approve the change, require additional controls, or initiate reauthorization. Simply updating documentation or assuming the old baseline suffices would not meet RMF requirements.

Answer

Immediately reauthorize the system with the existing security control baseline.

Answer

Update the system security plan without performing any additional assessment.

Answer

Remove the system from the authorization boundary until the change is complete.