scenario questions

You are the security engineer responsible for verifying the implementation of an organization's Public Key Infrastructure (PKI) as part of a system accreditation effort. The Certificate Practice Statement (CPS) states that all end-entity certificates must be issued with a maximum validity of 365 days and must include the Certificate Policies extension. During your validation, you sample issued certificates and find that a subordinate CA has been issuing certificates with a 730-day validity and no Certificate Policies extension. Which validation activity best identifies the root cause of this non-compliance?

A security engineer is drafting a change management procedure for a financial institution's production environment. The procedure must ensure that changes are approved before implementation and that emergency changes are handled without bypassing security controls. Which element is essential to include in the procedure?

An ISSEP is leading a risk assessment for a new cloud-based system that will store sensitive customer data. The organization must comply with GDPR and other privacy regulations. Which TWO of the following are the most critical factors to consider when assessing data residency risks? (Choose two.)

A security engineer is validating a server's hardening posture against CIS Benchmarks. Which TWO of the following configurations must be verified for the SSH service?

Which THREE actions should be taken when decommissioning an information system to ensure data security?

Which THREE factors are essential when performing a threat model using the STRIDE methodology?

An ISSEP is designing a system that will use a public key infrastructure (PKI) for authentication and encryption. The system owner is concerned about the security of the private keys used by the certificate authorities (CAs) and end entities. The ISSEP must recommend a key management strategy that protects private keys throughout their lifecycle. Which strategy should the ISSEP recommend?

You are advising a program on the disposal of a system that processes Sensitive But Unclassified information. The system uses solid-state drives. The program wants to reuse the drives in a lower-security environment. Which sanitization method is MOST appropriate to allow reuse while ensuring the data cannot be recovered?

You are finalizing the verification and validation report for a system entering the authorization phase. The approving official requires evidence that the implemented security controls are not only present but operating correctly, and that residual weaknesses are documented. Which TWO activities must be completed to satisfy this requirement? (Choose two.)

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

An ISSE is defining the boundary of a system under development and must document which components are inside the trusted computing base (TCB) versus outside it. The system includes a commercial hypervisor, guest virtual machines, a management console, and a hardware security module (HSM). Which criterion most directly determines whether a component belongs inside the TCB?

An ISSEP is designing a cross-domain solution (CDS) to allow data transfer between a high-assurance network and a low-assurance network. The solution must enforce a strict one-way flow of data and prevent any possibility of a covert channel back to the high side. Which architectural approach BEST satisfies this requirement?

Which TWO security standards are most relevant for an ISSEP designing a secure payment processing system?

Which of the following is the most appropriate action when an ISSEP identifies a high-risk vulnerability in a system that is currently in production?

A security engineer is verifying that an implemented boundary device correctly performs deep inspection of allowed application traffic rather than only permitting it based on port and protocol. The requirement states that the device must detect and block protocol anomalies within permitted sessions. Which verification approach provides the strongest evidence that this inspection capability is genuinely operating?

An ISSEP is assessing the security of a CI/CD pipeline. Which THREE of the following practices are crucial to ensure the security of the software supply chain?

An ISSE is leading the initial security architecture for a new Department of Defense (DoD) command-and-control system. The program manager asks how the ISSE plans to address the risk of a single component failure cascading to a mission-critical function. Which engineering principle should the ISSE apply to reduce the likelihood that one component's failure causes a total loss of the security function?

An ISSE is defining the trustworthiness requirements for a new high-assurance system that will process classified information. The program manager asks which security engineering principles should be explicitly applied to the system architecture to ensure it can enforce its security policy under attack. (Choose two.)

An ISSEP is reviewing the risk analysis for an Engineered System that relies on a commercial cloud provider for data storage. The analysis lists provider-side outages as the only supply chain risk. The ISSEP knows the provider uses subcontractors for data center operations and hardware maintenance. Which deficiency in the analysis should the ISSEP address first?

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

You are the ISSE for a system that has just been decommissioned. The system security plan included a contingency plan that referenced a failover site. Which action is MOST important to perform during the disposal phase to prevent unauthorized access to sensitive data that may remain at the failover site?

You are performing a security validation of a database to ensure that all administrative actions are captured. Which feature must be checked to confirm that logging is capturing these events?

An ISSEP is reviewing the security architecture for a system that will handle law enforcement sensitive data. The system owner wants to ensure that the design supports the concept of least privilege and separation of duties. Which security engineering principle should the ISSEP apply to enforce these requirements at the architectural level?

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where multiple nations will share data. The system owner asks which risk factors are MOST important to evaluate during the assessment. (Choose two.)

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

A federal information system is being decommissioned. The ISSE must ensure that hardware containing controlled unclassified information is disposed of in a manner that satisfies both the agency's media protection policy and its contract with a cloud service provider that hosted backups. Which action best addresses the disposal obligation for the provider-held backups?

A system is undergoing security control assessment before authorization to operate. The assessor must determine whether the implemented audit logging control satisfies the stated requirement that all authentication events, including failures, are recorded with sufficient detail for accountability. Which assessment method yields the most defensible evidence for this determination?

When applying NIST SP 800-53 controls to a new information system, which step occurs immediately after the 'Categorize' process in the RMF?

A systems security engineer is conducting a design review for a new web application that will handle sensitive customer data. The architecture includes a web server, application server, and database server. The engineer notices that the application server directly connects to the database using a hard-coded administrative account with full privileges. Which security principle is most directly violated by this design?

Which THREE elements are essential in a Change Management policy?

An ISSEP is conducting a security architecture review for a system that will process classified information. The system owner wants to ensure that the architecture includes appropriate boundary defense mechanisms. The ISSEP must recommend controls that provide boundary defense. Which two controls should the ISSEP recommend? (Choose two.)

An ISSEP is performing a system-level risk assessment for a new payroll processing system that will operate in a shared datacenter. The system owner insists on using a qualitative risk matrix because the organization lacks reliable historical incident data. During validation, the ISSEP notes that two different assessors assigned the same threat scenario to different likelihood categories, and the risk scores diverged significantly. Which action best addresses this inconsistency while preserving the qualitative approach?

A government agency is decommissioning a legacy mainframe that processes sensitive but unclassified data. The agency must ensure that all data is irretrievably destroyed and that the destruction is verifiable for audit purposes. Which disposal method best meets these requirements?

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

An ISSEP is designing a secure architecture for a system that will use a cloud-based service. The system must comply with the NIST Risk Management Framework (RMF) and the organization's security policy. The ISSEP must ensure that the cloud provider's security controls are assessed and that the organization retains the ability to authorize the system. Which approach best meets these requirements?

You are validating the implementation of security controls for a database server that stores sensitive customer data. The requirement is to verify that the database enforces encryption at rest and that access is restricted to authorized users. Which TWO of the following verification activities best confirm that these requirements are met? (Choose two.)

An ISSEP is performing a risk assessment on a system that depends on a commercial cloud provider for infrastructure. The provider's shared responsibility model places physical security and hypervisor patching with the provider, while the ISSEP's organization retains responsibility for data classification, identity management, and application security. The Authorizing Official asks the ISSEP to formally capture which controls are inherited, shared, or customer-owned so that residual risk is not double-counted or overlooked. Which risk management activity best addresses this need?

Which TWO items should be included in a system's security architecture documentation?

A systems security engineer is performing a functional decomposition of a new command-and-control system. The chief engineer insists that every allocated security control be traceable back to an approved stakeholder requirement before the preliminary design review. Which artifact should the ISSE produce to satisfy this demand?

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

An ISSE is drafting the security architecture description for a system that will undergo an assessment against the ISO/IEC 21827 (SSE-CMM) process areas. The assessor asks which work products demonstrate that the risk process area is being performed. Which TWO work products best provide that evidence? (Choose two.)

A security engineer is verifying that an organization's configuration management process detects unauthorized changes to security-relevant settings on production servers. The requirement states that deviations must be identified within one hour of occurrence. Which mechanism best demonstrates continuous compliance with this timing requirement?

You are assessing an Engineered System that utilizes a Trusted Platform Module (TPM) for secure boot. A scan reveals that the firmware version is outdated and susceptible to a known key-injection vulnerability. Which action should the ISSEP prioritize?

An ISSE is reviewing a system architecture that uses a trusted path for security-critical operations. The developer proposes implementing the trusted path as a software-only mechanism within the general-purpose operating system. Which characteristic of a trusted path is most important for the ISSE to verify in this design?

Which THREE strategies are used to mitigate risk during a production software change?

A defense contractor is designing a multi-level security (MLS) system that must enforce mandatory access controls. The ISSE must select a model that prevents a subject with Top Secret clearance from writing data to a Secret-level object, even if the subject has legitimate access to both levels. Which security model directly enforces this no-write-down property?

During a risk assessment of an industrial control system (ICS), the engineer identifies that an administrative workstation shares the same VLAN as the PLC network. Which remediation action is most effective from a risk management perspective?

An ISSEP is performing a system-level risk assessment for a new payroll system. The team decides to use a qualitative approach because quantitative data is scarce. Which of the following best describes a key limitation of qualitative risk assessment that the ISSEP should communicate to stakeholders?

You are validating the security of a database system. Which THREE of the following are standard verification steps for database security?

An ISSEP is assessing a border control system that uses biometric facial recognition for traveler verification. The system's FAR is 0.001 and FRR is 0.05 at the current threshold. The mission owner wants to reduce the chance of a false match to near zero. Which action should the ISSEP recommend FIRST?

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

During a system migration, you need to ensure integrity of transferred data. What is the best cryptographic method?

During a security architecture review, the ISSE must evaluate the system's ability to enforce the *-property (no write down) as defined in the Bell-LaPadula model. The system currently allows a process at the Secret level to write to an object at the Unclassified level. Which design change should the ISSE recommend to satisfy the *-property?

You are verifying that a specific file on a server has not been modified. Which tool or command is most appropriate for verifying file integrity?

An ISSEP is reviewing the security architecture of a system that will be accredited under the DoD Information Assurance Certification and Accreditation Process successor, the RMF. The system owner proposes to accept a known configuration weakness because compensating controls reduce the exploit likelihood. Before endorsing the risk acceptance, which action must the ISSEP take to ensure the decision is defensible?

You are the security engineer for a federal agency that must follow NIST SP 800-53 configuration management controls. A system administrator submits an emergency change to modify a firewall rule to allow a new business partner's IP range. The change is implemented immediately and documented afterward. Which configuration management control requirement does this action violate?

An ISSEP is performing a system-level risk assessment on a cloud-native architecture using the NIST SP 800-37 RMF. During the 'Assess' step, the engineer identifies that an automated security configuration baseline is missing for the container orchestration layer. What is the most appropriate action to maintain RMF compliance?

When conducting a security impact analysis for a system change in a Federal environment, what is the primary purpose of reviewing the FIPS 199 categorization?

An ISSE is leading a design review of a new identity management subsystem that must support separation of duties for administrative functions. The review board asks which design characteristics directly enforce separation of duties within the subsystem. (Choose two.)

You are verifying that a firewall rule correctly blocks traffic from an unauthorized network. Which tool is best suited for testing this connectivity?

An ISSEP is designing a cross-domain solution (CDS) to allow data to flow from a Secret network to an Unclassified network. The CDS must enforce a strict one-way transfer with content filtering. Which security principle is MOST critical to verify during the design review to prevent data leakage from the higher classification to the lower?

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

As part of an accreditation process, you are validating that the system meets NIST 800-53 requirements for incident response. Which THREE items must be present in the verification evidence?

An ISSEP is evaluating the risk of an API that uses basic authentication over HTTP. What is the most significant risk, and how should it be mitigated?

Which TWO actions should be included in a secure decommissioning process for a physical server?

When architecting a system to meet ISO 27001 requirements for secure system engineering, which TWO of the following design principles should be prioritized for protecting sensitive data at rest?

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

A healthcare provider is retiring an on-premises electronic health record (EHR) system that stored protected health information (PHI). The decommissioning plan includes data migration, media sanitization, and contract termination with the hardware maintenance vendor. The security engineer must ensure that residual PHI on the vendor's diagnostic laptops and spare parts inventory is addressed before the maintenance contract ends. Which action best closes this disposal gap?

Which THREE of the following are essential for protecting against 'Man-in-the-Middle' (MitM) attacks in a service-oriented architecture?

An ISSEP is evaluating the security of an API gateway. To implement OAuth 2.0 effectively, which flow should be recommended for a native mobile application?

When validating a server's security implementation, which THREE of the following log files or directories should be reviewed to check for unauthorized activity?

You are validating the security implementation of a wireless network. Which THREE of the following are necessary to verify that WPA3 is properly configured?

A security engineer is conducting verification and validation for a new Windows Server 2022 deployment on a classified network that must meet DISA STIG requirements. The engineer needs to verify that the audit policy is correctly implemented and that audit records are being generated for a specific security-relevant event. Which action provides the most direct evidence that the audit policy is functioning as intended?

As part of validating a cloud environment's security, you need to ensure the network boundary is protected. Which THREE of the following are valid verification tasks?

During a system validation audit, you must verify the configuration of a hardware security module (HSM). Which THREE of the following are valid validation checks?

An ISSEP is reviewing a system's risk register and notices that several entries list only the threat source and the affected asset, without any statement of the potential mission consequence. The system owner asks why consequence information is necessary when the threat and asset are already recorded. What is the most accurate justification for including consequence detail?

Which TWO criteria are used to determine if a change request must be reviewed by the Change Advisory Board (CAB)?

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

When validating the security of an email gateway, which THREE of the following settings should be verified to prevent spoofing and improve trust?

An ISSEP is designing a secure network architecture for a defense contractor that must comply with NIST SP 800-171. The system will handle CUI and requires protection against advanced persistent threats (APTs). The ISSEP proposes using a demilitarized zone (DMZ) with firewalls and intrusion detection systems. Which additional architectural control is most critical to satisfy the NIST SP 800-171 requirement for boundary protection?

You are assessing an Engineered System that uses a micro-segmentation strategy to isolate workloads. An attacker has compromised a single container and is attempting to perform network reconnaissance. What mechanism should block this attempt?

In an SCAP-compliant environment, you are validating a system against a DISA STIG. Which file extension is typically used for the definition of the security checks?

Which document outlines the specific security steps to be taken when a workstation reaches its end-of-life?

You are designing an incident response architecture for a cloud environment. Which TWO of the following configurations are critical for ensuring effective forensic readiness according to NIST SP 800-61?

A security engineer is validating the implementation of a public key infrastructure (PKI) for an enterprise that issues smart card certificates to employees for multifactor authentication. The engineer must verify that certificate revocation is properly implemented so that lost or stolen smart cards cannot be used for authentication. Which validation step provides the strongest assurance that revoked certificates are rejected during authentication?

An ISSEP is designing a secure storage solution for a database. To ensure data integrity, which mechanism is most reliable?

What is the primary advantage of 'Defense in Depth'?

You are an ISSEP leading the security architecture review for a new command-and-control system. The system will process classified information and must support defense in depth. The program manager asks which two principles are most critical to apply when defining the security architecture to ensure resilience against advanced persistent threats. (Choose two.)

Which command line utility is used on Linux to verify the integrity of binary files during a maintenance patch update?

Which TWO of the following are considered critical components of a Secure Software Development Life Cycle (SDLC)?

Which TWO of the following are key inputs for a quantitative risk analysis?

What is the correct order of operations when handling a vulnerability in a production system according to the RMF?

An ISSEP is reviewing a system's risk management plan. The plan states that risk will be assessed using a qualitative approach. Which of the following best describes a qualitative risk assessment?

Which TWO of the following are critical for an effective 'Continuous Monitoring' (ConMon) program under RMF?

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

You are evaluating the risk of an Artificial Intelligence (AI) model deployment. The model is susceptible to 'model inversion' attacks, where an attacker can reconstruct sensitive training data. What is the most effective engineering control to prevent this?

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

A security engineer is developing a media disposal plan for a data center that is being decommissioned. The plan must address the secure disposal of various media types, including hard disk drives (HDDs), solid-state drives (SSDs), and magnetic tapes. Which two actions should be included in the plan to ensure compliance with NIST SP 800-88 Rev. 1? (Choose two.)

During a security verification review, an engineer is examining how a web application handles user-supplied input that is used to build a database query. The application uses parameterized statements for most queries, but one legacy module concatenates input directly into a query string. The engineer wants to confirm whether the legacy module is exploitable before recommending remediation. Which verification technique is most appropriate to demonstrate the vulnerability?

A security engineer is validating the implementation of a new security information and event management (SIEM) system that aggregates logs from multiple sources. The engineer must verify that the SIEM is correctly ingesting and correlating events according to the designed use cases. Which validation approach is most appropriate for confirming that correlation rules are functioning as intended?

You are performing a security validation of a Kubernetes cluster using CIS Benchmarks. Which tool should you use to automate the verification of the 'etcd' configuration settings?

An ISSE is helping a program office plan a certification and accreditation effort for a system that will process controlled unclassified information. The program director wants to know how an assurance case differs from a traditional security test report. Which description best characterizes the purpose of an assurance case in this context?

You are utilizing Terraform to manage infrastructure as code. To ensure security-critical changes are not committed to production without authorization, which feature should you implement?

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

An ISSEP is drafting the initial security documentation for a new federal payroll system before any controls have been implemented. The authorizing official wants a document that records the system boundary, the security categorization, and the security controls selected from NIST SP 800-53 Rev. 5, and that will serve as the primary artifact supporting the authorization decision throughout the RMF. Which document should the ISSEP produce?

You are verifying the implementation of disk encryption on a Windows server. Which command is used to confirm that BitLocker is active on the C: drive?

Which TWO of the following are essential components of a robust threat modeling process for an engineered system?

An ISSEP is evaluating the security of an OT/ICS environment. Which THREE of the following are considered high-priority mitigation strategies to protect against common ICS cyber threats?

You are verifying the implementation of a FIPS 140-2 validated module in an on-premises Linux server. Which command correctly verifies that the cryptographic module is operating in the intended FIPS mode?

An ISSE is reviewing a proposed architecture for a cross-domain transfer system. The design uses a reference monitor concept to mediate all access between security domains. During review, the ISSE must confirm the design satisfies the properties required of a reference monitor implementation. Which set of properties should the ISSE verify?

A security engineer is verifying the implementation of a public key infrastructure (PKI) for a government agency. The agency requires that all digital certificates comply with FIPS 140-2 and are issued by a trusted certificate authority. During validation, the engineer needs to confirm that a server's certificate is valid and has not been revoked. Which mechanism should the engineer use to check the certificate's revocation status in real time?

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

You are designing a secure data enclave for highly sensitive research data. What is the most robust method to enforce physical and logical separation?

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

An ISSEP is developing the security architecture for a new system that will be deployed in a cloud environment. The system must comply with the NIST RMF and leverage cloud-specific security features. Which TWO considerations should the ISSEP address when defining the security architecture? (Choose two.)

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

During the design of a PKI hierarchy for a highly classified system, the ISSEP needs to ensure that the Root CA is kept offline. What is the most appropriate way to sign the Subordinate CA request?

Which document is used to track and manage vulnerabilities identified during the assessment phase of the RMF?

An ISSE supports a continuous integration pipeline where developers commit infrastructure-as-code that provisions security groups and logging agents. A recent audit found that a developer merged a change disabling flow logs in production without any independent review. Which control directly addresses this gap while preserving the pipeline's automated deployment model?

A systems security engineer is selecting controls for a new federal information system and must ensure the design meets the minimum security requirements defined in NIST SP 800-53. Which concept describes the set of controls determined to be necessary to protect the system based on its security categorization?

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

You are auditing the implementation of an API Gateway. How do you verify that rate limiting is effectively preventing a DoS attack?

A program manager asks the ISSE why the systems security engineering process should begin during the concept and requirements phase rather than after the design is complete. Which statement best explains the primary reason for early security engineering involvement?

An ISSEP is performing a system-level risk assessment for a new payroll application that will process employee bank account details. The system owner insists on using a proprietary, unpublished encryption algorithm because it is 'faster than AES.' Which risk response is MOST appropriate according to ISSEP risk management principles?

An ISSEP is conducting a risk assessment for a new system that will process Controlled Unclassified Information (CUI) on a government contract. The system owner proposes a purely qualitative risk assessment using a 5x5 likelihood-impact matrix because it is faster and cheaper. The contract requires compliance with NIST SP 800-171 and a defensible risk determination. Which action should the ISSEP recommend?

A defense contractor is preparing to decommission a classified file server that used self-encrypting drives (SEDs). The drives must be reused in a lower-classification environment. Which action satisfies the media sanitization requirements while preserving the drives' usability?

An ISSEP is leading the security engineering effort for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to ensure that the system's security requirements are derived from a formal threat model and that the design mitigates identified threats before development begins. Which activity should the ISSEP perform FIRST to integrate security into the early stages of the system development life cycle?

An ISSEP is designing a secure CI/CD pipeline. Which technique is most effective for preventing secrets (e.g., API keys) from being committed to the source code repository?

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

An ISSE is reviewing the security architecture of a system that uses a layered defense strategy. The system includes firewalls, intrusion detection systems, and host-based antivirus. The ISSE wants to ensure that the compromise of a single component does not lead to a total system breach. Which principle is the ISSE applying?

When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

An ISSEP is working on a system that must comply with the NIST Risk Management Framework (RMF). The system owner asks the ISSEP to explain the purpose of the 'Prepare' step in the RMF. Which statement best describes the goal of the Prepare step?

A security engineer is validating the implementation of a public key infrastructure (PKI) that issues certificates to internal servers. The validation must confirm that certificate revocation is enforced correctly by relying parties. Which TWO verification activities provide direct evidence that revocation checking is functioning as intended? (Choose two.)

When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?

During a risk assessment of a distributed system, the ISSEP identifies that a critical cryptographic module is nearing its end of support and the vendor will stop issuing firmware patches. The module cannot be replaced before the next authorization cycle, but the system must continue operating. Which risk response best fits the ISSEP's role at this stage?

An ISSEP is conducting a quantitative risk assessment for a mission-critical database. The Annualized Rate of Occurrence (ARO) is 0.5, and the Single Loss Expectancy (SLE) is $100,000. What is the Annualized Loss Expectancy (ALE)?

A defense contractor maintains classified systems in a facility accredited under the NISP. A storage area network (SAN) array will be repurposed from a collateral Secret enclave to an unclassified R&D network. The ISSE must select the sanitization action that renders the array's magnetic disk media free of any residual data that could be recovered using laboratory techniques. Which action satisfies this requirement?

An ISSEP is developing the security architecture for a new federal system that will process Controlled Unclassified Information (CUI). The system owner wants to reuse an existing authorization package from a similar system to reduce costs. The ISSEP must ensure the reuse is valid under the NIST Risk Management Framework (RMF) and NIST SP 800-37 Rev. 2. Which action best supports this goal?

An ISSE is reviewing a design where the system's security relies on the assumption that attackers will not discover a proprietary communication protocol. The ISSE objects to this approach. Which principle is being violated?

You are analyzing a proprietary SCADA system's threat landscape. The system uses a non-standard protocol that prevents the use of traditional deep packet inspection (DPI) tools. Which method provides the most effective risk reduction?

A defense contractor is engineering a command-and-control system that must enforce mandatory access control based on data sensitivity labels. The system must ensure that information never flows from a TOP SECRET object to an UNCLASSIFIED subject, even if the subject has legitimate access to other TOP SECRET data. Which security model should the ISSE specify as the foundation for the system's access control design?

What is the primary function of a Change Advisory Board (CAB) in an ITIL-based environment?

An ISSEP is performing a risk assessment for a new system that will process Controlled Unclassified Information (CUI). The system owner wants to use a cloud service provider (CSP) that stores data in multiple countries. The ISSEP must ensure compliance with applicable federal requirements. Which action should the ISSEP take FIRST?

A security engineer is validating the implementation of full disk encryption using BitLocker on Windows 11 laptops in an enterprise. The organization requires that BitLocker be enabled with TPM and PIN protector and that recovery keys be escrowed in Active Directory. Which validation activity provides the strongest evidence that the BitLocker configuration meets these requirements?

A security engineer is validating the implementation of a secure software development lifecycle (SDLC) for a critical application. The requirement is that all code must undergo static analysis before deployment. During validation, the engineer finds that the static analysis tool is configured to ignore certain classes of vulnerabilities. Which action should the engineer take to ensure the validation is effective?

Which TWO of the following are acceptable ways to handle residual risk after implementing security controls in an RMF process?

An ISSEP is performing a supply chain risk assessment for an IOT-based sensor array. Which finding poses the highest systemic risk to the overall system integrity?

What is the first step when preparing a system for secure disposal?

When validating a secure boot implementation on a server, which component should be verified in the UEFI firmware settings?

An ISSEP is integrating a commercial off-the-shelf (COTS) component into a system that will process Controlled Unclassified Information (CUI). The vendor provides a self-signed statement of conformity but no independent assessment. The program needs to characterize the supply chain risk before the component enters the authorization boundary. Which approach best supports an informed supply chain risk determination?

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

An ISSEP is conducting a risk assessment for a system that processes classified information. The system owner proposes using a single risk assessment for both the system and its hosting facility. Which of the following is the most significant risk of this approach?

An ISSEP is reviewing the risk management strategy for an organization deploying a new cloud-based email service. The organization wants to transfer as much risk as possible to the cloud provider. Which action should the ISSEP recommend to clarify what risk can actually be transferred?

You are assessing an Engineered System that uses 'Hardware Security Modules' (HSM). Which THREE of the following are the most critical administrative risks to address in an HSM policy?

An ISSE is developing a security architecture for a new system that must support multiple independent levels of security. The ISSE needs to ensure that the architecture enforces the principles of isolation and non-interference. Which two design techniques should the ISSE require? (Choose two.)

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

An engineering team is designing a new cloud infrastructure. To ensure the system complies with FIPS 140-3, which action must the ISSEP verify during the design phase?

In a cloud environment, you must ensure that VM snapshots are encrypted. What is the most effective approach?

An ISSEP is leading the security engineering effort for a new Department of Defense information system that will process classified data at the Secret level. The system will be deployed on a shared enclave. The program manager asks which NIST publication should be used as the primary source for selecting and specifying security controls for this system.

During a system accreditation process, you need to verify that logs are being sent to a centralized SIEM. Which method provides the most reliable verification of log integrity?

An ISSEP needs to secure inter-process communication (IPC) on a Linux host. Which feature should be configured to prevent unauthorized processes from accessing sensitive memory space?

An ISSEP is reviewing the risk of data residency for a system. Why is data residency a significant factor in a cloud-based risk assessment?

A system is being disposed of, and the disposal plan includes sanitizing solid-state drives that contain sensitive but unclassified data. The drives will be reused within the same organization but in a different security domain with a lower sensitivity level. Which sanitization method is most appropriate?

An ISSEP is configuring a WAF to mitigate OWASP Top 10 risks. Which configuration best addresses the 'Injection' category?

During a security verification review of an organization's systems engineering process, a security engineer must confirm that security requirements are traceable from the initial concept through detailed design. Which artifact provides the most authoritative evidence that each security requirement has been allocated to a specific system component?

A defense contractor is decommissioning a system that processed classified information. The media sanitization records must demonstrate compliance with the Committee on National Security Systems policy for clearing, purging, and destroying media. Which action best satisfies the sanitization requirement for magnetic hard drives that will leave the controlled area?

An ISSEP supports a defense program using the Risk Management Framework (RMF). The system has an approved Authorization to Operate (ATO). During continuous monitoring, a new Common Vulnerabilities and Exposures (CVE) is published that affects a component in the production environment. The vulnerability has a CVSS base score of 8.1, but the component is not exposed to any untrusted network and no known exploit exists. The program manager asks the ISSEP to determine the immediate next step. Which action is MOST appropriate?

Which of the following is the most important document for an ISSEP to review when starting a risk assessment for a new system to ensure that all security requirements are captured?

During the RMF process, which document serves as the primary record for the security controls selected and their implementation status?

An ISSE is reviewing a design that layers network segmentation, host-based firewalls, application input validation, and database encryption. A reviewer argues this duplication is wasteful and proposes collapsing to a single strong control. How should the ISSE justify the layered approach using established security engineering principles?

An ISSE is evaluating a proposed change to an accredited system that will introduce a new external interface. The change is classified as significant. According to the Risk Management Framework (RMF) process, which activity must the ISSE perform before the change can be approved?

You are assessing a system that uses machine learning for fraud detection. The system is experiencing 'concept drift'. What is the risk, and how should it be managed?

An ISSEP is planning the security architecture for a system that will be operated in a facility shared with other tenants. The design must protect against an attacker who gains physical access to the shared space and attempts to capture electromagnetic emanations from the system's displays and cables. Which countermeasure should the ISSEP specify?

An ISSE is defining the security requirements for a new system that will be developed using a systems security engineering approach. The ISSE must ensure that the requirements address the system's ability to protect against, detect, and respond to security incidents. Which TWO activities should the ISSE perform to derive these requirements? (Choose two.)

You are an ISSE for a healthcare provider. A legacy server that stored electronic protected health information (ePHI) is being decommissioned. The server's hard drives are encrypted with AES-256, and the encryption keys are managed by a hardware security module (HSM). The drives will be repurposed within the organization for non-sensitive data. According to NIST SP 800-88 Rev. 1, which sanitization method is most appropriate to render the ePHI unrecoverable while allowing drive reuse?

When selecting controls for a system in a high-compliance environment, what is the best practice for tailoring?

During early requirements definition for a new mission system, stakeholders agree that the system must remain effective even if several individual components are compromised. The ISSE must select a design principle that best supports this objective while keeping the architecture affordable. Which principle should be applied?

When conducting a security validation of a cloud-based infrastructure, which TWO of the following tasks are essential for verification?

An ISSEP is briefing a program manager on the purpose of the Risk Management Framework (RMF) as defined in NIST SP 800-37. The program manager asks which statement best describes the fundamental goal of applying RMF to a new information system. Which response should the ISSEP give?

You are reviewing a Change Management plan for an ICS (Industrial Control System). What is the most critical risk during the 'Implement' phase?

Which THREE items are required to verify the integrity of a downloaded software package?

A retail company is replacing its point-of-sale (POS) terminals with new models that support tokenization. The old terminals store encrypted card data locally and are leased from a payment processor. The security policy requires that all storage media be sanitized before leaving the company's control. Which action should the security engineer take before returning the leased terminals?

An ISSEP is evaluating the risk of a system that uses a blockchain-based ledger for audit logs. The system is designed to be tamper-evident. Which of the following is the most significant residual risk that the ISSEP should highlight?

A security engineer is validating an AWS environment using AWS Config. Which action should be taken to ensure continuous compliance monitoring against a custom security policy?

You are the security lead for a financial institution that is decommissioning a legacy server that processed credit card transactions. The server contains encrypted cardholder data. Legal requires that all data be irretrievably destroyed. The server has multiple hard drives that are still functional. Which disposal method best meets the requirement while also allowing for potential reuse of the drives?

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

An ISSEP is leading the security engineering effort for a new cloud-based system that will process sensitive but unclassified information. The system must comply with FedRAMP Moderate baseline. The ISSEP is selecting security controls from NIST SP 800-53 Rev. 5. Which TWO controls are most appropriate to address the risk of unauthorized access to data at rest in the cloud environment? (Choose two.)

An ISSE is tasked with evaluating the security architecture of a new system that will process top secret information. The system will use a combination of commercial and government-off-the-shelf components. The ISSE must ensure that the architecture supports the required security objectives. Which two security architecture principles are most critical to address when integrating COTS and GOTS components into a high-assurance system? (Choose two.)

You are assessing a system that uses hardware security modules (HSM) for signing code. An attacker is attempting a 'side-channel' attack on the HSM. Which mitigation strategy should be implemented to protect the signing keys?

An ISSEP is conducting a risk assessment for a system that will be deployed in a coalition environment where information must be shared with partner nations. The system uses a cross-domain solution (CDS) to transfer data between security domains. Which TWO of the following are the most critical risk factors to evaluate regarding the CDS? (Choose two.)

An ISSEP is drafting the security architecture for a new federal financial system. The system will process moderate-impact data and must follow the NIST Risk Management Framework (RMF). The system owner asks which document provides the initial allocation of security controls to the system based on the security categorization. Which document should the ISSEP reference?

An ISSEP is assessing the risk of a system that uses 'Secrets Management' services (e.g., HashiCorp Vault). Which THREE of the following are best practices for securing the secrets themselves?

An administrator needs to wipe a decommissioned laptop hard drive. Which method meets the NIST 800-88 'Purge' standard for magnetic media?

You are the ISSE for a system that processes Controlled Unclassified Information. An engineer submits a change request to upgrade the operating system, and the change will alter the cryptographic module boundary described in the system security plan. Before the change is approved, what must occur?

You are an ISSE at a financial institution. A critical security patch for a web application firewall (WAF) must be deployed to production. The change management policy requires that a rollback plan be documented and tested. The WAF configuration is managed via infrastructure-as-code (IaC) in a Git repository. Which approach best satisfies the rollback requirement while maintaining security?

An ISSEP is evaluating a new Engineered System that will be deployed across three geographically separated sites. The program manager wants to reuse a risk assessment performed two years ago for a similar system at a single site to save schedule time. Which factor most directly determines whether the earlier assessment can be reused?

Which TWO factors must be assessed when determining if a change is 'Emergency' versus 'Standard'?

You are designing a secure microservices architecture. To meet the 'Data at Rest' security requirements, you decide to use envelope encryption. Which sequence correctly describes the flow of managing the Data Encryption Key (DEK)?

Which of the following is a primary objective of a 'System-Level Risk Assessment'?

A security engineer is validating that an application server is not vulnerable to common web attacks. What is the first step in the validation process?

A financial services firm runs a three-tier web application on-premises. The security team must apply an emergency patch to the TLS library on all web servers because of an actively exploited vulnerability. The change management policy requires an emergency change process, but the firm's regulator mandates that production changes be traceable and approved by someone other than the implementer. Which sequence best satisfies both the emergency response need and the regulatory requirement?

An organization is migrating to a Zero Trust architecture as defined in NIST SP 800-207. Which component is responsible for evaluating the context of a request, such as device health and location, before granting access?

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

A security engineer is validating the implementation of security controls for a cloud-based system. The system uses infrastructure as code (IaC) to deploy resources. The engineer must verify that the deployed cloud environment matches the approved security baseline and that any drift is detected. Which approach BEST provides continuous verification of the deployed configuration against the baseline?

A security engineer is performing verification of a newly deployed intrusion prevention system (IPS) inline on the network perimeter. The goal is to confirm that the IPS is actively blocking malicious traffic rather than only alerting. Which action provides the most direct verification of blocking capability?

A security engineer is validating a boundary defense implementation and must confirm that the system enforces least privilege for inter-zone traffic. The design states that only approved services may cross from a lower-trust zone to a higher-trust zone. Which verification activity provides the strongest evidence that the enforcement point actually implements this policy?

An ISSE is evaluating a proposed architecture that uses a trusted computing base (TCB) to enforce security policy. The developer argues that because the TCB is small, it does not need to be evaluated against any protection profile. How should the ISSE respond?

When engineering a 'Secure Boot' sequence, what is the primary security objective?

You are verifying the implementation of a microsegmentation policy in a software-defined network (SDN). Which approach is most effective for validating that isolation is enforced?

A system is being designed to process PII. The requirement is to maintain data sovereignty while utilizing a hybrid cloud model. What architectural strategy best achieves this?

When designing an information system architecture, what is the primary role of a System Security Plan (SSP)?

An ISSEP is leading a system-level risk assessment for a new command-and-control (C2) system that will operate on a classified network. The program manager asks which activities are required to ensure the assessment supports a defensible authorization decision. (Choose two.)

You are verifying the security of a Linux server's SSH configuration. Which directive should be set to 'no' to prevent unauthorized remote root login?

During the security architecture review of a new identity management system, the ISSEP must choose an authentication protocol that supports native single sign-on across organizational boundaries and carries signed assertions about the user so relying parties can make authorization decisions without contacting the identity provider on every request. Which protocol best meets these requirements?

An ISSEP is establishing a risk management process for a new Engineered System that will process controlled unclassified information. The program office wants to ensure that risk decisions are defensible and repeatable across the system lifecycle. Which TWO activities are essential to achieving that outcome? (Choose two.)

An ISSEP must secure a server-to-server connection that currently uses plaintext LDAP. What is the recommended secure alternative?

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

You are an ISSEP for a defense contractor. The program uses a commercial cloud service to process controlled unclassified information (CUI). The government customer requires compliance with DFARS clause 252.204-7012 and NIST SP 800-171. The cloud provider offers a FedRAMP Moderate authorization. Which action must you take to ensure the cloud service meets the required security baseline?

A security engineer has completed implementation of a configuration management baseline on a fleet of Linux servers. Before accepting the system, the engineer must verify that the servers remain in the approved configuration over time. Which verification method best confirms ongoing adherence to the baseline?

A system uses a hardware-based root of trust (RoT) for verifying code execution. An attacker has managed to perform a 'fault injection' attack to bypass the verification. What is the most effective hardware-level defense?

Which TWO methods are effective for managing cryptographic keys in a cloud architecture?

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

An ISSEP is designing a secure architecture for a cloud environment using NIST SP 800-160. Which architectural pattern should the engineer prioritize to ensure the principle of Least Privilege is enforced at the service-to-service communication layer within a Kubernetes cluster?

An ISSEP is facilitating a risk assessment workshop for an Engineered System that controls a regional electrical substation. The system owner insists that the design is safe because every identified threat has an assigned countermeasure, and the residual risk register shows no entries above the organization's risk tolerance. Before the system can be accredited, the ISSEP must confirm that the risk management process has accounted for which of the following?

An ISSEP is leading a risk assessment for a system that will connect a tactical edge network to an enterprise enclave through a cross-domain solution. The Authorizing Official requires that the assessment identify the threats, vulnerabilities, and potential mission impacts before authorization. Which two activities are essential components of this system-level risk assessment? (Choose two.)

What is the primary function of an 'API Gateway' in a microservices security architecture?

You are the ISSE responsible for a change to an accredited system that will replace the cryptographic module used for data-at-rest encryption. The system is in the Operations phase and processes Controlled Unclassified Information. The change has been approved by the Configuration Control Board. Before implementation, which action BEST ensures the change does not invalidate the existing authorization?

You are engineering the disposal process for a system that stores Top Secret information on magnetic tape. The tapes are at end-of-life and will be transported to an offsite facility for destruction. Which combination of activities BEST ensures the media cannot be reconstructed and that the disposal is auditable?

An ISSEP is architecting a secure API environment. Which strategy is most effective for throttling and preventing resource exhaustion?

During a system security engineering review, an ISSEP discovers that a critical supplier's component firmware is updated automatically over the internet without cryptographic signature verification. The component is embedded in a system that processes Controlled Unclassified Information (CUI). Which risk treatment strategy should the ISSEP recommend FIRST?

During a security verification of a Linux server, you need to confirm that the implementation of mandatory access control (MAC) is enforcing the intended policy for a custom application. The server uses SELinux in enforcing mode. The application's binary is labeled with a custom type, and the policy includes allow rules for its required operations. However, the application is failing to write to a log directory. Which command should you use to verify whether SELinux is denying the write operation?

Which type of change is typically excluded from a formal Change Advisory Board review process?

An ISSEP is reviewing the security architecture of a system that uses a trusted platform module (TPM) for hardware root of trust. The system must ensure that the boot process is measured and that the integrity of the boot components can be verified remotely. Which TPM feature should be used to achieve this?

A security professional is verifying the implementation of MFA on an administrative account. What is the most reliable way to confirm the MFA configuration is working correctly?

You are an ISSEP working on a system that uses a service-oriented architecture. The system must enforce access control decisions based on multiple attributes, including user role, clearance level, and time of day. The policy is centrally managed and may change dynamically. Which access control model best fits these requirements?

What is the primary benefit of modularity in secure systems design?

An ISSEP is tasked with designing a security architecture for a system that must comply with the NIST RMF. During the architecture definition, the ISSEP needs to ensure that the system can be authorized to operate. Which activity should be performed to provide the necessary evidence for the authorization decision?

When designing for high availability and security, what is the best use of a Load Balancer (LB) from a security perspective?

Which TWO of the following statements are true regarding the relationship between the System Security Plan (SSP) and the Plan of Action and Milestones (POA&M)?

An ISSEP is reviewing the security architecture for a system that handles PII. The system uses a centralized database for PII storage. What is the primary risk associated with this design pattern?

An ISSE is reviewing the change management process for a system that processes law enforcement sensitive data. A proposed emergency change will modify the audit logging configuration to reduce log volume during a peak period. The change must be implemented within four hours. Which action best preserves the security posture while meeting the timeline?

What is the primary objective of a 'Security Design Review' early in the lifecycle?

What is the primary risk of a 'Privileged User' who lacks proper oversight?

A security engineer is validating that a new VPN concentrator correctly enforces the organization's remote access policy. The policy states that only members of the 'Remote Users' group may connect, that split tunneling is prohibited, and that all sessions must use AES-256 encryption. After configuring the device, the engineer needs to verify enforcement. Which action best validates that the policy is enforced as intended?

Which TWO of the following are common pitfalls when tailoring security controls in an RMF implementation?

An ISSEP is performing a risk assessment for a system that uses a common biometric authentication mechanism. The system owner wants to understand the risk of a false acceptance. Which metric should the ISSEP use to quantify this risk?

When validating a server's compliance with hardening guidelines, which tool provides the most efficient way to check OS configuration against the DISA STIG?

A security engineer is planning verification and validation activities for a new command-and-control system and must decide which techniques constitute dynamic verification rather than static analysis. Which two of the following are dynamic verification techniques? (Choose two.)

An ISSEP is reviewing the supply chain risk for a system that will embed a commercial off-the-shelf cryptographic module. The program requires assurance that the module's cryptographic functions were independently tested against a published standard and that the module's security features are documented against a recognized protection profile. Which artifact should the ISSEP require from the vendor?

When managing a security-sensitive change in a regulated environment, why is 'Separation of Duties' applied to the 'Build' and 'Deploy' roles?

An organization uses an HSM to store root CA keys. As part of the annual validation, which action must be performed to confirm the HSM's physical security posture?

You are developing a decommissioning plan for a system that processes sensitive data. The plan must address both data remanence and the removal of the system from the network. Which two actions are essential to include in the decommissioning plan to ensure secure disposal? (Choose two.)

An ISSEP is supporting a system that processes classified intelligence data and must be accredited under an Authority to Operate. The system owner proposes to accept a moderate risk involving unencrypted backup tapes stored in a commercial offsite facility, arguing that physical access controls at the facility are adequate. Which action should the ISSEP take?

An ISSEP is tasked with securing an internal web application. Which headers should be implemented to prevent clickjacking?

A security engineer is performing verification and validation of a new security architecture for a government network. The design documentation states that all data at rest must be encrypted with FIPS 140-3 validated modules. During validation, the engineer discovers that the database uses AES-256 encryption but the cryptographic module is not on the FIPS 140-3 validated list. Which action should the engineer take FIRST?

A systems security engineer must verify that a new boundary protection device is correctly enforcing the organization's approved information flow policy. The device is an application-layer gateway that inspects traffic between the corporate network and a partner extranet. Which verification activity provides the strongest evidence that the device enforces the intended flow control?

What is the primary objective of the 'Assessment' phase in the NIST RMF?

An ISSEP is evaluating a proposed change to a system that will introduce a new external interface for partner data exchange. The change is scheduled for next week, and the program manager wants to skip a formal risk assessment to meet the deadline. Which action should the ISSEP take?

An ISSEP is reviewing a cloud-based application that uses a multi-factor authentication (MFA) provider. The provider experiences an outage, and the system is configured to 'fail-open'. What is the security risk?

An ISSEP is reviewing the risk management plan for a system that has just completed its initial authorization. The system owner asks what activities are required to maintain the authorization over time. Which activity is the PRIMARY focus of continuous monitoring under the Risk Management Framework (RMF)?

Which THREE elements are required in a high-security access control policy?

When implementing FIPS 140-2/-3 validated cryptography in a system, what is the most important factor to verify?

An ISSEP is tasked with ensuring that a new information system complies with the organization's security requirements. The system will be deployed in a cloud environment and will process sensitive but unclassified data. The ISSEP must select an appropriate set of security controls and tailor them to the cloud deployment. Which NIST publication provides the security control catalog and guidance for tailoring controls?

When managing decommissioning of a cloud-native application, which document must be updated to reflect the removal of security controls?

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

An ISSEP professional is reviewing an architecture for compliance with NIST SP 800-160, Systems Security Engineering. Which THREE of the following activities are core to the 'Trustworthiness' objective for an engineered system?

A security engineer is validating the implementation of a network intrusion prevention system (IPS) in inline mode. The requirement is that the IPS must block malicious traffic without disrupting legitimate business traffic. Which validation test is MOST appropriate to verify this requirement?

Which of the following is an example of an 'Administrative' security control?

A security engineer is validating the implementation of a Security Information and Event Management (SIEM) system. The requirement is that all authentication events from critical servers must be logged and correlated. During validation, the engineer finds that some authentication events are missing from the SIEM. Which verification technique is MOST effective to identify the root cause?

An ISSEP is leading a risk assessment for an Industrial Control System (ICS) that controls a water treatment facility. The system uses legacy Programmable Logic Controllers (PLCs) that cannot be patched. The ISSEP must recommend compensating controls to reduce risk. Which TWO of the following are the MOST effective compensating controls for this scenario? (Choose two.)

What is the primary goal of the 'Authorization' phase in the NIST RMF?

An ISSEP is preparing the security engineering documentation for a new Department of Defense (DoD) information system that will process classified data. The program manager wants to know which document formally captures the security controls, their implementation details, and the system's authorization boundary, and is required to accompany the system through the Risk Management Framework (RMF) authorization process. Which document should the ISSEP identify?

An organization is adopting ISO 27001. Which document is required to justify the inclusion or exclusion of specific controls?

You are leading a verification and validation review for a newly deployed enterprise boundary protection system. Before accepting the system into operations, you must confirm that the implemented access control policy enforces the organization's approved flow matrix. Which verification activity most directly confirms that the system's enforcement mechanism matches the approved design baseline?

A system is undergoing accreditation. You need to verify that automated vulnerability scanning is occurring on a recurring basis. Which artifact provides the best evidence?

An ISSEP is designing a secure network architecture for a system that must support remote users accessing sensitive data. The system owner has mandated the use of a VPN to protect data in transit. The ISSEP must select a VPN protocol that provides confidentiality, integrity, and mutual authentication. Which protocol should the ISSEP choose?

During a system engineering project, an ISSEP discovers that a vendor-provided API lacks robust authentication. Which risk management strategy is best suited for this vulnerability when the API cannot be updated by the development team?

A security engineer must verify that a new database server's operating system configuration meets the organization's security baseline before it is placed into production. The baseline requires that all unnecessary services be disabled, that audit logging be enabled for authentication events, and that file permissions on sensitive configuration files be restricted. Which verification method provides the most reliable evidence that these controls are correctly implemented on the live system?

A legacy database must be decommissioned. You need to ensure the data is retrievable for 7 years for regulatory compliance. Which strategy is most secure?

A government agency is decommissioning a legacy identity management system that issued smart card credentials. The system's hardware security modules (HSMs) contain root certificate authority (CA) private keys, and the directory database holds user attributes. The decommissioning team must decide how to handle the HSM keys and the directory data. Which two actions are required to properly dispose of the CA key material and user data while preserving the ability to validate previously issued credentials? (Choose two.)

When designing a system for 'Non-repudiation', which technical control is essential?

An ISSEP is conducting a risk assessment for a system that will be hosted in a multi-tenant cloud environment. Which risk is unique to the multi-tenancy model?

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

An ISSE is leading the security design for a system that will process Controlled Unclassified Information (CUI). The system must comply with NIST SP 800-171. The ISSE needs to ensure that the design includes mechanisms to protect the confidentiality of CUI at rest and in transit. Which set of controls from SP 800-171 should the ISSE prioritize?

A security engineer is validating the implementation of a Network Intrusion Prevention System (NIPS) inline on a critical network segment. The requirement is that the NIPS must block malicious traffic while allowing legitimate business traffic. During testing, the engineer observes that the NIPS is alerting on malicious traffic but not dropping it. Which configuration should be verified first to ensure the NIPS is operating in blocking mode?

A program office is planning a new logistics system and the ISSE must determine which security engineering activities belong in the concept stage versus later stages. The chief engineer asks which activity should occur earliest, before any system requirements baseline is established. Which activity is most appropriate at that point?

You are configuring a CI/CD pipeline in GitLab to ensure security-critical changes are verified. Which mechanism ensures that only authorized engineers can merge changes to the master branch?

An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?

When validating a firewall's implementation, what does checking the 'Implicit Deny' rule verify?

During a security architecture review, an ISSE observes that the design separates the trusted computing base into distinct, isolated modules with explicit interfaces, and that no module can access another's internal data structures directly. Which design principle is primarily being applied to limit the propagation of a compromise?

An organization is retiring a legacy application that stores personal data. The decommissioning plan must address data retention, media sanitization, and the removal of the application from the authorization boundary. Which activity must be completed before the system is removed from the authorization boundary?

In a Zero Trust architecture, what is the most critical function of a Policy Decision Point (PDP)?

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

You are configuring a secure baseline for a server migration. Which NIST SP 800-53 control category covers 'System and Services Acquisition' regarding the maintenance of security-critical configurations?

A security engineer is validating the implementation of security controls for a facility that houses a government information system. The facility must comply with physical security requirements from NIST SP 800-53. The engineer needs to verify that access control mechanisms are properly implemented. Which TWO of the following are appropriate verification activities for physical access control? (Choose two.)

An ISSEP is establishing a continuous risk monitoring capability for an accredited system that processes sensitive data across multiple environments. The goal is to maintain an accurate risk picture between formal assessments. Which two activities are most essential to that capability? (Choose two.)

Which THREE of the following are necessary to successfully implement Zero Trust in an existing enterprise environment?

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

You are assessing an Engineered System for cloud-native vulnerabilities. Which THREE of the following are common misconfigurations in containerized environments that an ISSEP should identify?

When validating the security of a database implementation, how do you verify that sensitive data at rest is encrypted using Transparent Data Encryption (TDE)?

You are the ISSE reviewing a change management process for a system that supports a continuous authorization approach. The process must ensure that security-relevant changes are identified and handled appropriately. Which TWO activities are required to maintain the authorization when a security-relevant change occurs? (Choose two.)

Which THREE items should be included in a Post-Implementation Review (PIR) for a security change?

A security engineer is validating the implementation of a public key infrastructure (PKI) used for internal TLS. The validation must confirm that certificate issuance and revocation controls are working as designed. Which TWO of the following verification activities provide direct evidence that these controls are effective? (Choose two.)

An ISSE is defining the protection profile for a new multi-level secure system that must enforce the Bell-LaPadula model. The design team asks which rules must be enforced to prevent unauthorized disclosure of classified information. (Choose two.)

An ISSEP is designing a secure network architecture for a Department of Defense (DoD) system that must comply with the NIST Risk Management Framework (RMF) and DoD Instruction 8510.01. The system will use a demilitarized zone (DMZ) to host a public-facing web server. The ISSEP must ensure that the DMZ design follows the principle of least privilege and prevents direct access to the internal network. Which design approach best meets these requirements?

You are an ISSEP designing a cross-domain solution (CDS) that will allow data to flow from a low-assurance network to a high-assurance network. The security requirement is to ensure that only authorized data transfers occur and that the high side is protected from malicious content. Which architectural approach best meets this requirement?

Which THREE of the following are valid 'Authentication' factors?

An ISSEP is designing a cross-domain solution (CDS) to allow a high-assurance system to transfer data to a low-assurance system. The CDS must enforce data flow policies and prevent leakage of sensitive information. Which security engineering approach should the ISSEP implement to meet these requirements?

An ISSEP is assessing a system that uses an air-gapped network for processing highly sensitive data. The security team argues that because the network is air-gapped, risk from external threat actors is negligible and no further analysis is needed. Which response should the ISSEP provide?

During a verification review of a cryptographic implementation, the engineer must confirm that data at rest on a storage volume is protected with an approved algorithm and key length, and that the protection is genuinely active rather than merely provisioned. Which combination of activities best verifies the implemented state?

An ISSE is reviewing a system architecture where the design team plans to mitigate a spoofing threat to an external interface by adding a digital signature to each message. During the design review, the ISSE notes that the signing key is stored in plaintext in the same configuration file as the application. Which security engineering principle is most directly violated by this design decision?

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

You are designing the disposal process for a data center that hosts a multi-tenant cloud environment. The hardware includes NVMe SSDs and HDDs. Regulatory requirements mandate that data must be rendered unrecoverable even against laboratory attacks. Which combination of sanitization methods should you specify for the SSDs and HDDs respectively to meet the most stringent level?

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

An ISSEP is defining the security requirements for a new federal information system that will process Controlled Unclassified Information (CUI). The system owner mandates that the design must support continuous monitoring and near real-time risk determination. Which NIST publication should the ISSEP reference to implement the required continuous monitoring capabilities?

An ISSE is developing a security architecture for a new payroll processing system that handles PII and financial data. The system will be deployed on a private cloud and must comply with NIST SP 800-53 controls. The ISSE needs to ensure that the system's security requirements are traceable from initial stakeholder needs through design, implementation, and testing. Which systems security engineering activity best supports this traceability?

A systems security engineer is validating the implementation of security controls for a new federal information system. The system's security plan specifies that the organization will follow NIST RMF guidance and use NIST SP 800-53A for assessment. The engineer must verify that the implemented controls meet the stated security requirements. Which activity BEST represents the verification step in this context?

You are validating the security of a containerized environment (e.g., Docker). Which THREE of the following configurations should be checked for security compliance?

An ISSEP is performing a threat assessment for a mobile application. What is the biggest risk when using hardcoded API keys for third-party services within the app code?

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?

An ISSE is evaluating a commercial off-the-shelf (COTS) product for use in a system that processes classified information. The vendor claims the product is 'secure by design' but provides no formal evaluation. The ISSE must determine the level of assurance that can be placed in the product's security features. Which factor is most critical in assessing the product's assurance level?

You are assessing a system for compliance with FIPS 140-3. You need to ensure that the cryptographic module being used for TLS termination on a load balancer meets specific physical security requirements. Where should you look for the validation status of the cryptographic module?

A security engineer must validate that a cryptographic module used in a high-assurance system meets the organization's requirement for independently tested, tamper-resistant key protection. Which verification approach provides the most defensible evidence that the module satisfies this requirement?

A security engineer is verifying that a new web application's authentication mechanism meets the organization's requirement that all passwords must be transmitted and stored using strong cryptography. The application uses HTTPS for transport and stores password hashes in a database. During validation, the engineer inspects the database and finds that passwords are stored as unsalted SHA-256 hashes. Which validation finding is most accurate?

An ISSE is preparing a disposal plan for a system that has reached end of life. The system includes custom-developed software, commercial hardware, and interfaces to an external identity provider. Which TWO activities must be included in the disposal plan to address security and continuity obligations? (Choose two.)

An ISSEP is developing a security architecture for a system that will use a service-oriented architecture (SOA) with multiple web services. The system must ensure that messages are protected end-to-end and that services can verify the identity of the sender. Which TWO security standards or specifications should be incorporated into the architecture to meet these requirements? (Choose two.)

Which TWO aspects of a system's lifecycle must be documented in the decommission plan?

When disposing of SSDs that contain PII, why is traditional degaussing ineffective?

In the context of the NIST Risk Management Framework (RMF), which step involves the initial identification of security controls based on the system's impact level?

An ISSEP is reviewing the risk management framework for a defense program. The program uses a continuous monitoring strategy that includes automated vulnerability scanning and configuration compliance checks. A recent audit found that findings are being generated but not consistently reviewed or remediated within the program's defined timelines. Which action should the ISSEP recommend to address the ROOT cause?