49 questions · Systems Security Engineering Foundations topic · All types, answers revealed
When designing for 'System Survivability', what is the most critical engineering principle to incorporate?
Ensures the system continues to work at a base level under duress.
Why this answer
Graceful degradation ensures that the system maintains critical functionality even when non-critical components fail or are compromised.
Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?
This is the core activity of the Assess step.
Why this answer
The Assess step focuses on determining the effectiveness of the security controls implemented in the system.
When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?
Identifying components helps focus security controls where they are most needed.
Why this answer
System design involves defining architectural components, securing interfaces, and establishing trust boundaries.
In the context of the NIST Cybersecurity Framework, which function is specifically supported by the 'Systems Security Engineering' process during the 'Identify' stage?
Systems engineering provides the data necessary to perform accurate risk assessments.
Why this answer
Systems Engineering identifies assets and risks, which aligns with the 'Identify' function in the NIST CSF.
Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?
This principle mandates that security resides in the keys, not the design.
Why this answer
Kerckhoffs's Principle (or Shannon's Maxim) states that a system should be secure even if everything about it is known, except for the keys.
Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?
This shows where the requirement is implemented.
Why this answer
An SRTM maps requirements to design elements and test cases to ensure no security requirement is overlooked.
When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?
Security must be maintained even during transitions.
Why this answer
Fail-over mechanisms often create race conditions or temporary bypasses that attackers can exploit to gain unauthorized access.
Which THREE of the following are considered 'Common Criteria' (ISO/IEC 15408) elements for evaluating the security functionality of a product?
The PP defines the security requirements for a category of products.
Why this answer
Common Criteria uses Protection Profiles and Security Targets to define and evaluate security requirements.
You are performing an audit of a new system's 'Trusted Computing Base' (TCB). Which observation would indicate a violation of the 'Separation of Duties' principle?
This is a direct violation of separation of duties.
Why this answer
Separation of Duties ensures that no single individual has the authority to perform all steps of a critical security task.
Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?
These reports provide independent validation of CSP security.
Why this answer
Assessing a CSP involves reviewing their security certifications, physical controls, and logical security isolation capabilities.
Which THREE items should be included in a thorough 'System Security Plan' (SSP)?
Defining the boundary is essential for scoping security.
Why this answer
An SSP describes the system, its security boundaries, the controls applied, and the risk management strategy.
An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?
SAST tools are designed to scan source code during the build process.
Why this answer
Static Application Security Testing (SAST) tools analyze source code for security vulnerabilities without executing the code, making them ideal for the build stage.
What is the primary advantage of 'Defense in Depth'?
The core strength is resiliency via layering.
Why this answer
Defense in depth ensures that if one control fails, others are present to stop an attacker, creating a more robust overall system.
When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?
Tampering involves unauthorized modification, violating data integrity.
Why this answer
Tampering threats target the Integrity aspect of the CIA triad by attempting to modify data or system configurations.
Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?
Developers must own the security of the code they write.
Why this answer
An SDL integrates security into every phase of development: planning, design, implementation, testing, and release.
Which engineering document should be created during the early stages of the system lifecycle to define the security-relevant mission goals and constraints?
The SSP is the primary document detailing security implementation and goals.
Why this answer
The System Security Plan (SSP) or an equivalent Concept of Operations for Security (SecConOps) defines the security mission and constraints at the start.
When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?
SBOMs are critical for identifying vulnerable upstream dependencies.
Why this answer
Software Bill of Materials (SBOM) allows organizations to track and manage the components in their software, facilitating the identification of vulnerable third-party dependencies.
When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?
Load balancers protect against overloading and improve availability.
Why this answer
Load balancers distribute traffic, preventing any single instance from being overwhelmed (a form of DoS mitigation) and allowing for maintenance without downtime.
When designing a system for 'High Integrity' (using the Biba model), which THREE rules must be enforced?
This prevents reading less-trusted information.
Why this answer
Biba is the dual of Bell-LaPadula: No Read Down (integrity) and No Write Up (integrity).
Which THREE factors must be evaluated when determining if a system component is 'security-critical'?
Components handling sensitive info require higher security assurance.
Why this answer
Security-critical components are those that enforce policy, handle sensitive data, or provide security functions.
Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?
Changes can inadvertently weaken security controls.
Why this answer
Impact analysis evaluates how changes affect existing controls, risk profiles, and system integrity.
Which TWO architectural patterns are considered best practices for securing cloud-native applications?
Zero-trust assumes no network is inherently safe.
Why this answer
Cloud security relies on zero-trust and defense-in-depth principles implemented through infrastructure-as-code and micro-segmentation.
Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?
These define the mandatory and consistent actions.
Why this answer
Policies must define the 'what' (High-level), the 'how' (Standards/Procedures), and the 'how-to' (Guidelines).
When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?
Standard algorithms are vetted by the global community; custom ones are not.
Why this answer
Custom cryptography is prone to subtle implementation errors that are difficult to detect and often break the security of the underlying algorithm.
In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?
Enforcing means the system will not allow operations that violate policy.
Why this answer
A security-enforcing component is one that actively mandates security policies, such as a reference monitor or a gatekeeper.
When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?
Layering is the core concept of defense in depth.
Why this answer
Defense in depth relies on layering security controls so that a single failure does not result in a total system compromise.
When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?
TCB components must be small enough to be analyzed and verified for correctness.
Why this answer
The TCB is the set of all hardware, software, and firmware components that are critical to the security of the system; it must be verifiable and correct.
Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?
Git tracks changes and ensures history is preserved.
Why this answer
Documentation must be version-controlled and subject to strict change management to remain accurate.
In the systems engineering V-model, how does 'Verification' differ from 'Validation'?
Verification checks the 'build-to' specs, validation checks the 'fit-for-purpose' aspect.
Why this answer
Verification ensures the system is built correctly (conformance to requirements), while validation ensures the correct system is built (meeting user needs).
Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?
Immediate detection minimizes the blast radius.
Why this answer
Continuous monitoring relies on real-time data, automated alerting, and periodic reporting to maintain a security posture.
When engineering a 'Secure Boot' sequence, what is the primary security objective?
This prevents untrusted or malicious software from starting.
Why this answer
Secure Boot ensures that every piece of software loaded during the boot process is digitally signed by a trusted entity, preventing rootkits from loading early.
In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?
Baselines are standardized sets of controls for specific system types.
Why this answer
A baseline establishes the minimum set of security controls required to protect the system based on its impact level.
Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?
Bell-LaPadula enforces confidentiality rules.
Why this answer
The Bell-LaPadula model focuses on confidentiality by enforcing the 'no read up, no write down' rules.
What is the primary function of an 'API Gateway' in a microservices security architecture?
These are key security and management functions of an API gateway.
Why this answer
An API Gateway acts as a single entry point that handles authentication, rate limiting, and request routing for microservices.
What is the primary benefit of modularity in secure systems design?
Smaller, independent parts are easier to audit and secure.
Why this answer
Modularity allows for fault isolation and easier security verification of individual components.
What is the primary objective of a 'Security Design Review' early in the lifecycle?
Early detection reduces development costs and risk.
Why this answer
A design review aims to identify security flaws before they are implemented, as it is much cheaper to fix them in the design phase than during production.
What is the primary risk of a 'Privileged User' who lacks proper oversight?
High access levels require checks and balances.
Why this answer
Privileged users have significant access, so without oversight (separation of duties/auditing), they can perform malicious actions or make catastrophic errors.
You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?
Requirements analysis is the foundational stage where security constraints and functional needs are mapped to system goals.
Why this answer
Security requirements must be defined during the Requirements Analysis phase to ensure they are baked into the system design rather than added as an afterthought.
Which of the following is an example of an 'Administrative' security control?
Policies and plans are administrative controls.
Why this answer
Administrative controls focus on policies, procedures, and guidelines, such as an incident response plan.
When designing a system for 'Non-repudiation', which technical control is essential?
Signatures provide cryptographic proof of origin.
Why this answer
Digital signatures using public-key cryptography ensure that a message or transaction can be linked to a specific user and not disavowed.
What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?
The primary goal is preventing unauthorized data access.
Why this answer
Sanitization is the process of removing data from storage media such that the data cannot be reconstructed by any forensic means.
An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?
Segmentation isolates traffic and limits lateral movement.
Why this answer
Network segmentation and compartmentalization are essential for preventing lateral movement.
When integrating security into the requirements phase, what is the value of 'Misuse Cases'?
Misuse cases simulate attacker behavior to identify defensive needs.
Why this answer
Misuse cases define what a malicious actor might try to do to the system, helping to derive security requirements.
During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?
Once the secret design is found, the protection vanishes.
Why this answer
Obscurity is not a reliable control; if the design is discovered (which it eventually will be), the system has no remaining security.
Which THREE of the following are valid 'Authentication' factors?
Biometric authentication is a standard factor.
Why this answer
Authentication factors fall into categories: something you know, something you have, and something you are.
During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?
Compensating controls provide necessary security when native support is missing.
Why this answer
The ISSE should perform a gap analysis to determine if a compensating control can mitigate the risk until the legacy system can be upgraded or replaced.
In the context of the 'Common Criteria', what is the role of the 'Security Target'?
The ST documents what the product claims to do security-wise.
Why this answer
The Security Target (ST) defines the security requirements and claims for a specific IT product, which are then evaluated against a Protection Profile.
When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?
Hashing detects changes; secure storage prevents deletion.
Why this answer
Logs must be protected from tampering; hashing and secure remote storage are standard methods to ensure they remain trustworthy.
When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?
ABAC allows for fine-grained policy definition required for Least Privilege.
Why this answer
Attribute-Based Access Control (ABAC) provides granular control based on user, environment, and resource attributes, ideal for complex microservice environments.
Ready to test yourself?
Try a timed practice session using only Systems Security Engineering Foundations questions.