Systems Security Engineering Foundations

When designing for 'System Survivability', what is the most critical engineering principle to incorporate?

Which THREE activities are included in the 'Risk Management Framework' (RMF) step 'Assess'?

When applying NIST SP 800-160 Systems Security Engineering principles, which THREE activities are critical during the 'System Design' phase to ensure confidentiality and integrity?

In the context of the NIST Cybersecurity Framework, which function is specifically supported by the 'Systems Security Engineering' process during the 'Identify' stage?

Which principle suggests that the security of a system should not depend on the secrecy of its design or implementation?

Which TWO items should be included in a 'Security Requirements Traceability Matrix' (SRTM) to ensure comprehensive engineering coverage?

When designing high-availability systems, what is the primary security engineering concern regarding 'Fail-over' mechanisms?

Which THREE of the following are considered 'Common Criteria' (ISO/IEC 15408) elements for evaluating the security functionality of a product?

You are performing an audit of a new system's 'Trusted Computing Base' (TCB). Which observation would indicate a violation of the 'Separation of Duties' principle?

Which THREE security-relevant criteria should be assessed when evaluating a cloud service provider (CSP)?

Which THREE items should be included in a thorough 'System Security Plan' (SSP)?

An organization is adopting a DevSecOps model. To ensure security engineering principles are met, which tool should be integrated into the CI/CD pipeline to automate the detection of vulnerabilities in proprietary code during the 'Build' stage?

What is the primary advantage of 'Defense in Depth'?

When using the STRIDE threat modeling methodology, which security principle does 'Tampering' specifically attempt to violate?

Which THREE are key components of a 'Secure Development Lifecycle' (SDL) process?

Which engineering document should be created during the early stages of the system lifecycle to define the security-relevant mission goals and constraints?

When evaluating a system's resilience to 'Supply Chain Attacks', what is the most important engineering practice to implement?

When considering 'System Availability', what is the primary advantage of a 'Load Balancer' in a security engineering context?

When designing a system for 'High Integrity' (using the Biba model), which THREE rules must be enforced?

Which THREE factors must be evaluated when determining if a system component is 'security-critical'?

Which THREE activities are essential when conducting a 'Security Impact Analysis' for a proposed system change?

Which TWO architectural patterns are considered best practices for securing cloud-native applications?

Which THREE components are necessary to define a complete 'Security Policy' for an enterprise system?

When engineering a cryptographically secure system, what is the primary risk associated with custom cryptographic implementations?

In the context of 'Systems Engineering', what does the term 'Security-Enforcing' mean regarding a system component?

When designing a secure system architecture, which TWO of the following are primary considerations for achieving the principle of 'Defense in Depth'?

When conducting a security assessment of a system's 'Trusted Computing Base' (TCB), what is the most important attribute to verify?

Which TWO of the following are valid methods for maintaining the integrity of system design documentation throughout the system lifecycle?

In the systems engineering V-model, how does 'Verification' differ from 'Validation'?

Which THREE factors are critical for an effective 'Continuous Monitoring' (ConMon) program?

When engineering a 'Secure Boot' sequence, what is the primary security objective?

In the context of the System Development Life Cycle (SDLC), what is the primary purpose of a security control baseline?

Which security model is specifically designed to prevent the unauthorized flow of information from high-security levels to low-security levels (no read up, no write down)?

What is the primary function of an 'API Gateway' in a microservices security architecture?

What is the primary benefit of modularity in secure systems design?

What is the primary objective of a 'Security Design Review' early in the lifecycle?

What is the primary risk of a 'Privileged User' who lacks proper oversight?

You are integrating security requirements into the Systems Engineering V-Model. At which stage should the Information Systems Security Engineer (ISSE) define the security functional requirements to ensure traceability to the system architecture?

Which of the following is an example of an 'Administrative' security control?

When designing a system for 'Non-repudiation', which technical control is essential?

What is the primary purpose of a 'Sanitization' process in the context of system decommissioning?

An ISSE is defining the 'Security Architecture' for an enterprise network. Which concept should be prioritized to ensure that an attacker who gains access to one segment cannot easily pivot to others?

When integrating security into the requirements phase, what is the value of 'Misuse Cases'?

During a 'Design Review', an ISSE notices that the system architecture relies on 'Security through Obscurity'. Why is this considered an engineering flaw?

Which THREE of the following are valid 'Authentication' factors?

During the 'Engineering Process Integration' phase, an ISSE identifies that the legacy system lacks support for modern TLS 1.3 encryption. What is the most appropriate engineering response?

In the context of the 'Common Criteria', what is the role of the 'Security Target'?

When configuring a 'Logging and Auditing' system, what is the most important consideration for 'Log Integrity'?

When applying the principle of Least Privilege, which technical implementation is most effective in a microservices architecture?