3.1 - Research, Implement and Manage Engineering Processes Using Secure Design Principles CISSP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   During threat modeling, which of the following is a key input used to identify potential threats?

   • AThe organization's marketing strategy and target customer demographics
   • BThe list of approved software vendors for the organization
   • CThe system's architecture and data flow diagrams
   • DThe organization's hiring policies and procedures
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of implementing secure defaults?

   • AA new application requires a strong password and multi-factor authentication to be configured before first use
   • BA new application disables all logging to improve performance
   • CA new application uses default passwords that are easy to remember
   • DA new application allows anonymous access until the administrator creates user accounts
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A financial institution is implementing a new wire transfer system. The system will allow employees to initiate and approve wire transfers. The company wants to prevent fraud and errors. The security architect is designing the workflow. Which workflow BEST implements segregation of duties?

   • AOne employee initiates the wire transfer, and a different employee approves it. The approver must have a higher level of authority.
   • BThe system automatically approves all wire transfers under a certain amount, and a manager approves larger transfers.
   • CThe same employee can initiate and approve a wire transfer, but a second employee must review the transaction after it is completed.
   • DAny employee can initiate and approve a wire transfer, but the system logs all transactions for audit.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of defense in depth?

   • ATo ensure that all security controls are managed by the same vendor
   • BTo rely on a single, strong security control for all protection
   • CTo implement multiple layers of security controls so that if one fails, others still protect the asset
   • DTo make security controls invisible to users to avoid disruption
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company is implementing a new enterprise resource planning (ERP) system. The system will handle financial transactions and sensitive employee data. The security architect is designing the access control model. The company has a small IT team, and the same administrator currently manages both user accounts and financial data. The company wants to reduce the risk of fraud and errors. Which approach BEST balances least privilege and segregation of duties?

   • ASeparate the roles of user account management and financial data management, and grant each role only the permissions necessary for their function.
   • BGrant the administrator full access to the ERP system, but require a second administrator to review all changes.
   • CGrant all users the same level of access to the ERP system to simplify management.
   • DUse a single administrator account for all administrative tasks, but require multi-factor authentication.
   Reveal Solution Discussion Select an answer first