3.1 - Research, Implement and Manage Engineering Processes Using Secure Design Principles CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is an example of segregation of duties?

   • AOne employee is responsible for all aspects of the payroll process
   • BOne employee is responsible for both creating and approving vendor invoices
   • COne employee has full administrative access to all financial systems
   • DOne employee creates vendor invoices and another employee approves payments
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large enterprise is redesigning its payment processing system. The system will handle credit card transactions and must comply with PCI DSS. The security team is conducting a threat model. They have identified the following assets: cardholder data, the payment application, and the database. They have also identified the following threats: SQL injection, insider theft, and malware on the application server. The team must prioritize threats based on risk. Which threat should be addressed FIRST?

   • ASQL injection, because it is a well-known attack vector that could lead to data breach.
   • BThe team should prioritize based on a risk assessment that considers the likelihood and impact of each threat, along with existing controls.
   • CInsider theft, because insiders have legitimate access to cardholder data and can bypass technical controls.
   • DMalware on the application server, because it can compromise the entire system and exfiltrate data.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a direct benefit of implementing least privilege?

   • AEliminates the need for monitoring user activity
   • BGuarantees that no insider threats will occur
   • CReduces the potential damage from a compromised account or process
   • DEnsures that all users have equal access to system resources
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is adopting a zero trust security model. They want to ensure that every access request to their internal applications is verified, regardless of whether the user is on the corporate network or remote. Which control is MOST essential to implement this model?

   • ARequire multi-factor authentication for every access request, and continuously validate the user's identity and device posture.
   • BImplement a virtual private network (VPN) for all remote users to access the internal network.
   • CUse a firewall to block all traffic from untrusted networks.
   • DGrant all users the same level of access to internal applications to simplify management.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is designing a new IoT device that will be deployed in customers' homes. The device will collect sensor data and send it to the cloud. The security team is concerned about the device's attack surface. Which design choice BEST aligns with the principle of 'keep it simple and small'?

   • AUse a complex operating system with many features to support future functionality.
   • BInclude only the necessary features and services on the device, and disable all unused ports and protocols.
   • CAllow remote access to the device via SSH for troubleshooting purposes.
   • DInclude a web server on the device to allow users to configure it easily.
   Reveal Solution Discussion Select an answer first