Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A government agency is developing a new system for processing citizen benefits. The system must comply with federal information security standards. The agency has developed a set of security requirements, including that all access to the system must be logged and that the system must be able to detect and respond to unauthorized access. The project is nearing the end of the development phase. The systems security engineer is tasked with developing a validation plan. What is the primary purpose of this validation plan?

   • ATo assign roles and responsibilities for the system's operation.
   • BTo estimate the cost of the system's security controls.
   • CTo document the system's design and architecture for future maintenance.
   • DTo verify that the implemented security controls meet the specified security requirements.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A defense contractor is developing a new secure messaging system for a government client. The system must handle classified information, and the client has mandated that all data be stored on-premises. The contractor has identified the program manager, the security officer, and the end users as stakeholders. However, during a design review, the security officer raises a concern that the system must also comply with export control regulations, which were not previously considered. What is the most appropriate action for the systems security engineer to take?

   • AProceed with the current design, as the client's on-premises mandate already covers all security requirements.
   • BDocument the export control requirement as a new constraint and update the stakeholder list to include the export control compliance officer.
   • CAsk the security officer to personally ensure export control compliance without documenting it, to avoid delaying the project.
   • DAdd the export control requirement to the validation plan but do not change the stakeholder list, as the security officer can represent all compliance needs.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   During the initial phase of a security engineering project, the team is compiling a list of parties who will be affected by or have an interest in the system's security posture. Which activity is being performed?

   • AConstraint identification
   • BRole definition
   • CRequirements elicitation
   • DStakeholder identification
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A software company is developing a new cloud-based collaboration tool. The company's threat model assumes that the primary threat is external attackers attempting to gain unauthorized access. The system will be used by employees and external contractors. The security team has implemented strong authentication and encryption. However, during a design review, a security engineer points out that the threat model does not account for insider threats, such as a contractor exfiltrating data. The project manager is concerned that expanding the threat model will delay the project. What is the most appropriate action?

   • AAdd insider threats to the validation plan but do not change the threat model.
   • BAssume that the existing authentication and encryption controls are sufficient to mitigate insider threats.
   • CKeep the original threat model, as it was approved by stakeholders and changing it would delay the project.
   • DUpdate the threat model to include insider threats, and document the assumption that external attacks are the primary threat but not the only one.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of a constraint that could impact security architecture?

   • AA defined role for the system owner
   • BA stakeholder's preference for a specific vendor
   • CA regulatory requirement to encrypt data at rest
   • DAn assumption that users will follow password policies
   Reveal Solution Discussion Select an answer first