Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of role definition in security planning?

   • AAssigning a specific penetration test to the security team
   • BIdentifying regulatory constraints on data storage
   • CConducting interviews to gather security requirements
   • DDocumenting that the system owner is responsible for overall system security
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A defense contractor is developing a new system for a military client. The client has specified that the system must be able to operate in a disconnected environment for extended periods. The contractor's security team has proposed implementing a public key infrastructure (PKI) for authentication. However, the PKI requires access to a certificate authority (CA) to validate certificates, which may not be available in a disconnected environment. The project manager is concerned about the feasibility of the PKI approach. What is the most appropriate way to address this conflict?

   • AImplement PKI but plan to validate certificates only during periodic reconnection windows.
   • BAsk the client to relax the disconnected operation requirement to allow for PKI.
   • CDocument the constraint and explore alternative authentication methods that can operate offline, such as pre-shared keys or smart cards with embedded certificates.
   • DProceed with the PKI approach and assume that the CA will be available when needed.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   Which of the following best describes the purpose of stakeholder identification in security engineering?

   • ATo select validation methods for security controls
   • BTo ensure all parties with an interest in or affected by the system's security are considered
   • CTo document assumptions about the operational environment
   • DTo assign security tasks to specific individuals
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A software startup is developing a new mobile payment application. The company's threat model assumes that the primary threat is malware on users' devices. The security team has implemented app sandboxing and code signing. However, the team has not documented the assumption that users will keep their devices updated with the latest security patches. During a security review, a team member points out that this assumption may not hold for all users. What is the most appropriate action?

   • AAdd a validation plan to test the app on outdated devices, but do not document the assumption.
   • BRemove the assumption from the threat model, as it is not relevant to the app's security.
   • CDocument the assumption and include a requirement that the app checks for device security updates and warns users if they are outdated.
   • DAssume that all users will have updated devices, and proceed without additional controls.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A manufacturing company is deploying a new industrial control system (ICS). The plant manager is the system owner. The IT security team is responsible for network security, and the OT (operational technology) team is responsible for the ICS itself. The company has a policy that all security incidents must be reported to the CISO within one hour. During a planning meeting, the systems security engineer must ensure that incident response responsibilities are clearly assigned. What is the most effective way to assign these responsibilities?

   • ADo not assign specific roles until an incident occurs, to allow for flexibility in response.
   • BDefine a single incident response lead from the OT team, with the IT security team providing support, and document the escalation path to the CISO.
   • CMake the plant manager personally responsible for all incident response actions.
   • DAssign incident response to the IT security team exclusively, since they have the most security expertise.
   Reveal Solution Discussion Select an answer first