Apply System Security Principles ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a system architecture, what is a single point of failure (SPOF)?

   • AA component whose failure would cause the entire system to fail
   • BA component that is shared by multiple users
   • CA component that is more likely to fail than others
   • DA component that is not monitored
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A software development team is building a new web application. The team wants to ensure the software is secure throughout its lifecycle. Which practice best supports software assurance?

   • AUse a third-party penetration test once the application is deployed.
   • BConduct regular security training for developers and perform code reviews and automated security testing during development.
   • CRely on the QA team to test for security issues after the application is built.
   • DPerform a single security review just before the final release.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which security model explicitly assumes that a breach has already occurred and requires verification of every access request regardless of network location?

   • ADefense-in-depth
   • BZero Trust
   • CLayered security
   • DSecure-by-default
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An e-commerce company runs its web application on two virtual machines in the same availability zone. Each VM runs the same application code and connects to the same database. The company wants to improve availability in case of a regional outage. Which change provides the most significant improvement?

   • APut the database in read-only mode to reduce the load on the VMs.
   • BIncrease the size of the existing VMs to handle more load.
   • CAdd a third VM in the same availability zone to handle more traffic.
   • DDeploy the application to a second availability zone and configure load balancing across both zones.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A software development team is designing an access-control module for a new application. One developer proposes a custom encryption algorithm and a complex rule engine to determine access. Another developer suggests using a well-established open-source access-control library with a simple configuration file. The security architect must decide which approach to recommend. Which choice best aligns with the economy of mechanism principle?

   • AUse the custom encryption algorithm because it is unique to the organization and harder for attackers to predict.
   • BUse both the custom algorithm and the open-source library to provide defense in depth.
   • CUse the custom rule engine because it provides more granular control over access decisions.
   • DUse the open-source library with a simple configuration because it is smaller, well-tested, and easier to audit.
   Reveal Solution Discussion Select an answer first