Apply System Security Principles ISSEP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A financial services company is deploying a new payment-processing application. The application runs as a single service that both reads customer account data and initiates fund transfers. The security team is concerned about the risk of a compromised service being able to perform both operations. Which approach best reduces the risk while maintaining operational efficiency?

   • ARun the application with a service account that has read-only access to customer data and separate write access to the transfer system.
   • BKeep the single service but require two-factor authentication for all API calls.
   • CSplit the application into two separate services: one that reads customer data and another that initiates transfers, each with its own least-privilege credentials.
   • DGrant the service account full access to both systems but log all actions for auditing.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   How does automation improve security operations?

   • AIt eliminates the need for human security analysts
   • BIt guarantees that all security incidents are prevented
   • CIt reduces response times and handles repetitive tasks consistently
   • DIt increases the number of manual steps in incident response
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A global financial institution operates a real-time trading platform. The platform is deployed across two data centers in different geographic regions. Each data center runs the full application stack, and traffic is load-balanced between them. The platform uses a single-vendor hardware security module (HSM) for cryptographic key operations. A recent firmware vulnerability in that HSM model was disclosed, and the vendor has not yet released a patch. The institution is concerned about a single point of failure and wants to reduce risk. Which action best addresses the concern?

   • AReplace the HSMs in both data centers with a different vendor's HSM model.
   • BWait for the vendor to release a patch and apply it as soon as it is available.
   • CDisable the HSM and use software-based cryptography instead.
   • DMove all cryptographic operations to a single data center to simplify management.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What does the principle of economy of mechanism advocate in security design?

   • AKeeping security mechanisms as simple and small as possible
   • BUsing multiple security mechanisms for each function
   • CUsing complex security mechanisms to deter attackers
   • DDesigning security mechanisms that are expensive to implement
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A software company is adopting a SecDevOps approach to improve the security of its continuous integration/continuous deployment (CI/CD) pipeline. The team wants to automatically block a build if a critical vulnerability is found in a new dependency. Which practice best supports this goal?

   • AScan the dependency manually once a month and document the results in a spreadsheet.
   • BAllow the build to pass but create a ticket for the security team to review the dependency later.
   • CRun a vulnerability scan on the dependency and fail the build if a critical finding is detected.
   • DDisable the vulnerability scanner to avoid slowing down the build process.
   Reveal Solution Discussion Select an answer first