Apply System Security Principles ISSEP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary goal of software assurance?

   • ATo provide confidence that software is secure, reliable, and resilient throughout its lifecycle
   • BTo ensure software runs only on specific hardware
   • CTo make software as complex as possible to deter attackers
   • DTo ensure software is free of all bugs
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   A firewall fails and enters a state where it allows all traffic to pass. What is this failure mode called?

   • AFail secure
   • BFail open
   • CFail closed
   • DFail safe
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary goal of the principle of least privilege?

   • ATo give all users the same level of access for simplicity
   • BTo give users the minimum permissions necessary to perform their job functions
   • CTo grant permissions based on seniority
   • DTo ensure users have administrative rights to avoid help desk calls
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A mid-sized company is deploying a new customer relationship management (CRM) system. The system has three types of users: sales representatives (can view and edit their own leads), sales managers (can view and edit all leads in their team), and administrators (manage user accounts and system configuration). The company wants to enforce separation of duties so that no single user can both create a new user account and assign that account elevated privileges. Which configuration best achieves this?

   • ALet administrators create accounts and assign roles, but require a second administrator to approve the role assignment.
   • BAllow administrators to create user accounts and assign any role, including sales manager.
   • CAllow sales managers to create user accounts for their team members.
   • DCreate two administrator roles: one that can create user accounts and another that can assign roles, and ensure no user holds both roles.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which activity is a core software assurance practice?

   • APerforming security code reviews and static analysis
   • BDeploying software without testing to save time
   • CUsing only proprietary software to avoid open-source vulnerabilities
   • DDisabling security features to improve performance
   Reveal Solution Discussion Select an answer first