In systems security engineering, what is the primary purpose of defining a trust boundary?

To list all the security assumptions made by the system architect

To establish a clear demarcation between components that are trusted and those that are not

To specify the level of trust granted to each user role in the system

To identify the physical location of all hardware components within the system

A security architect is designing a new system that will be accessed by both internal employees and external partners. The architect wants to apply the principle of least privilege. Which of the following is the most appropriate way to implement least privilege?

Grant all users the same level of access to simplify administration.

Grant users access based on their job title, regardless of their specific job functions.

Grant users access based on the sensitivity of the data they need to access, but do not consider their job functions.

Grant each user the minimum level of access necessary to perform their job functions.

A defense contractor is designing a new weapons system that will process classified data. The system will have multiple components, including a user interface, a processing unit, and a data store. The security team is defining trust boundaries and applying the principle of least privilege. Which of the following is the most appropriate way to establish trust boundaries and enforce least privilege?

Define trust boundaries based on the sensitivity of the data, and grant all components within a boundary the same level of access.

Define separate trust boundaries for each component and enforce least privilege by granting each component only the permissions necessary for its function.

Place all components in a single trust boundary and rely on perimeter defenses to protect the system.

Establish a single trust boundary around the entire system and use encryption to protect data at rest and in transit.

A security architect is designing a system that uses a public key infrastructure (PKI) to establish trust among components. The architect wants to ensure that the trust hierarchy is properly established. Which of the following is the most appropriate way to establish the trust hierarchy?

Use a hierarchical CA structure with a root CA at the top, intermediate CAs, and leaf certificates for components.

Use a single CA but have each component trust the CA directly, with no intermediate CAs.

Use a single certificate authority (CA) to issue certificates to all components, and have all components trust that CA.

Use a web of trust model where all components trust each other directly.

What is the primary purpose of the defense in depth principle?

To focus security efforts on the perimeter only

To use multiple layers of security controls to protect assets

To ensure that all users have the same level of access

To reduce the number of security controls to minimize complexity

Information Systems Security Engineering Professional

Domain 1Objective 1

Apply Systems Security Engineering Fundamentals ISSEP Practice Questions (Page 2)

Part of the Systems Security Engineering Foundations domain, which accounts for 24% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 3–5 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

8concepts

24%of the exam

8 Concepts in This Objective

Trust concepts in systems security engineering
Trust hierarchies
Relationship between systems engineering and security engineering
Security engineering process inputs and outputs
NIST systems security engineering framework
ISO/IEC 27001 security management principles
Structural security design principles
Integrating security into system architecture

Questions 6–10

6foundation · easy
In systems security engineering, what is the primary purpose of defining a trust boundary?
Select an answer first
7application · medium
A security architect is designing a new system that will be accessed by both internal employees and external partners. The architect wants to apply the principle of least privilege. Which of the following is the most appropriate way to implement least privilege?
Select an answer first
8application · medium
A defense contractor is designing a new weapons system that will process classified data. The system will have multiple components, including a user interface, a processing unit, and a data store. The security team is defining trust boundaries and applying the principle of least privilege. Which of the following is the most appropriate way to establish trust boundaries and enforce least privilege?
Select an answer first
9application · medium
A security architect is designing a system that uses a public key infrastructure (PKI) to establish trust among components. The architect wants to ensure that the trust hierarchy is properly established. Which of the following is the most appropriate way to establish the trust hierarchy?
Select an answer first
10foundation · easy
What is the primary purpose of the defense in depth principle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.