Apply Systems Security Engineering Fundamentals ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial institution is implementing a new online banking platform. The architecture includes a web server, an application server, and a database server. The security architect wants to establish a trust hierarchy to ensure that the web server cannot directly access the database. Which of the following best describes the trust hierarchy in this architecture?

   • AThe web server is at a lower trust level than the application server, which is at a lower trust level than the database server.
   • BThe database server is at a higher trust level than the web server, but the application server is at the same trust level as the web server.
   • CAll components are in the same trust domain, and access control lists are used to restrict communication.
   • DThe web server, application server, and database server are all at the same trust level, but the database server is protected by a firewall.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes a trust assumption in systems security engineering?

   • AA documented belief that a component will behave in a certain way without proof
   • BA security control that is implemented at the system boundary
   • CA level of trust assigned to a user after authentication
   • DA verified fact about the system's security posture
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A government agency is adopting the NIST systems security engineering framework (SP 800-160) to structure its security engineering activities. The agency wants to ensure that security is integrated into the system development lifecycle. Which of the following is the most appropriate way to apply the framework?

   • AUse the framework to create a standalone security plan that is separate from the systems engineering plan.
   • BApply the framework as a set of security activities that are performed in parallel with systems engineering activities, using the framework's processes and tasks to guide the integration.
   • CApply the framework only during the design phase to ensure that security is incorporated into the system architecture.
   • DUse the framework to define security requirements and then hand them off to the systems engineering team for implementation.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a trust hierarchy, what is the primary role of a root of trust?

   • ATo act as a backup for the primary authentication server
   • BTo enforce the principle of least privilege across the system
   • CTo provide a list of all trusted users in the system
   • DTo serve as the highest-level entity from which trust is derived for other components
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security engineer is documenting the inputs and outputs of the security engineering process for a new system. The engineer is preparing to present the security engineering artifacts to the systems engineering team. Which of the following is a key input to the security engineering process?

   • AThe system's operational procedures and maintenance plans.
   • BThe system's security test results and vulnerability scan reports.
   • CThe system's security architecture and design specifications.
   • DThe system's functional requirements and design constraints.
   Reveal Solution Discussion Select an answer first