Create System Security Design ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A team is designing a secure file transfer system for a government agency. The system-level function 'protect data during transfer' is decomposed into sub-functions: encryption, authentication, and integrity checking. During allocation, the team assigns encryption to the network encryptor, authentication to the user directory, and integrity checking to the file server. Which additional action is necessary to ensure complete functional allocation?

   • ADocument the allocation in the system security plan but do not update the traceability matrix.
   • BEnsure that each component is assigned only one sub-function to avoid complexity.
   • CVerify that every sub-function is allocated to at least one component and that no component is overloaded.
   • DAsk the customer to approve the allocation before proceeding with the design.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When a security requirement changes, what is the primary benefit of maintaining traceability between requirements and design?

   • AIt enables impact analysis to identify which design elements are affected
   • BIt automatically updates the design to reflect the change
   • CIt removes the need for configuration management
   • DIt ensures the change is implemented without additional testing
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of a bidirectional traceability matrix in system security design?

   • ATo link design elements to security requirements in both directions, ensuring full coverage
   • BTo track the project schedule and milestones
   • CTo list all security vulnerabilities and their mitigations
   • DTo document the system's network architecture and data flows
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary outcome of allocating sub-functions to system components during functional analysis?

   • AA list of security controls that must be implemented in each component
   • BA test plan that verifies each component's performance
   • CA complete system architecture diagram showing all hardware and software interfaces
   • DA set of component-level requirements that can be used for detailed design
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security engineer is reviewing the traceability matrix for a new secure messaging system. The matrix shows that the requirement 'messages must be encrypted in transit' is linked to the design element 'TLS implementation'. However, the design also includes a 'message queuing' component that handles messages before they are sent. The engineer notices that the queuing component does not have any security requirements linked to it. What is the most appropriate action?

   • AAdd a new requirement for the queuing component to ensure messages are protected while queued, and link it to the design element.
   • BAssume the TLS implementation covers the queuing component because it is part of the message flow.
   • CUpdate the traceability matrix to link the existing encryption requirement to the queuing component as well.
   • DRemove the queuing component from the design because it is not covered by any security requirement.
   Reveal Solution Discussion Select an answer first