Execute Systems Security Engineering Processes (e.g., Hardware, Software, Data) ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A software company is developing a new encryption library that will be used by multiple government agencies. The lead engineer proposes making the source code publicly available for review. The systems security engineer supports this approach. Which security benefit is most directly achieved by this open design decision?

   • AThe library will be easier to integrate into other systems because the interfaces are public.
   • BThe library's security can be independently verified by a broad community of experts.
   • CThe library will be immune to side-channel attacks because the code is public.
   • DThe library will automatically comply with all federal security standards because it is open source.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare organization is developing a new patient portal that will handle protected health information (PHI). The system must comply with HIPAA. During the design phase, the systems security engineer is reviewing the authentication mechanism. The proposed design uses only a username and password. Which action should the engineer take to align with HIPAA's security requirements?

   • AConduct a risk assessment to determine if the username and password are sufficient, and document the decision.
   • BApprove the design because HIPAA does not specify authentication methods.
   • CRequire the implementation of multi-factor authentication for all users, regardless of the risk assessment.
   • DAsk the legal department to interpret HIPAA and provide a compliance statement.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A systems security engineer is working on a project for a defense agency. The project involves a system that will be used by multiple departments, each with its own security authority. During a design review, the engineer identifies a security requirement that is mandated by one department but conflicts with the operational needs of another department. What is the most appropriate course of action?

   • AEscalate the conflict to the appropriate governance body or steering committee for resolution.
   • BIgnore the conflicting requirement and proceed with the design that meets the majority of the requirements.
   • CImplement the requirement from the department with the highest authority, regardless of the operational impact.
   • DImplement the requirement from the department that has the most operational need, because the system must be usable.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How do laws, regulations, and standards typically influence system security governance?

   • AThey are irrelevant once a system is deployed
   • BThey are optional guidelines that only apply to government systems
   • CThey only affect the procurement of hardware, not software
   • DThey provide a framework for defining security requirements and compliance obligations
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A systems security engineer is working on a project for a federal agency. The project must comply with FISMA, and the agency's CISO has delegated authority to the program manager to accept residual risk. During a design review, the engineer identifies a moderate-risk vulnerability in the proposed architecture. The program manager wants to accept the risk to stay on schedule. What should the engineer do?

   • AEscalate the issue directly to the CISO, bypassing the program manager, because the vulnerability is moderate risk.
   • BRefuse to proceed until the vulnerability is fully mitigated, regardless of the program manager's authority.
   • CAccept the program manager's decision because the CISO delegated authority to them.
   • DDocument the vulnerability and the program manager's risk acceptance decision in the system security plan, and continue the engineering process.
   Reveal Solution Discussion Select an answer first