Execute Systems Security Engineering Processes (e.g., Hardware, Software, Data) ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a systems security engineering effort, which entity is typically responsible for establishing the organization's security policies and providing high-level direction for security activities?

   • AThe system's end users
   • BThe system's lead security engineer
   • CThe organization's senior management or board
   • DThe external certification body
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a potential security advantage of a proprietary design approach?

   • AThe system is immune to reverse engineering
   • BThe design is open to public scrutiny, leading to more thorough review
   • CThe vendor can control access to the design and implementation details
   • DThe system requires no security updates
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A company is developing a proprietary hardware security module (HSM) for a banking application. The design uses a closed, proprietary architecture that is not publicly documented. The systems security engineer is concerned about the lack of external review. Which mitigation is most effective for addressing this concern?

   • AHire an independent third-party security firm to perform a penetration test and design review.
   • BRely on the fact that the HSM will be physically protected and cannot be accessed by attackers.
   • CConduct an internal security review using the company's own security team.
   • DPublish the full design documentation to the public to gain community review.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A systems security engineer is designing a new authentication service for a large enterprise. The design uses a modular architecture where the password validation module, the multi-factor authentication module, and the session management module are separate components with well-defined interfaces. The engineer is evaluating the security implications of this modular approach. Which security benefit is most directly realized by this design?

   • AThe modular design eliminates the need for external security testing because each module can be tested in isolation.
   • BThe system will have fewer attack surfaces because each module is smaller and simpler than a monolithic design.
   • CThe system can be fully verified as secure because all modules are open to inspection by any party.
   • DA vulnerability in the password validation module can be patched and replaced without requiring changes to the session management module.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is an example of an external security authority that can influence a systems security engineering process?

   • AThe organization's Chief Information Security Officer (CISO)
   • BA national data protection regulatory agency
   • CThe organization's internal audit department
   • DThe system's project manager
   Reveal Solution Discussion Select an answer first