Execute Systems Security Engineering Processes (e.g., Hardware, Software, Data) ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a common implication of adopting open design in a system engineering project?

   • AThe system's source code must be kept secret from all external parties
   • BThe system's design is subject to public review and scrutiny
   • CThe system's security relies on the complexity of its internal algorithms being unknown
   • DThe system cannot be used in any regulated environment
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A government agency is evaluating two designs for a new secure messaging system. Design A uses an open-source protocol that is publicly documented and has been reviewed by the security community. Design B uses a proprietary protocol developed in-house that is not publicly disclosed. The agency has a requirement for interoperability with other government systems, some of which use the proprietary protocol. The systems security engineer must recommend a design. Which consideration is most critical for the recommendation?

   • ADesign B is more secure because it is proprietary and less likely to be attacked, so it should be selected.
   • BDesign B should be selected because it meets the interoperability requirement, and the security risk can be mitigated through internal testing.
   • CDesign A is always more secure because it is open source, so it should be selected regardless of interoperability.
   • DDesign A should be selected because open design allows for broader review, but interoperability with the proprietary protocol must be addressed through a gateway or adapter.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following best describes the role of a security standard (e.g., ISO/IEC 27001) in system security governance?

   • AIt is a one-time checklist that, once completed, ensures permanent compliance
   • BIt is a framework of best practices that organizations can adopt to manage security risks
   • CIt is a legally binding law that mandates specific security controls
   • DIt is a technical specification that only applies to hardware components
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is developing a proprietary cryptographic module for a high-assurance government application. The design relies on a secret algorithm that is not publicly disclosed. During a security review, the systems security engineer notes that the algorithm has never been subjected to independent peer review. What is the primary security concern with this proprietary approach?

   • AThe algorithm will be slower than a publicly known algorithm because it is proprietary.
   • BThe algorithm cannot be patented because it is not publicly disclosed.
   • CThe secret algorithm may be reverse-engineered from the compiled code, exposing the design.
   • DThe lack of public scrutiny increases the risk of undiscovered cryptographic weaknesses.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a compliance assessment of a system, what is the primary purpose of mapping security controls to regulatory requirements?

   • ATo identify which controls are optional and can be skipped
   • BTo demonstrate that the system meets applicable legal and regulatory obligations
   • CTo replace the need for any risk assessment
   • DTo ensure that all controls are implemented in hardware only
   Reveal Solution Discussion Select an answer first