Execute Systems Security Engineering Processes (e.g., Hardware, Software, Data) ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A systems security engineer is working on a project that processes credit card data. The project must comply with PCI DSS. During a design review, the engineer notices that the proposed architecture stores cardholder data in a way that may not meet PCI DSS requirements. Who is the most appropriate authority to consult for guidance on PCI DSS compliance?

   • AThe payment card brands directly, because they own the PCI DSS standard.
   • BA Qualified Security Assessor (QSA), because they are certified to assess PCI DSS compliance.
   • CThe company's legal department, because PCI DSS is a legal requirement.
   • DThe company's internal security team, because they are responsible for implementing security controls.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A defense contractor is developing a new avionics subsystem for a U.S. government program. The program office requires the system to comply with NIST SP 800-171 for controlled unclassified information (CUI) and the contractor's internal security policy. During a design review, the systems security engineer identifies that the proposed data-at-rest encryption algorithm does not meet the NIST-approved list. Which action best aligns with the systems security engineering process?

   • ADocument the deviation and proceed with the design, noting that the internal policy takes precedence over the NIST requirement.
   • BProceed with the design and address the encryption algorithm during the security control assessment phase after development completes.
   • CAsk the customer to waive the NIST requirement because the internal policy already mandates a stronger algorithm.
   • DFlag the non-compliant algorithm to the program's security authority and recommend an alternative NIST-approved algorithm, updating the compliance assessment.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational corporation is deploying a new HR system that will process personal data of employees in the European Union and the United States. The systems security engineer must ensure the system complies with GDPR and relevant U.S. state laws. During the design phase, the engineer is deciding where to store the data. Which approach best supports compliance with GDPR's data transfer requirements?

   • AStore all employee data in a single data center located in the United States, relying on the company's binding corporate rules.
   • BUse a cloud provider that offers encryption at rest and in transit, and assume this satisfies GDPR requirements.
   • CStore all data in the EU to simplify compliance, regardless of where the employees are located.
   • DStore EU employee data in an EU-based data center and U.S. employee data in a U.S.-based data center, implementing appropriate transfer mechanisms if data crosses borders.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a key security consideration when using a proprietary design approach in system engineering?

   • AThe design is publicly available for independent security review
   • BThe security of the system may depend on the secrecy of the design
   • CThe system cannot be patched or updated
   • DThe system is automatically more secure than open designs
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A systems security engineer is designing a new payment processing system. The design uses a modular architecture with separate modules for cardholder data processing, tokenization, and transaction logging. The engineer is considering the security implications of this modularity. Which trade-off is most important to address?

   • AModularity increases the attack surface because each module exposes an interface that could be exploited.
   • BModularity eliminates the need for a centralized security monitoring system because each module can be monitored independently.
   • CModularity makes it easier to isolate a compromised module, but it also requires secure interfaces between modules to prevent lateral movement.
   • DModularity reduces the need for encryption because data is segmented across modules.
   Reveal Solution Discussion Select an answer first