CAP Security Architecture & Engineering 5 — Questions and Answers
Question 1: A federal system must ensure that hardware components are from trusted suppliers. Which program directly addresses this supply chain concern?
- FedRAMP Authorization
- NIST SP 800-161 Supply Chain Risk Management (Correct answer)
- FISMA Compliance
- DoD RMF Overlay
Correct answer: NIST SP 800-161 Supply Chain Risk Management
NIST SP 800-161 provides guidance on supply chain risk management practices for federal information systems.
Question 2: Which security engineering concept involves deliberately introducing a weakness into a system to detect attackers?
- Fuzzing
- Penetration testing
- Honeypot deployment (Correct answer)
- Fault injection
Correct answer: Honeypot deployment
Honeypots are decoy systems designed to attract and detect attackers while appearing to be legitimate targets.
Question 3: When applying security engineering principles, 'economy of mechanism' primarily means:
- Using cost-effective security controls
- Keeping security designs as simple as possible (Correct answer)
- Minimizing the number of security tools
- Reducing authentication steps for efficiency
Correct answer: Keeping security designs as simple as possible
Economy of mechanism means keeping security designs simple and small to reduce the attack surface and facilitate verification.
Question 4: A system architect needs to protect data that remains sensitive even after the system is decommissioned. Which control addresses this long-term concern?
- Data masking at rest
- Media sanitization procedures (Correct answer)
- Encryption key rotation
- Access control list updates
Correct answer: Media sanitization procedures
Media sanitization (e.g., per NIST SP 800-88) ensures data cannot be recovered after system decommissioning.
Question 5: Which type of security control prevents a security incident from occurring in the first place?
- Detective control
- Corrective control
- Preventive control (Correct answer)
- Compensating control
Correct answer: Preventive control
Preventive controls stop security incidents before they occur, such as firewalls, encryption, and access controls.
Question 6: An organization's security architect is designing a system with multiple layers of security controls. Which NIST document provides the security control catalog for this effort?
- NIST SP 800-37
- NIST SP 800-53 (Correct answer)
- NIST SP 800-30
- NIST SP 800-137
Correct answer: NIST SP 800-53
NIST SP 800-53 provides the comprehensive catalog of security and privacy controls for federal information systems.
Question 7: Which formal verification approach mathematically proves that a security policy is correctly enforced by a system design?
- Penetration testing
- Code review
- Formal methods (Correct answer)
- Vulnerability scanning
Correct answer: Formal methods
Formal methods use mathematical proofs to verify that a system design correctly implements its security policy.
CAP Security Architecture & Engineering 5
A federal system must ensure that hardware components are from trusted suppliers.
Which program directly addresses this supply chain concern?