Security Engineering

IAM troubleshooting, endpoint hardening, cryptography, vulnerability management, automation, and specialized system security.

5 minutes 5 Questions

Security Engineering in CompTIA CASP+ refers to the systematic design, implementation, and management of security controls and processes throughout an organization's infrastructure and systems. It involves applying engineering principles to create secure systems that protect against threats while m…

Concepts covered
Network Infrastructure Security TroubleshootingSpecialized and Legacy System SecurityEnterprise Mobility SecuritySOAR and Workflow AutomationGenerative AI in Security EngineeringDigital Signatures and Hashing AlgorithmsPKI and Certificate ManagementPost-Quantum Cryptography (PQC)Key Stretching and Hardware AccelerationSCAP Framework (OVAL, XCCDF, CVE, CVSS)Containerization and Patching AutomationIAM Troubleshooting in Enterprise EnvironmentsEndpoint Security Controls and HardeningServer Security EnhancementHardware Security Technologies (HSM, TPM)ICS/SCADA and OT SecuritySecurity Automation and ScriptingInfrastructure as Code Security PracticesCryptographic Techniques (Tokenization, Code Signing)Symmetric and Asymmetric CryptographyData Protection (At Rest, In Transit, In Use)Advanced Cryptography (Homomorphic, Forward Secrecy)Vulnerability Management and Scanning
Test mode:
Start practice test

SecurityX - Security Engineering Example Questions

Test your knowledge of Security Engineering

Question 1

A team wants to use a generative AI chatbot to help junior analysts write basic firewall rules. The model occasionally produces rules that reference internal IP ranges from its training data. What is the most appropriate first step to address this issue?

Correct Answer: Add an output filter that detects and masks internal IP addresses before showing results to analysts

Adding an output filter that detects and masks internal IP addresses is the most appropriate first step because it provides an immediate, practical mitigation against data leakage without requiring the time-intensive process of retraining the model, directly addressing the symptom at the point of risk.

Retraining the model on a curated dataset is a valid long-term solution but is not a first step since it is resource-intensive and time-consuming. Restricting input prompts addresses the wrong side of the problem, as the issue is in the model's output, not the analyst's input. Deploying a secondary AI model to review output introduces unnecessary complexity and does not guarantee reliable detection of sensitive data.

The key concept tested is AI output validation and data leakage prevention in generative AI deployments.

Question 2

A team is tasked with building an automated compliance and vulnerability reporting dashboard. They need to design a workflow that ingests vulnerability identifiers, scores their severity, checks system configurations against benchmarks, and tests the actual state of endpoints. Which sequence of SCAP components best represents this end-to-end workflow design?

Correct Answer: Use CVE to identify vulnerabilities, CVSS to score severity, XCCDF to define configuration benchmarks, and OVAL to assess endpoint states

The correct answer properly maps each SCAP component to its intended function: CVE (Common Vulnerabilities and Exposures) provides standardized identifiers for known vulnerabilities, CVSS (Common Vulnerability Scoring System) assigns numerical severity scores, XCCDF (Extensible Configuration Checklist Description Format) defines configuration benchmarks and checklists, and OVAL (Open Vulnerability and Assessment Language) performs actual technical assessments of endpoint states.

One option incorrectly uses OVAL for identification and CVE for assessment, reversing their roles. Another option misassigns XCCDF as a scoring system and OVAL as a benchmark definition tool. Another option swaps CVE and CVSS functions entirely and misuses OVAL and XCCDF.

Key concept tested: understanding the distinct roles of SCAP component specifications in an integrated compliance and vulnerability management workflow.

Question 3

In X.509v3 certificate path validation, what is the specific role of the "Policy Mappings" extension when present in a CA certificate?

Correct Answer: It declares equivalence between certificate policies in different PKI domains, allowing cross-domain trust when policies differ in naming but share equivalent assurance levels

The Policy Mappings extension in an X.509v3 CA certificate establishes equivalence between certificate policy OIDs used in different PKI domains, enabling cross-certification trust by declaring that one domain's policy provides equivalent assurance to another domain's policy despite having different identifiers.

The restriction of acceptable policies for subordinate CAs is handled by the Policy Constraints extension, not Policy Mappings. Priority ordering of policies within a single domain is not a function defined in X.509. Translating policies into key usage combinations conflates unrelated extensions, as key usage constraints are governed by their own dedicated extensions.

Key concept tested: understanding cross-domain PKI trust and the specific function of the Policy Mappings extension in certificate path validation.

More Security Engineering questions
1078 questions (total)
Practice 100 questions
One session at a time, always new questions