3.10 - Manage the Information System Lifecycle CISSP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is a primary objective of the operations and maintenance phase?

   • AEnsuring the system continues to function securely and reliably
   • BDefining the initial system requirements
   • CSanitizing storage media for disposal
   • DDesigning the system architecture
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In the development and implementation phase, which activity involves turning the design into a working system?

   • AUser acceptance testing
   • BRequirements elicitation
   • CCoding and configuration
   • DSystem retirement planning
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A healthcare organization is replacing its legacy patient portal. The new system must support 24/7 access for patients, integrate with an existing EHR, and comply with HIPAA. During requirements gathering, the project manager collects input from clinicians, patients, and IT security. Which action best ensures the system's requirements are complete and testable?

   • ADocument functional and non-functional requirements in a traceability matrix, with measurable acceptance criteria for each.
   • BCreate a requirements document that lists all stakeholder requests verbatim to ensure nothing is missed.
   • CDefer detailed requirements until after the architecture is designed to avoid constraining technical solutions.
   • DPrioritize requirements based on the IT security team's input, since compliance is the most critical constraint.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is part of the retirement and disposal phase?

   • AConducting user training on the new system
   • BPerforming system integration testing
   • CDecommissioning the system and removing it from service
   • DDefining functional requirements
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company operates a legacy system that is still critical to daily operations but is no longer receiving vendor support. The system has known vulnerabilities that cannot be patched. What is the most appropriate risk management action during the operations and maintenance phase?

   • ADisconnect the system from the network to eliminate the vulnerability.
   • BContinue operating the system without changes, accepting the risk.
   • CUpgrade the system to a newer version even though it is unsupported.
   • DImplement compensating controls, such as network segmentation and enhanced monitoring, while planning for system replacement.
   Reveal Solution Discussion Select an answer first