8.1 - Understand and Integrate Security in the Software Development Life Cycle (SDLC) CISSP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A developer needs to make an urgent change to a production system to fix a critical bug. The organization has a formal change management process that requires a change advisory board (CAB) approval. What should the developer do?

   • AAsk the security team for permission instead of the CAB.
   • BSubmit an emergency change request and follow the expedited approval process.
   • CWait for the next scheduled CAB meeting to approve the change.
   • DMake the change immediately and document it after the fact.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a formal change management process in the context of software and system modifications?

   • ATo speed up the implementation of changes without any review
   • BTo assign blame when a change causes an incident
   • CTo ensure that changes are reviewed, approved, and implemented in a controlled manner to minimize risk
   • DTo document all changes for auditing purposes only
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of a maturity model such as the Capability Maturity Model (CMM) in the context of software development?

   • ATo provide a framework for assessing and improving the maturity of an organization's software processes
   • BTo define a set of security controls that must be implemented in every software project
   • CTo replace the need for security testing by providing a checklist of best practices
   • DTo certify that a software product is free from all vulnerabilities
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is using the Waterfall model for a project with strict regulatory requirements. The security team wants to ensure that security requirements are captured early. At which phase should security requirements be defined?

   • ADuring the testing phase.
   • BDuring the requirements gathering phase.
   • CDuring the deployment phase.
   • DDuring the maintenance phase.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A development team is transitioning from a Waterfall model to an Agile approach. The security team is concerned that security reviews, which were previously conducted as a distinct phase before release, will be lost. Which practice BEST integrates security into the new Agile workflow?

   • AHave developers self-certify that their code is secure without formal review.
   • BRequire a security sign-off at the end of each sprint before the increment is accepted.
   • CMaintain the existing security review as a separate phase after all sprints are complete.
   • DConduct a single comprehensive security assessment at the end of the project.
   Reveal Solution Discussion Select an answer first