8.1 - Understand and Integrate Security in the Software Development Life Cycle (SDLC) CISSP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company uses a DevOps model with continuous deployment. A developer wants to make a configuration change that affects security settings. The change management policy requires a CAB approval for security-related changes. How can the company balance speed and security?

   • ARequire CAB approval for all security-related changes, even if it slows down deployment.
   • BUse automated security checks and pre-approved change templates for standard security changes.
   • COnly review security changes after they have been deployed.
   • DAllow developers to make security changes without any review.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which software development methodology is characterized by iterative cycles, continuous feedback, and adaptive planning, often delivering small, incremental releases?

   • AWaterfall
   • BAgile
   • CScaled Agile Framework (SAFe)
   • DDevOps
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is using a DevOps model and frequently deploys updates to production. The change management process requires that all changes be documented and approved. How can the team maintain security while keeping up with rapid deployment?

   • AOnly document changes after a security incident occurs.
   • BRequire manual approval for every deployment.
   • CSkip change management for minor updates to speed up the process.
   • DAutomate change tracking and use pre-approved change templates for routine updates.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A project is facing challenges because security requirements are discovered late in the development cycle, leading to costly rework. The project manager wants to improve collaboration between developers and security professionals. What is the MOST effective action?

   • AHire more security testers to perform more thorough testing.
   • BIncrease the frequency of security audits during the testing phase.
   • CProvide security training to developers after the project is completed.
   • DEstablish an Integrated Product Team (IPT) that includes security professionals from the start.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is an Integrated Product Team (IPT) in the context of software development?

   • AA cross-functional team that includes representatives from all relevant stakeholders to collaborate throughout the product lifecycle
   • BA team that only focuses on security testing at the end of development
   • CA team that is responsible for deploying the software to production
   • DA team that works in isolation to develop a product without external input
   Reveal Solution Discussion Select an answer first