How does an Integrated Product Team (IPT) facilitate the incorporation of security throughout the SDLC?

By having a separate security team that works independently from the development team

By focusing solely on compliance with security standards

By requiring security testing only after the product is fully developed

By ensuring security experts are involved in all phases, from requirements to maintenance

During the operation and maintenance phase, a security incident occurs. The incident response team has contained the threat and eradicated the cause. What is the NEXT step in the incident response process?

Conduct a lessons-learned review.

Update the incident response plan.

Recover the affected systems and restore normal operations.

A company is adopting DevSecOps to accelerate software delivery. The security team wants to ensure that vulnerabilities are identified as early as possible without slowing down the pipeline. Which action BEST supports this goal?

Perform a manual penetration test once before each major release.

Deploy a web application firewall (WAF) in front of production systems.

Run static application security testing (SAST) tools automatically on every code commit.

Require security approval before any code is merged into the main branch.

A company is using the Scaled Agile Framework (SAFe) to coordinate multiple Agile teams. The security team wants to ensure that security is integrated across all teams. What is the BEST approach?

Include security representatives in the Agile Release Train (ART) and ensure security features are part of the program backlog.

Conduct a security review only at the end of the program increment.

Have each team handle security independently without coordination.

Assign security tasks only to a dedicated security team outside the ART.

Certified Information Systems Security Professional

Domain 8Objective 1

8.1 - Understand and Integrate Security in the Software Development Life Cycle (SDLC) CISSP Practice Questions (Page 4)

Part of the Software Development Security domain, which accounts for 10% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~7–12 in this domain), expect 1–2 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

10%of the exam

Questions 16–20

16foundation · easy
How does an Integrated Product Team (IPT) facilitate the incorporation of security throughout the SDLC?
Select an answer first
17foundation · easy
Which development approach integrates security practices directly into the DevOps pipeline, automating security checks and fostering shared responsibility for security among development, operations, and security teams?
Select an answer first
18application · medium
During the operation and maintenance phase, a security incident occurs. The incident response team has contained the threat and eradicated the cause. What is the NEXT step in the incident response process?
Select an answer first
19application · medium
A company is adopting DevSecOps to accelerate software delivery. The security team wants to ensure that vulnerabilities are identified as early as possible without slowing down the pipeline. Which action BEST supports this goal?
Select an answer first
20application · medium
A company is using the Scaled Agile Framework (SAFe) to coordinate multiple Agile teams. The security team wants to ensure that security is integrated across all teams. What is the BEST approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.