8.1 - Understand and Integrate Security in the Software Development Life Cycle (SDLC) CISSP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An organization wants to benchmark its current software security practices and create a roadmap for improvement. The team is familiar with the Capability Maturity Model (CMM) but needs a model specifically focused on software assurance. Which model should they adopt?

   • ANIST Cybersecurity Framework
   • BCapability Maturity Model Integration (CMMI)
   • CSoftware Assurance Maturity Model (SAMM)
   • DISO/IEC 27001
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A critical application is in production and a zero-day vulnerability is discovered. The vendor has released a patch, but applying it requires a system restart that will cause 30 minutes of downtime. The application is business-critical and cannot tolerate downtime during peak hours. What is the BEST course of action?

   • AImplement temporary mitigations (e.g., WAF rules) and apply the patch at the next maintenance window.
   • BApply the patch during the next scheduled maintenance window, even if it is several days away.
   • CDo not apply the patch until the vulnerability is actively exploited.
   • DApply the patch immediately, accepting the downtime.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which activity is a key security consideration during the operation and maintenance phase of the SDLC?

   • APerforming regular patching of software and systems
   • BWriting user documentation for the software
   • CConducting a threat model for the initial design
   • DDefining acceptance criteria for the product
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An organization is at CMM Level 1 (Initial) for its software development processes. The security team wants to improve to Level 2 (Repeatable). What is the PRIMARY focus of this improvement effort?

   • AOptimizing processes based on quantitative feedback.
   • BStandardizing processes across the entire organization.
   • CMeasuring and controlling processes using statistical techniques.
   • DEstablishing basic project management and security processes that can be repeated on future projects.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which element is typically included in a change management process to ensure that security is maintained after a modification?

   • AA policy to avoid documenting minor changes
   • BA guarantee that no security testing is needed after the change
   • CA rollback plan in case the change introduces issues
   • DA requirement to bypass approval for urgent changes
   Reveal Solution Discussion Select an answer first