Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A city government is planning to deploy a new public Wi-Fi network in its downtown area. The network will be used by citizens and visitors. The city's IT department will manage the network. The city council has expressed concerns about the security of the network and the potential for misuse. The systems security engineer is beginning the security planning process. Which group of stakeholders is most likely to be overlooked but should be included in the requirements elicitation process?

   • AThe city's marketing department, to promote the network's benefits.
   • BThe local internet service provider, to ensure technical feasibility.
   • CThe city's finance department, to ensure the project stays within budget.
   • DThe city's legal department, to address liability and compliance issues.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A university is developing a new research data management system. The system will store sensitive research data, some of which is subject to federal regulations. The university's budget for the project is fixed, and the timeline is driven by the start of the next academic year. The research office requires that the system support multi-factor authentication (MFA) for all users. The IT department notes that implementing MFA will require additional hardware tokens, which are not in the budget. What is the most appropriate way to handle this constraint?

   • AAssume that the IT department can implement MFA without additional cost, and document that assumption.
   • BProceed with hardware tokens and request additional funding from the university administration.
   • CRemove the MFA requirement from the project scope to stay within budget.
   • DDocument the budget constraint and explore alternative MFA methods, such as software-based authenticators, that may be less costly.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A hospital is implementing a new electronic health record (EHR) system. The hospital's CIO is the system owner. The clinical staff will be the primary users. The IT security team will manage access controls. The hospital is subject to HIPAA regulations, which require that access to patient data be logged and monitored. During the planning phase, the systems security engineer needs to define roles for the system. Which role is most appropriate for the clinical staff?

   • AAssign the clinical staff the role of system owners, since they are the primary users.
   • BExclude clinical staff from the role definition process, as they are not involved in security planning.
   • CDefine the clinical staff as system users with responsibilities for protecting patient data according to hospital policy.
   • DMake the clinical staff responsible for managing the system's access controls.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which validation activity involves examining a security control to ensure it is implemented correctly?

   • ASurvey
   • BInterview
   • CInspection
   • DWorkshop
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which technique is commonly used in requirements elicitation to gather security-related requirements from stakeholders?

   • APenetration testing
   • BRisk assessment
   • CInterviews
   • DArchitecture review
   Reveal Solution Discussion Select an answer first