Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following best describes the scope of a security validation plan?

   • AIt defines what will be validated, including the security requirements and controls
   • BIt describes the threat landscape and user behavior
   • CIt lists all stakeholders and their roles
   • DIt details the budget and schedule for the entire project
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In security planning, defining the roles and responsibilities of system owners, users, and security personnel is known as:

   • ARole definition
   • BConstraint identification
   • CStakeholder identification
   • DResponsibility assignment
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the primary purpose of a security validation plan?

   • ATo document assumptions
   • BTo assign security tasks
   • CTo verify that security requirements are met
   • DTo identify stakeholders
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A multinational bank is planning to deploy a new customer relationship management (CRM) system. The system will store customer data, including financial information. The bank operates in several countries, each with its own data protection regulations. The bank's security team has proposed a centralized data storage architecture to simplify management. However, the legal team has identified that some countries require data to be stored locally. The project is under a tight deadline. What is the most appropriate approach to reconcile these conflicting requirements?

   • ADelay the project until a single global data protection standard is established.
   • BProceed with the centralized architecture and rely on encryption to satisfy data residency requirements.
   • CAdopt a distributed architecture that stores data locally in countries with data residency requirements, and document the trade-off of increased management complexity.
   • DAsk the legal team to provide a legal opinion that the centralized architecture is compliant.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   A security engineer conducts interviews, surveys, and workshops with stakeholders to collect security-related requirements. Which activity is being performed?

   • ARequirements analysis and prioritization
   • BStakeholder identification
   • CValidation plan development
   • DRequirements elicitation
   Reveal Solution Discussion Select an answer first