Analyze Organizational and Operational Environment ISSEP Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A multinational corporation is deploying a new HR system that will be used in multiple countries. The system must comply with the General Data Protection Regulation (GDPR) for EU employees and with local data residency laws in other countries. The security requirements include that all personal data must be encrypted and that access must be logged. The project has a limited budget for validation. The systems security engineer must develop a validation plan. What is the most important consideration when developing this plan?

   • ADefer validation of GDPR compliance until after the system is deployed, to allow for real-world testing.
   • BEnsure the validation plan includes specific test cases for GDPR compliance and data residency requirements.
   • CFocus validation on the encryption and logging requirements, as they are the most technical.
   • DUse a single validation method, such as a demonstration, to save costs.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A state government agency is implementing a new case management system. The agency's IT director will serve as the system owner. The agency has a security team that will handle incident response, and a database administrator (DBA) who will manage the underlying database. The project is subject to state records retention laws. During the planning phase, the systems security engineer needs to define who is responsible for ensuring that audit logs are retained for the required period. What is the most appropriate assignment of responsibility?

   • AAssign the security team the responsibility for audit log retention, since they handle incident response.
   • BLeave the responsibility undefined until the validation plan is developed, to allow for flexibility.
   • CMake the system owner personally responsible for manually archiving audit logs each month.
   • DAssign the DBA the responsibility for configuring the database to retain audit logs, with the system owner accountable for ensuring compliance.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary outcome of requirements analysis and prioritization?

   • AA set of assumptions about the environment
   • BA list of all stakeholders
   • CA set of clear, testable security requirements
   • DA detailed validation plan
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A company has developed a new web application that handles customer payment information. The security requirements include that the application must be resistant to SQL injection attacks and that all payment data must be encrypted in transit. The development team has implemented parameterized queries and TLS. The systems security engineer is selecting validation methods to verify these requirements. Which combination of validation methods is most appropriate?

   • AConduct a demonstration to show that the application works, and rely on the developer's assurance that the code is secure.
   • BPerform a penetration test on the production system, but do not review the code.
   • CUse only a static analysis tool to check for SQL injection, and skip dynamic testing.
   • DPerform a code review to verify parameterized queries are used, and conduct a vulnerability scan to test for SQL injection vulnerabilities.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   After gathering security requirements from stakeholders, the team evaluates them for feasibility, conflicts, and priorities, and translates them into clear, testable requirements. Which activity is this?

   • ARequirements elicitation
   • BValidation plan development
   • CConstraint identification
   • DRequirements analysis and prioritization
   Reveal Solution Discussion Select an answer first