A company is developing a new product and is using a hybrid development approach with both in-house and outsourced teams. The outsourced team is responsible for a critical module. The security team has identified a risk that the outsourced team may not follow secure coding practices. What is the most effective way to manage this risk throughout the development lifecycle?

Perform a single security review of the outsourced module just before the final release.

Trust the outsourced team to follow secure coding practices because they are professionals.

Include security requirements in the contract, conduct regular security audits of the outsourced team's code, and perform a final security review before release.

Require the outsourced team to sign a non-disclosure agreement and then accept the risk.

A software development team is using a DevOps model with continuous integration and continuous deployment (CI/CD). They want to integrate security risk management without slowing down their release pipeline. Which practice best supports this goal?

Automate security scanning and threat modeling within the CI/CD pipeline, and have security engineers review and triage the results.

Perform a comprehensive security risk assessment only at the end of each sprint.

Require a manual security review by a security engineer before every production release.

Defer all security testing to the operations team after the software is deployed.

A company is in the operations and maintenance phase of a critical business application. A new critical vulnerability is discovered in the application's web server software. What is the most appropriate immediate action to manage this risk?

Apply the vendor's security patch to the web server as soon as possible, following the change management process.

Wait for the next scheduled maintenance window, which is in six months, to apply the patch.

Disable the web server until the patch can be applied, even if it disrupts business operations.

Accept the risk and do nothing because the vulnerability is in a web server that is not directly accessible from the internet.

A mid-sized company is implementing a new customer relationship management (CRM) system. The security team has identified a risk that customer data could be exposed due to misconfigured cloud storage. The ERM committee is reviewing the risk. What is the most appropriate risk response if the likelihood is low but the impact is high?

Accept the risk because the likelihood is low and the cost of mitigation may not be justified.

Transfer the risk by purchasing cyber insurance to cover potential losses from a data breach.

Mitigate the risk by implementing automated configuration checks and access controls to reduce the likelihood of misconfiguration.

Avoid the risk by not storing customer data in the cloud and using an on-premises system instead.

A company is in the process of decommissioning a legacy application. The data from the application has been migrated to a new system. What is the most important step to ensure the legacy system does not pose a security risk after decommissioning?

Sanitize the storage media of the legacy system to ensure all sensitive data is unrecoverable.

Keep the legacy system running in a read-only mode for a few months to ensure the new system is stable.

Document the decommissioning process and archive it, but do not sanitize the media because the data has been migrated.

Remove the legacy system from the network but keep it powered on for potential data recovery.

Information Systems Security Engineering Professional

Domain 2Objective 1

Apply Security Risk Management Principles ISSEP Practice Questions (Page 3)

Part of the Risk Management domain, which accounts for 20% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 5–8 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

2concepts

20%of the exam

Questions 11–15

11expert · hard
A company is developing a new product and is using a hybrid development approach with both in-house and outsourced teams. The outsourced team is responsible for a critical module. The security team has identified a risk that the outsourced team may not follow secure coding practices. What is the most effective way to manage this risk throughout the development lifecycle?
Select an answer first
12application · medium
A software development team is using a DevOps model with continuous integration and continuous deployment (CI/CD). They want to integrate security risk management without slowing down their release pipeline. Which practice best supports this goal?
Select an answer first
13application · medium
A company is in the operations and maintenance phase of a critical business application. A new critical vulnerability is discovered in the application's web server software. What is the most appropriate immediate action to manage this risk?
Select an answer first
14application · medium
A mid-sized company is implementing a new customer relationship management (CRM) system. The security team has identified a risk that customer data could be exposed due to misconfigured cloud storage. The ERM committee is reviewing the risk. What is the most appropriate risk response if the likelihood is low but the impact is high?
Select an answer first
15application · medium
A company is in the process of decommissioning a legacy application. The data from the application has been migrated to a new system. What is the most important step to ensure the legacy system does not pose a security risk after decommissioning?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Apply Security Risk Management Principles ISSEP Practice Questions (Page 3)

Questions 11–15

A software development team is using a DevOps model with continuous integration and continuous deployment (CI/CD). They want to integrate security risk management without slowing down their release pipeline. Which practice best supports this goal?

A company is in the operations and maintenance phase of a critical business application. A new critical vulnerability is discovered in the application's web server software. What is the most appropriate immediate action to manage this risk?

A company is in the process of decommissioning a legacy application. The data from the application has been migrated to a new system. What is the most important step to ensure the legacy system does not pose a security risk after decommissioning?

Keep studying — Risk Management