Integrate with System Development Methodology ISSEP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which assurance method provides confidence in the security properties of a software system by analyzing its source code?

   • AStatic code analysis
   • BRed team exercise
   • CFormal verification
   • DPenetration testing
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In MBSE, what is the role of simulation in supporting security engineering?

   • ATo automatically patch vulnerabilities
   • BTo generate final security documentation
   • CTo replace all physical testing
   • DTo evaluate system behavior under various security scenarios
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A large enterprise is transitioning from a waterfall SDLC to an agile approach. The security team is concerned that agile's iterative nature may weaken the traceability of security requirements, which is required by ISO/IEC 24641:2023. The team wants to maintain rigorous traceability while adopting agile. Which strategy best addresses this concern?

   • AConducting a security review at the end of each release without documenting links
   • BAbandoning agile and sticking with waterfall to preserve traceability
   • CKeeping a separate security requirements document that is not linked to agile artifacts
   • DUsing a requirements management tool that links security requirements to user stories, test cases, and test results in each sprint
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A defense contractor is developing a new embedded system for a military platform. The program office mandates that security requirements be fully defined and frozen before any design work begins, and that each phase must be completed and formally reviewed before the next phase starts. The contractor must select a development approach that aligns with this mandate while ensuring security is integrated from the start. Which approach should the contractor use?

   • AWaterfall SDLC with security checkpoints at each phase gate
   • BSpiral model with risk analysis in each loop
   • CDevOps pipeline with continuous security testing
   • DAgile sprints with security stories in each iteration
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A software company is developing a new cloud-based application. The development team wants to release features quickly, but the security team requires that all security requirements be verified before each release. The company also has a regulatory requirement to produce evidence of security verification for audits. Which approach best balances the need for speed and the need for verifiable security?

   • AAdopting a DevSecOps approach with automated security testing integrated into the CI/CD pipeline and generating audit logs
   • BDeferring security verification until after the release
   • CConducting manual security reviews before each release
   • DUsing a waterfall model with a security phase before each release
   Reveal Solution Discussion Select an answer first