Integrate with System Development Methodology ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which assurance method is particularly relevant for verifying the security of a cloud-based system's configuration?

   • APhysical security assessment
   • BHardware-level fault injection
   • CConfiguration review against security benchmarks
   • DSource code static analysis
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does ISO/IEC 24641:2023 guide security integration in system development?

   • ABy requiring all systems to use a particular encryption algorithm
   • BBy providing processes that incorporate security activities into each engineering phase
   • CBy focusing solely on software testing
   • DBy mandating a specific SDLC model
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary focus of ISO/IEC 24641:2023?

   • ACryptographic algorithms
   • BPhysical security controls
   • CNetwork security protocols
   • DSystems and software engineering processes
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is developing a new hardware security module (HSM) for cryptographic operations. The security team needs to ensure that the hardware design is resistant to side-channel attacks. Which security activity should be integrated into the design phase of the SDLC?

   • AConducting a threat analysis that includes side-channel attack vectors and incorporating countermeasures into the design
   • BWriting security requirements after the design is complete
   • CPerforming a penetration test on the final hardware
   • DDeferring all security activities until the testing phase
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A development team is working on a new e-commerce platform. The team is using an agile methodology, but the security team is concerned that security requirements are not being verified early enough. The security team wants to introduce security verification without slowing down the agile process. Which approach is most effective?

   • ADeferring all security verification until the final release
   • BSwitching to a waterfall model to ensure security is verified at each phase
   • CIntroducing a 'security champion' in each scrum team who ensures security tasks are included in each sprint and reviews security test results
   • DRequiring a full security review at the end of each sprint
   Reveal Solution Discussion Select an answer first