Integrate with System Development Methodology ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A systems engineering team is developing a new authentication service for a federal agency. The security requirements include mandatory use of multi-factor authentication (MFA) and a maximum session timeout of 15 minutes. The team needs to demonstrate to an independent assessor that each security requirement is implemented correctly in the final system. Which approach best supports this verification need?

   • AConduct a single comprehensive security test at the end of the development cycle
   • BMaintain a requirements traceability matrix linking each security requirement to design elements, test cases, and test results
   • CRely on the security architect's sign-off that the design meets all requirements
   • DUse a penetration test report as the sole evidence of requirement satisfaction
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A development team is using an agile methodology to build a new customer relationship management (CRM) system. The security requirements include encryption of customer data at rest and in transit. The team wants to ensure that these requirements are verified as the system evolves. Which practice is most effective in an agile environment?

   • ADeferring all security testing until the final release
   • BIncluding security acceptance criteria in each user story and running automated security tests in the CI/CD pipeline
   • CConducting a single security review at the end of each release
   • DRelying on the product owner to verify security requirements manually
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A government agency is developing a new system with highly critical security requirements. The project manager wants to identify and mitigate security risks early in the development process, and is willing to accept multiple iterations of requirements and design. Which SDLC model is most suitable for this environment?

   • AV-model with verification and validation at each stage
   • BWaterfall model with a single risk assessment at the start
   • CSpiral model with risk analysis in each iteration
   • DAgile model with security stories in each sprint
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which method is commonly used to validate that security requirements are correctly implemented in the final system?

   • AArchitecture review
   • BRequirements elicitation
   • CSecurity testing and evaluation
   • DConfiguration management
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A defense contractor is developing a new command and control system. The program requires that security requirements be verified at each stage of the SDLC, and that the verification evidence be auditable by an external assessor. The contractor is using ISO/IEC 24641:2023 as the process standard. Which combination of practices best satisfies the program's verification and auditability requirements?

   • ARelying on the security team's informal notes and emails as evidence
   • BMaintaining a requirements traceability matrix and conducting formal verification reviews at each phase gate
   • CConducting a single comprehensive security test at the end of development
   • DUsing automated testing tools and storing results in a shared repository
   Reveal Solution Discussion Select an answer first