A manufacturing company is procuring industrial control system (ICS) components from a supplier. The supplier's software includes a library that is no longer maintained by its original developer. What is the most appropriate supply chain risk mitigation?

Require the supplier to provide a software bill of materials (SBOM) and a plan for addressing unmaintained components

Ask the supplier to remove the library and rewrite the software

Ignore the issue because the supplier is reputable

Accept the risk because the library is widely used

A financial institution has just received a new hardware security module (HSM) from a vendor. The contract specifies that the HSM must be FIPS 140-2 Level 3 validated. During the review of contractual deliverables, what is the most important action to verify?

Confirm the HSM's certificate number and validation status on the NIST CMVP list

Check the HSM's physical dimensions and weight

Review the vendor's marketing brochure

Test the HSM's performance under load

A healthcare organization is procuring a new patient portal. The preferred vendor uses a third-party component for authentication. The security team discovers that this component has a known critical vulnerability. The vendor states a patch will be available in 90 days. What should the security team do to manage this supply chain risk?

Accept the risk and proceed with deployment

Require the vendor to provide a mitigation plan and interim controls before deployment

Switch to a different vendor immediately

Disable the vulnerable component and use a custom-built alternative

Which of the following is an example of a compliance criterion that might be included in security requirements for a technology acquisition?

The product must support the organization's single sign-on (SSO) integration

The product must be able to process transactions within two seconds

The product must comply with the General Data Protection Regulation (GDPR) for handling personal data

The product must be compatible with the existing network infrastructure

Which of the following is an example of a security-related contractual deliverable that should be reviewed?

The vendor's financial audit report

The vendor's marketing brochure

The vendor's employee satisfaction survey

The vendor's security testing report for the delivered software

Information Systems Security Engineering Professional

Domain 1Objective 5

Participate in the Technology Procurement Management ISSEP Practice Questions (Page 1)

Part of the Systems Security Engineering Foundations domain, which accounts for 24% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 3–5 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

24%of the exam

Questions 1–5

1application · medium
A manufacturing company is procuring industrial control system (ICS) components from a supplier. The supplier's software includes a library that is no longer maintained by its original developer. What is the most appropriate supply chain risk mitigation?
Select an answer first
2application · medium
A financial institution has just received a new hardware security module (HSM) from a vendor. The contract specifies that the HSM must be FIPS 140-2 Level 3 validated. During the review of contractual deliverables, what is the most important action to verify?
Select an answer first
3application · medium
A healthcare organization is procuring a new patient portal. The preferred vendor uses a third-party component for authentication. The security team discovers that this component has a known critical vulnerability. The vendor states a patch will be available in 90 days. What should the security team do to manage this supply chain risk?
Select an answer first
4foundation · easy
Which of the following is an example of a compliance criterion that might be included in security requirements for a technology acquisition?
Select an answer first
5foundation · easy
Which of the following is an example of a security-related contractual deliverable that should be reviewed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.