A software company is selecting a new code review tool. The security team has defined requirements for integration with the CI/CD pipeline, support for multiple programming languages, and on-premises deployment. Two tools meet these requirements. Tool A has a larger user community and more frequent updates. Tool B has a smaller community but offers a more detailed security report. What should the selection team do?

Choose Tool A because of its larger community

Select the tool with the lower price

Choose Tool B because of its detailed reports

Conduct a proof-of-concept with both tools to evaluate their effectiveness in the company's environment

What is the primary goal of supply chain risk management (SCRM) in the context of technology acquisitions?

To ensure the lowest possible procurement cost for all technology purchases

To guarantee that all suppliers are located in the same country as the organization

To identify and mitigate risks associated with suppliers, components, and services

To eliminate all third-party involvement in the technology lifecycle

A hospital is procuring a new electronic health record (EHR) system. The contract specifies that the system must be interoperable with existing systems and meet HIPAA security requirements. During the review of contractual deliverables, the security team finds that the system's API documentation is incomplete, and the vendor has not provided a signed HIPAA business associate agreement (BAA). What should the security team do?

Accept the system because the vendor is reputable

Reject the deliverables and require the vendor to provide the complete API documentation and signed BAA

Accept the system and request the missing items later

Ask the vendor to provide a verbal assurance of compliance

Information Systems Security Engineering Professional

Domain 1Objective 5

Participate in the Technology Procurement Management ISSEP Practice Questions (Page 4)

Part of the Systems Security Engineering Foundations domain, which accounts for 24% of the ISSEP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~17–29 in this domain), expect 3–5 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

24%of the exam

Questions 16–18

16application · medium
A software company is selecting a new code review tool. The security team has defined requirements for integration with the CI/CD pipeline, support for multiple programming languages, and on-premises deployment. Two tools meet these requirements. Tool A has a larger user community and more frequent updates. Tool B has a smaller community but offers a more detailed security report. What should the selection team do?
Select an answer first
17foundation · easy
What is the primary goal of supply chain risk management (SCRM) in the context of technology acquisitions?
Select an answer first
18expert · hard
A hospital is procuring a new electronic health record (EHR) system. The contract specifies that the system must be interoperable with existing systems and meet HIPAA security requirements. During the review of contractual deliverables, the security team finds that the system's API documentation is incomplete, and the vendor has not provided a signed HIPAA business associate agreement (BAA). What should the security team do?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to ISSEP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSEP” is a trademark of its owner, used for identification only.

Participate in the Technology Procurement Management ISSEP Practice Questions (Page 4)

Questions 16–18

What is the primary goal of supply chain risk management (SCRM) in the context of technology acquisitions?

Keep studying — Systems Security Engineering Foundations