Perform Technical Management ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is implementing a new data classification policy. The security engineer must ensure that information is managed securely throughout its lifecycle. Which combination of actions is most critical for the engineer to implement?

   • AImplement access controls based on classification and ensure that data is encrypted both at rest and in transit.
   • BEstablish procedures for labeling data at creation, controlling access during storage, and securely destroying it when no longer needed.
   • CFocus on secure disposal methods, such as degaussing and physical shredding, for all media types.
   • DDefine retention periods for each classification level and implement automated deletion at the end of the period.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security engineer is designing a process for handling sensitive customer data. The data must be retained for a specific period to meet legal requirements, but must also be protected from unauthorized access. Which of the following is the most important control to implement?

   • AEncrypting the data at rest and in transit.
   • BUsing a dedicated storage area network (SAN) for all sensitive data.
   • CAssigning a data owner who is responsible for approving access requests.
   • DImplementing a data classification scheme and labeling the data accordingly.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a security-related measurement?

   • AThe brand of firewall used in the network
   • BThe number of security patches applied within the required timeframe
   • CThe color scheme of the security awareness posters
   • DThe number of employees in the organization
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which activity is typically part of a quality assurance process?

   • ADesigning the user interface for a new application
   • BWriting the organization's marketing materials
   • CInstalling security patches on servers
   • DConducting reviews and audits to verify compliance with standards
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security engineer is part of a project team implementing a new data loss prevention (DLP) system. The project is behind schedule, and the project manager asks the engineer to reduce the scope of security testing to meet the deadline. What is the most appropriate action for the security engineer?

   • AEscalate the issue to the project sponsor and request that the project manager be replaced.
   • BAgree to reduce the testing scope to help the project meet its deadline.
   • CAnalyze the risks of reducing the testing scope and present the findings to the project manager for a decision.
   • DRefuse to reduce the testing scope and insist that all tests must be completed as originally planned.
   Reveal Solution Discussion Select an answer first