Verify Successful Implementation ISSEP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a security test plan, which element is primarily used to estimate the time and personnel needed to complete the verification activities?

   • ATest methods
   • BTest objectives
   • CTest resources
   • DTest schedule
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   After security verification reveals a new vulnerability, what is the first step in updating the risk analysis?

   • ADocument the new risk in the risk register
   • BAccept the risk without further analysis
   • CNotify all stakeholders immediately
   • DImplement a mitigation control
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which component of a security test plan specifies the conditions under which the system will be considered to have passed the security verification?

   • ATest objectives
   • BTest success criteria
   • CTest scope
   • DTest methods
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   After a security verification test, a risk analysis reveals that a new vulnerability has been introduced by a recent system update. The vulnerability is not yet exploited, but the risk is rated as high. The system owner wants to proceed with deployment because the update fixes a critical business function. What should the security engineer do?

   • ARecommend deploying the system with a documented risk acceptance and a plan for monitoring and mitigation.
   • BDeploy the system without documenting the risk to avoid delaying the project.
   • CRefuse to allow deployment until the vulnerability is fixed, regardless of business impact.
   • DRemove the vulnerability from the risk analysis because it has not been exploited.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security verification test for a new system is complete. The test report shows that all security requirements are met, but the system owner wants to add a new feature that was not in the original scope. The security engineer must decide how to handle the acceptance process. What should the security engineer do?

   • AAccept the system as is and note that the new feature will be tested later.
   • BDocument the new feature as a change request and require additional security testing before final acceptance.
   • CAsk the system owner to sign the acceptance document and handle the new feature in a future release.
   • DRefuse to accept the system until the new feature is removed.
   Reveal Solution Discussion Select an answer first