Verify Successful Implementation ISSEP Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security engineer is updating the risk analysis for a system after verification testing. The test results show that a critical vulnerability was found in a third-party component, but the vendor has not yet released a patch. The system is currently in production and cannot be taken offline. What should the security engineer do?

   • AIgnore the vulnerability because it is in a third-party component and not the organization's responsibility.
   • BRemove the vulnerability from the risk analysis because the vendor will eventually release a patch.
   • CDocument the vulnerability as a new risk with a high likelihood and impact, and recommend compensating controls.
   • DImmediately shut down the system to eliminate the risk, regardless of business impact.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During a security verification test of a new web application, the test team discovers that the authentication mechanism fails to lock out accounts after multiple failed attempts, contrary to the security requirements. The test lead needs to document this finding and decide on the next step. What should the test lead do?

   • AStop all testing immediately and notify the system owner to fix the authentication flaw before proceeding.
   • BDelete the test case from the plan to avoid reporting a failure that could delay deployment.
   • CIgnore the finding because it is a minor issue and does not affect the overall security posture.
   • DRecord the failure in the test log and continue with the remaining test cases, noting the issue for the final report.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security test team is executing a test plan for a new system. Midway through testing, a critical vulnerability is discovered that could allow unauthorized access to sensitive data. The test lead must decide whether to continue testing or halt the test. The system is not yet in production. What should the test lead do?

   • AContinue testing other areas while documenting the critical finding, and escalate it to the system owner immediately.
   • BIgnore the vulnerability because it is not in the test plan's scope.
   • CFix the vulnerability immediately without documenting it to avoid delays.
   • DHalt all testing until the vulnerability is fixed, even if it delays the project significantly.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security verification test for a new system is complete, and the test report shows that one high-risk finding was not fully resolved because the fix introduced a new issue. The system owner is under pressure to go live and asks the security engineer to sign off on the acceptance. What should the security engineer do?

   • ASign off but note in the acceptance document that the issue is unresolved.
   • BSign off because the system owner is the decision-maker and has the authority to accept the risk.
   • CRefuse to sign off until the issue is resolved or formally accepted by the appropriate authority.
   • DAsk the system owner to sign a waiver that absolves the security engineer of responsibility.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During a security verification test, a test engineer discovers that a new firewall rule is not blocking traffic as specified in the security requirements. The test engineer needs to collect data to support the finding. What should the test engineer do?

   • AVerbally report the issue to the firewall administrator and ask them to fix it.
   • BAssume the rule will be fixed later and continue testing other areas.
   • CModify the security requirements to match the observed behavior.
   • DCapture network traffic logs and screenshots showing the rule configuration and the traffic that was allowed.
   Reveal Solution Discussion Select an answer first