Verify Successful Implementation ISSEP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security engineer is developing a security test plan for a system that will process highly sensitive data. The system has a tight deadline, and the test budget is limited. The engineer must decide how to allocate testing effort between automated vulnerability scanning and manual penetration testing. What is the most balanced approach?

   • AConduct manual penetration testing on the most critical components and use automated scanning for the rest.
   • BDelay testing until after deployment to allow more time for a comprehensive test.
   • CPerform only manual testing on a few components and rely on the development team's code reviews for the rest.
   • DUse automated scanning for all components and skip manual testing to save time and money.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A system has completed security verification, and the test report shows that all high-risk findings are resolved, but several medium-risk findings remain. The system owner is ready to accept the system, but the security officer is hesitant because the medium risks are not fully mitigated. What should the security engineer do to facilitate acceptance?

   • ADelay acceptance until all medium risks are fully mitigated, even if it causes significant schedule delays.
   • BAsk the system owner to sign the acceptance document without mentioning the residual risks.
   • CReclassify the medium risks as low so that the system can be accepted without further discussion.
   • DPresent the residual risks to the security officer and document an explicit risk acceptance decision.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A defense contractor is deploying a new secure messaging system that must pass a security test plan before going live. The project manager wants to minimize schedule impact while ensuring that all security requirements are verified. The security engineer has limited test resources and must prioritize which controls to test first. What should the security engineer do?

   • ATest all controls in the order they appear in the system design document to ensure complete coverage.
   • BDelay testing until all development is complete to avoid re-testing after changes.
   • CPrioritize testing of high-risk controls and those that are prerequisites for other tests, then document the rationale in the test plan.
   • DAsk the project manager to approve a reduced test scope to meet the schedule.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A software development team is using an agile methodology to build a new customer relationship management (CRM) system. The security engineer must integrate security testing into the agile process. What is the most effective approach?

   • APerform a single security test at the end of each release, but do not document the results.
   • BIncorporate security test cases into each sprint's definition of done and run them as part of the sprint review.
   • CRely on the development team's code reviews to identify security issues without formal testing.
   • DDevelop a comprehensive security test plan at the start and execute it only after all development is complete.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the purpose of reassessing existing risks after security verification?

   • ATo replace the risk analysis with the test plan
   • BTo assign blame for failed tests
   • CTo eliminate all residual risks
   • DTo determine if the risk level has changed due to verification results
   Reveal Solution Discussion Select an answer first