Verify Successful Implementation ISSEP Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security test team is executing a test plan for a new system. The test plan includes both automated and manual test cases. The team discovers that the automated test tool is generating false positives, which are consuming time to investigate. The test lead must decide how to handle this. What should the test lead do?

   • AContinue with the current configuration and accept the time spent on false positives.
   • BRemove the automated tests from the test plan to avoid false positives.
   • CAdjust the automated tool's configuration to reduce false positives and document the changes.
   • DIgnore the automated test results and rely only on manual testing.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A healthcare organization is implementing a new patient portal that must comply with HIPAA. The security test plan must include verification of access controls and audit logging. The project manager wants to ensure that the test plan is comprehensive and can be executed within the project timeline. What is the most important element to include in the test plan?

   • AA budget breakdown for test tools and any external testing services.
   • BThe names of the test team members and their qualifications.
   • CA detailed schedule for each test activity and the resources assigned to execute them.
   • DA list of all security requirements and the specific test methods that will verify each one.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   After completing security verification testing for a new financial system, the test results show that the encryption implementation is weaker than specified in the security requirements. The risk analysis previously rated the encryption risk as low. What should the security engineer do?

   • AIncrease the system's security controls to compensate for the weak encryption without updating the risk analysis.
   • BLeave the risk analysis unchanged because the system is already in production and the risk was accepted.
   • CNotify the system owner and request a waiver to accept the risk without further analysis.
   • DUpdate the risk analysis to reflect the new finding and reassess the overall risk posture.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   After security verification testing, the risk analysis for a system is updated to reflect that a previously identified high-risk vulnerability has been successfully mitigated. What should the security engineer do next?

   • AUpdate the risk register to show the reduced risk level and document the evidence from the verification.
   • BNotify the system owner that the risk is resolved and no further action is needed.
   • CWait until the next scheduled risk review to update the risk analysis.
   • DRemove the vulnerability from the risk register entirely because it is no longer a risk.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A government agency has completed the security verification of a new case management system. The project manager needs to obtain formal acceptance from the agency's security officer. What should the project manager do to document stakeholder acceptance?

   • APrepare a formal acceptance document that lists the security requirements, test results, and any residual risks, and obtain the security officer's signature.
   • BAsk the system administrator to sign the acceptance document on behalf of the security officer.
   • CSend an email to the security officer summarizing the test results and ask for a verbal confirmation.
   • DAssume acceptance is granted because the system passed all tests and proceed to deployment.
   Reveal Solution Discussion Select an answer first