A startup is developing a new mobile app and needs to get a working prototype to investors quickly. The team plans to use rapid application development (RAD) with heavy user feedback. How should the security manager ensure security is addressed in this fast-paced environment?

Skip security testing because the prototype is only for demonstration purposes

Use a waterfall approach to ensure security is thoroughly documented before any coding

Defer all security considerations until after the prototype is approved by investors

Incorporate security requirements into each prototype iteration and conduct security reviews with user feedback

A project manager is developing a timeline for a new software release. The security team has estimated that a full penetration test will take three weeks. The project has a hard release date. How should the project manager incorporate the penetration test into the schedule?

Reduce the penetration test to one week to fit the existing schedule

Allocate the three weeks in the schedule before the release date, with a buffer for remediation

Skip the penetration test and rely on code reviews only

Schedule the penetration test after the release date to avoid delaying the launch

During the maintenance phase of the SDLC, which security activity is most important?

Developing the system architecture

Performing user acceptance testing

Applying security patches and updates

Conducting initial risk assessment

Which element is typically part of project scope analysis?

Selecting the programming language

Defining the boundaries of the system

What is the primary purpose of static application security testing (SAST)?

Measure user satisfaction with the interface

Simulate a distributed denial-of-service attack

Test the application in a production environment

Analyze source code for vulnerabilities without executing it

Information Systems Security Management Professional

Domain 1Objective 10

1.10 Apply Product Development and Project Management Principles ISSMP Practice Questions (Page 3)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

14concepts

21%of the exam

Questions 11–15

11application · medium
A startup is developing a new mobile app and needs to get a working prototype to investors quickly. The team plans to use rapid application development (RAD) with heavy user feedback. How should the security manager ensure security is addressed in this fast-paced environment?
Select an answer first
12application · medium
A project manager is developing a timeline for a new software release. The security team has estimated that a full penetration test will take three weeks. The project has a hard release date. How should the project manager incorporate the penetration test into the schedule?
Select an answer first
13foundation · easy
During the maintenance phase of the SDLC, which security activity is most important?
Select an answer first
14foundation · easy
Which element is typically part of project scope analysis?
Select an answer first
15foundation · easy
What is the primary purpose of static application security testing (SAST)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.