A project has a fixed deadline and a limited budget. The security team has identified a critical vulnerability that will require significant rework to fix. The project manager must decide how to proceed. Which decision best balances security, schedule, and budget?

Fix the critical vulnerability now, even if it means reducing the scope of non-essential features

Release on time and fix the vulnerability in a future patch

Defer the fix until after the release to meet the deadline

Ask for more budget and time, even though the deadline is fixed

A defense contractor is developing a new embedded system for a military platform. The project has fixed, non-negotiable delivery dates tied to a government contract, and the system must meet strict security certification requirements (e.g., Common Criteria) that mandate formal documentation and evidence at each stage. The team is small but highly experienced. Which development methodology is most appropriate?

Lean, eliminating documentation to reduce waste and speed delivery

RAD, using prototypes to demonstrate security to the customer early

Waterfall, with security checkpoints and formal deliverables at each phase

Agile, with two-week sprints to iterate quickly on security features

Which is an example of a security quality metric?

Number of user interface screens

Number of open critical vulnerabilities

A project is in the scoping phase. The security manager is asked to identify security requirements. Which activity is most important during this phase?

Selecting the specific security testing tools to be used

Deploying the system to production

Identifying applicable regulations, standards, and internal policies that affect the system

Writing the final security test report

A security manager is working with a project team to define quality metrics for a new application. The team wants to track security as part of quality assurance. Which metric best measures the effectiveness of the security testing process?

Number of user interface screens designed

Number of developers on the team

Percentage of security defects found during testing that are fixed before release

Information Systems Security Management Professional

Domain 1Objective 10

1.10 Apply Product Development and Project Management Principles ISSMP Practice Questions (Page 4)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

14concepts

21%of the exam

Questions 16–20

16expert · hard
A project has a fixed deadline and a limited budget. The security team has identified a critical vulnerability that will require significant rework to fix. The project manager must decide how to proceed. Which decision best balances security, schedule, and budget?
Select an answer first
17application · medium
A defense contractor is developing a new embedded system for a military platform. The project has fixed, non-negotiable delivery dates tied to a government contract, and the system must meet strict security certification requirements (e.g., Common Criteria) that mandate formal documentation and evidence at each stage. The team is small but highly experienced. Which development methodology is most appropriate?
Select an answer first
18foundation · easy
Which is an example of a security quality metric?
Select an answer first
19application · medium
A project is in the scoping phase. The security manager is asked to identify security requirements. Which activity is most important during this phase?
Select an answer first
20expert · hard
A security manager is working with a project team to define quality metrics for a new application. The team wants to track security as part of quality assurance. Which metric best measures the effectiveness of the security testing process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.