In trade-off analysis, what does the 'iron triangle' of project management refer to?

Requirements, design, and testing

People, process, and technology

A project manager is creating a schedule for a project that includes a security testing phase. The security team has estimated that testing will take two weeks, but the project manager has only allocated one week. What is the most appropriate action?

Adjust the project schedule to allocate the full two weeks for security testing

Keep the one-week allocation and ask the security team to work overtime

Skip the security testing phase to stay on schedule

Reduce the scope of security testing to fit the one-week allocation

A software company is transitioning from a traditional waterfall approach to agile to deliver a customer-facing web application. The security team is concerned that security testing is being deferred to the end of the cycle. Which approach best integrates security into the agile process?

Include security tasks in each sprint backlog and run automated security scans as part of the definition of done

Create a separate security sprint at the end of the project to address all security concerns

Perform a single penetration test after the final release to identify all vulnerabilities

Have the security team audit the code only after each major feature is complete

A security architect is designing a new web application. To ensure security is built in, not added on, which activity should be performed during the design phase?

Conducting a threat model to identify potential attack vectors and design mitigations

Running a penetration test on the final product

Installing a firewall after deployment

Writing user documentation for the application

What is the primary purpose of project scope analysis in a security context?

Identify security requirements and constraints

Eliminate all security activities to save time

Assign blame for security failures

Guarantee the project will be completed on time

Information Systems Security Management Professional

Domain 1Objective 10

1.10 Apply Product Development and Project Management Principles ISSMP Practice Questions (Page 5)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

14concepts

21%of the exam

Questions 21–25

21foundation · easy
In trade-off analysis, what does the 'iron triangle' of project management refer to?
Select an answer first
22application · medium
A project manager is creating a schedule for a project that includes a security testing phase. The security team has estimated that testing will take two weeks, but the project manager has only allocated one week. What is the most appropriate action?
Select an answer first
23application · medium
A software company is transitioning from a traditional waterfall approach to agile to deliver a customer-facing web application. The security team is concerned that security testing is being deferred to the end of the cycle. Which approach best integrates security into the agile process?
Select an answer first
24application · medium
A security architect is designing a new web application. To ensure security is built in, not added on, which activity should be performed during the design phase?
Select an answer first
25foundation · easy
What is the primary purpose of project scope analysis in a security context?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.