A development team is building a new customer portal. The security manager wants to ensure that security is integrated throughout the SDLC, not just at the end. Which activity best demonstrates this principle during the requirements phase?

Training developers on secure coding practices after the project is complete

Conducting a penetration test on the final build to identify vulnerabilities

Documenting functional and non-functional security requirements, such as authentication and data protection, in the requirements specification

Deploying a web application firewall to protect the application after launch

What is a characteristic of the waterfall methodology?

Development and testing occur simultaneously

Each phase must be completed before the next begins

Requirements are developed iteratively with user feedback

Changes are easily accommodated at any time

Which factor is most important when selecting a development methodology for a project with strict regulatory compliance requirements?

The methodology's ability to document and demonstrate security controls

The methodology's popularity in the industry

The methodology's speed of delivery

An agile team is planning its next sprint. The product owner wants to include a new feature, but the security team has identified a backlog of security debt that needs to be addressed. How should the team prioritize?

Focus only on the new feature and ignore security debt for this sprint

Cancel the sprint and work only on security debt

Include security debt items in the sprint backlog alongside the new feature, with the team agreeing on the priority

Ask the security team to fix the debt outside of the sprint without tracking it

A system is being deployed to production. The security manager must decide on the deployment strategy. The system handles sensitive data, and any downtime is unacceptable. Which deployment approach best balances security and availability?

Blue-green deployment, with the new version fully tested in a staging environment before switching traffic

Direct deployment to production without prior testing to save time

Deploy the new version during peak hours to test under load

Deploy the new version and immediately delete the old version to free up resources

Information Systems Security Management Professional

Domain 1Objective 10

1.10 Apply Product Development and Project Management Principles ISSMP Practice Questions (Page 9)

Part of the Leadership and Organizational Management domain, which accounts for 21% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~15–25 in this domain), expect 2–3 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

14concepts

21%of the exam

Questions 41–45

41application · medium
A development team is building a new customer portal. The security manager wants to ensure that security is integrated throughout the SDLC, not just at the end. Which activity best demonstrates this principle during the requirements phase?
Select an answer first
42foundation · easy
What is a characteristic of the waterfall methodology?
Select an answer first
43foundation · easy
Which factor is most important when selecting a development methodology for a project with strict regulatory compliance requirements?
Select an answer first
44application · medium
An agile team is planning its next sprint. The product owner wants to include a new feature, but the security team has identified a backlog of security debt that needs to be addressed. How should the team prioritize?
Select an answer first
45expert · hard
A system is being deployed to production. The security manager must decide on the deployment strategy. The system handles sensitive data, and any downtime is unacceptable. Which deployment approach best balances security and availability?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.