A system administrator needs to update the configuration of a production web server to enable a new feature. The change is not urgent and does not address a security vulnerability. According to configuration change control best practices, what should the administrator do before applying the change?

Apply the change during off-peak hours without notifying anyone

Submit a change request and obtain approval from the change advisory board (CAB)

Ask a colleague to apply the change on their behalf

Apply the change immediately and document it in the change log

A company is developing a new IoT device that will collect health data from patients. The device will be used in a regulated environment. The security manager must ensure that security requirements are integrated into the product's life cycle. However, the product team is focused on time-to-market and wants to minimize security overhead. What is the best approach?

Rely on the product team to implement security best practices without formal requirements

Defer security requirements until after the product is developed to speed up time-to-market

Outsource security testing to a third party after the product is complete

Incorporate security requirements into the product requirements document and conduct security reviews at each development phase

An organization has a policy that all server configurations must be reviewed and approved before implementation. A junior administrator is about to implement a change to a firewall rule. What is the most appropriate action for the junior administrator to take?

Ask the system owner for verbal approval and implement the change

Submit the proposed change to the change advisory board for approval

Implement the change immediately because it is a simple firewall rule

Wait for the next scheduled maintenance window and implement the change without approval

A proposed change to a web application would allow users to upload files. The security team must assess the security impact of this change. Which aspect should be evaluated?

The potential for malicious file uploads to compromise the server

The cost of additional storage for uploaded files

The impact on the application's user interface design

The performance impact on the web server

Information Systems Security Management Professional

Domain 2Objective 1

2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 1)

Part of the Systems Lifecycle Management domain, which accounts for 15% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

15%of the exam

Questions 1–5

1application · medium
A system administrator needs to update the configuration of a production web server to enable a new feature. The change is not urgent and does not address a security vulnerability. According to configuration change control best practices, what should the administrator do before applying the change?
Select an answer first
2expert · hard
A company is developing a new IoT device that will collect health data from patients. The device will be used in a regulated environment. The security manager must ensure that security requirements are integrated into the product's life cycle. However, the product team is focused on time-to-market and wants to minimize security overhead. What is the best approach?
Select an answer first
3application · medium
An organization has a policy that all server configurations must be reviewed and approved before implementation. A junior administrator is about to implement a change to a firewall rule. What is the most appropriate action for the junior administrator to take?
Select an answer first
4foundation · easy
In which phase of the system life cycle should security requirements first be formally identified and documented?
Select an answer first
5application · medium
A proposed change to a web application would allow users to upload files. The security team must assess the security impact of this change. Which aspect should be evaluated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 1)

Questions 1–5

A system administrator needs to update the configuration of a production web server to enable a new feature. The change is not urgent and does not address a security vulnerability. According to configuration change control best practices, what should the administrator do before applying the change?

An organization has a policy that all server configurations must be reviewed and approved before implementation. A junior administrator is about to implement a change to a firewall rule. What is the most appropriate action for the junior administrator to take?

In which phase of the system life cycle should security requirements first be formally identified and documented?

A proposed change to a web application would allow users to upload files. The security team must assess the security impact of this change. Which aspect should be evaluated?

Keep studying — Systems Lifecycle Management