2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A government agency is procuring a new system that will process classified information. The agency wants to ensure that security requirements are included in the procurement contract. Which action is most appropriate?

   • AAsk the vendor to sign a non-disclosure agreement (NDA) to ensure security
   • BWait until the system is delivered and then test it for security
   • CRely on the vendor's standard security features
   • DInclude security requirements as mandatory contractual clauses in the request for proposal (RFP)
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A multinational corporation is developing a new cloud-based application that will be used by customers in multiple countries with varying data protection regulations. The project is in the requirements phase. The security manager must ensure that security requirements are integrated into the system life cycle while balancing the need for a single global application. Which approach best addresses this challenge?

   • ADevelop separate security requirements for each country and implement them in regional instances
   • BWait until the design phase to determine which regulations apply
   • CUse a single set of requirements based on the company's home country regulations
   • DDefine a core set of security requirements that meet the most stringent regulations and apply them globally
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An organization has a change management process that requires all changes to be approved by the change advisory board (CAB). A security administrator discovers that a server has been compromised and needs to apply an emergency security patch. The CAB is not available until the next day. What is the best course of action?

   • AWait for the CAB to approve the patch before applying it
   • BIsolate the server and wait for the CAB to approve the patch
   • CApply the emergency patch immediately and document it for retrospective CAB approval
   • DApply the patch but do not document it to avoid the need for CAB approval
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A proposed change to a critical financial system would update the operating system from a legacy version to a current one. The change is necessary to address known vulnerabilities, but it may affect the compatibility of a custom application. What is the best approach to manage this change?

   • AReject the change because it might affect the custom application
   • BPerform a security impact analysis and a compatibility test in a staging environment before approving the change
   • CApply the change to production and monitor for issues
   • DApprove the change immediately because it addresses known vulnerabilities
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of defining security requirements during the system life cycle?

   • ATo ensure security is considered from the start and built into the system
   • BTo satisfy auditors after the system is deployed
   • CTo document the system's final configuration
   • DTo replace the need for security testing
   Reveal Solution Discussion Select an answer first