A change is proposed to modify the encryption algorithm used for data at rest on a file server. The current algorithm is AES-256, and the proposed change is to use a weaker algorithm to improve performance. What should the security team do before approving this change?

Approve the change because performance improvements are important

Implement the change and monitor for any security incidents

Conduct a security impact analysis to determine if the weaker algorithm introduces unacceptable risk

Reject the change outright because any change to encryption is risky

A company is deploying a new wireless network for guest access. The security manager wants to ensure that appropriate controls are implemented during the deployment phase. Which control is most important to implement?

Segment the guest network from the corporate network using VLANs or firewalls

Use the same SSID as the corporate network for convenience

Disable encryption on the guest network to improve performance

Allow guests to access all network resources for ease of use

A financial services firm is deploying a new customer relationship management (CRM) system. The system will be hosted on-premises and will process sensitive customer financial data. During the implementation phase, the security manager must ensure that appropriate security controls are applied. Which control implementation is most appropriate at this phase?

Configure the system with least-privilege access controls and enable auditing

Defer all security configurations until after the system goes live

Only implement controls that are required by the vendor's default installation

Rely on the network firewall to protect the system, since it is on-premises

Which step is essential in the configuration change control process?

Keeping change records only for a week

Allowing any administrator to approve their own changes

Obtaining formal approval before implementing a change

Implementing changes immediately without review

Information Systems Security Management Professional

Domain 2Objective 1

2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 3)

Part of the Systems Lifecycle Management domain, which accounts for 15% of the ISSMP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 3–5 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

6concepts

15%of the exam

Questions 11–15

11application · medium
A change is proposed to modify the encryption algorithm used for data at rest on a file server. The current algorithm is AES-256, and the proposed change is to use a weaker algorithm to improve performance. What should the security team do before approving this change?
Select an answer first
12application · medium
A company is deploying a new wireless network for guest access. The security manager wants to ensure that appropriate controls are implemented during the deployment phase. Which control is most important to implement?
Select an answer first
13foundation · easy
During which life cycle phase is a system's security configuration typically baselined and documented?
Select an answer first
14application · medium
A financial services firm is deploying a new customer relationship management (CRM) system. The system will be hosted on-premises and will process sensitive customer financial data. During the implementation phase, the security manager must ensure that appropriate security controls are applied. Which control implementation is most appropriate at this phase?
Select an answer first
15foundation · easy
Which step is essential in the configuration change control process?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ISSMP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “ISSMP” is a trademark of its owner, used for identification only.

2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 3)

Questions 11–15

A change is proposed to modify the encryption algorithm used for data at rest on a file server. The current algorithm is AES-256, and the proposed change is to use a weaker algorithm to improve performance. What should the security team do before approving this change?

A company is deploying a new wireless network for guest access. The security manager wants to ensure that appropriate controls are implemented during the deployment phase. Which control is most important to implement?

During which life cycle phase is a system's security configuration typically baselined and documented?

Which step is essential in the configuration change control process?

Keep studying — Systems Lifecycle Management