2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is essential to ensure security requirements are incorporated into system design?

   • ADecommissioning legacy systems
   • BPerforming a risk assessment after deployment
   • CConducting a post-implementation review
   • DIncluding security requirements in design specifications
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A proposed change to a database server configuration would enable a new authentication method. Before approving the change, the security team must assess its security impact. Which action is most appropriate for this assessment?

   • AReview the change against the system's security baseline and threat model
   • BApprove the change because it is a standard configuration option
   • CRely on the vendor's documentation that the change is secure
   • DTest the change in production to see if it causes any issues
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A large enterprise has a configuration management database (CMDB) that tracks all IT assets and their configurations. The security team is concerned that unauthorized changes to system configurations could introduce vulnerabilities. Which practice is most effective for ensuring that security configurations are documented, controlled, and audited?

   • AImplement a change management process that requires approval before any configuration change is applied
   • BUse automated tools to detect configuration drift but do not require approval for changes
   • CAllow administrators to make changes freely and document them after the fact
   • DRely on the CMDB to automatically update itself when changes are made
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A software development team is using a DevOps approach to build a new application. The security manager wants to ensure that security is integrated throughout the continuous integration/continuous deployment (CI/CD) pipeline. Which approach best achieves this goal?

   • AIncorporate automated security scanning tools into each stage of the pipeline
   • BDefer security testing until after the application is deployed to production
   • CRely on the development team to manually test security features
   • DPerform a single security review just before the final release
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A healthcare organization is developing a patient portal that will handle protected health information (PHI). The project is in the design phase, and the security team has been asked to ensure that security requirements are incorporated into the system design. Which approach best fulfills this objective?

   • ADefine security requirements as non-functional requirements and include them in the design specification
   • BUse a generic security checklist from a similar project without tailoring it
   • CWait until the coding phase to add security features based on developer preferences
   • DRely on the security team to test the final product and fix any issues found
   Reveal Solution Discussion Select an answer first