2.1 Manage Integration of Security Throughout System Life Cycle ISSMP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which activity is a key part of configuration management oversight?

   • AIgnoring configuration changes during maintenance
   • BRegularly auditing system configurations against the baseline
   • CDeleting configuration files after deployment
   • DAllowing any user to change configurations
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A large enterprise has a decentralized IT structure where each business unit manages its own systems. The security team wants to implement a centralized configuration management process to ensure consistent security configurations. However, business units resist losing control over their systems. What is the best approach to balance central oversight with business unit autonomy?

   • AImplement a decentralized process where each business unit sets its own security standards
   • BAllow business units to manage all configurations but require them to report changes monthly
   • CEstablish a centralized configuration management policy with mandatory security baselines, while allowing business units to manage non-security configurations
   • DRequire all configuration changes to be approved by the central security team
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A security auditor is reviewing the configuration management process for a data center. The auditor wants to verify that security configurations are documented and controlled. Which evidence would best demonstrate this?

   • AA configuration baseline document that is version-controlled and updated after approved changes
   • BA vendor's security whitepaper for the server hardware
   • CA log of all network traffic for the past month
   • DA list of all system administrators with access to the servers
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the main goal of configuration change control?

   • ATo allow all users to modify configurations freely
   • BTo make configuration changes without documentation
   • CTo prevent unauthorized modifications to system configurations
   • DTo eliminate the need for configuration baselines
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An organization is migrating a legacy application to a new cloud platform. The migration requires changes to the application's authentication mechanism. The security team must ensure that the change does not introduce vulnerabilities. However, the migration timeline is aggressive, and the business wants to minimize downtime. What is the best approach?

   • ASkip the security impact analysis to meet the migration deadline
   • BMigrate the application first and then perform a security review
   • CConduct a security impact analysis of the new authentication mechanism before migration
   • DUse the same authentication mechanism as the legacy system to avoid change
   Reveal Solution Discussion Select an answer first