1.9 Manage Security Programs ISSMP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company is adopting a new DevOps model where development teams deploy code to production frequently. The security team wants to ensure that security checks are performed without slowing down the deployment pipeline. Which approach best integrates security into this new process?

   • AProvide developers with a security checklist to follow before they submit their code for deployment.
   • BRequire a manual security review by the security team for every production deployment.
   • CEmbed automated security scanning tools into the CI/CD pipeline so that builds are checked for vulnerabilities before deployment.
   • DConduct a comprehensive security assessment of the application only after it has been deployed to production.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security team is responsible for patching vulnerabilities across the organization. The team lead notices that critical patches are sometimes applied late because it is unclear who is responsible for testing patches in the development environment before production deployment. Which action would most directly resolve this accountability gap?

   • ACreate a RACI matrix that explicitly assigns the responsibility for patch testing to a named individual in the development team.
   • BImplement a new automated patch management tool that can deploy patches directly to production without manual testing.
   • CAsk the development team lead to informally coordinate with the security team on patch testing.
   • DSend a weekly reminder email to the entire IT department about the importance of applying patches on time.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which practice is most effective for managing team performance to ensure security responsibilities are met?

   • AAvoiding negative feedback to maintain morale
   • BConducting regular performance reviews with clear metrics and feedback
   • COnly addressing performance issues during annual reviews
   • DAssigning all tasks to the most senior team member
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security manager is leading a project to integrate security requirements into the software development lifecycle (SDLC). The development team is resistant, viewing security as an obstacle to their agile delivery speed. The manager has limited budget and cannot hire new staff. Which strategy is most likely to build a productive relationship with the development team and achieve the integration goal?

   • AAsk the development team to document all security decisions they make and submit them for approval to the security team.
   • BHave the security team conduct a detailed security review of the code after each sprint and send a list of findings to the development manager.
   • CAssign a security champion from within the development team to act as a liaison and provide peer-to-peer guidance on security requirements.
   • DMandate that all developers complete a comprehensive security training course before they can commit any code.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A security manager is responsible for a security awareness program. The program's metrics show that employees are not completing the training modules, and the security team is not receiving feedback from department managers about specific training needs. The manager suspects the communication between the security team and department managers is poor. What is the most effective way to identify and overcome this communication bottleneck?

   • ASend a survey to all employees asking them why they are not completing the training.
   • BIncrease the frequency of email reminders about the training to all employees.
   • CMake the training modules shorter and more engaging to increase completion rates.
   • DConduct structured interviews with a sample of department managers to understand their communication preferences and barriers to engagement.
   Reveal Solution Discussion Select an answer first