A software company is developing a new application and wants to ensure it is secure from the start. The company has a DevSecOps culture and uses continuous integration/continuous deployment (CI/CD). Which practice is most effective for integrating security into the development process?

Performing manual security reviews by a separate team after each sprint.

Automating security testing in the CI/CD pipeline, including static analysis and dependency scanning.

Running a security scan only on the final build before release.

Relying on the security team to test the application after deployment.

A company has just purchased a new network firewall. The security team must ensure it is securely implemented and compliant with the organization's security policies. Which step is most critical during the implementation and assessment phase?

Hardening the firewall by changing default passwords, disabling unused services, and applying a baseline configuration.

Immediately connecting the firewall to the production network to test its performance.

Documenting the firewall's serial number and warranty information only.

Configuring the firewall with default settings to ensure it works out of the box.

What is a key difference between managing licenses for open-source and closed-source software?

Open-source software does not require license management at all

Open-source licenses often have specific usage and distribution terms, while closed-source licenses typically restrict usage and copying

Closed-source licenses are always free of charge

Open-source licenses prohibit any commercial use

A company is planning to acquire new laptops for its employees. The security team must ensure that the laptops are secure and meet the company's needs. Which phase of the asset management lifecycle should the security team focus on to define security requirements?

Disposal, where the laptops are decommissioned.

Operation and maintenance, where the laptops are patched and monitored.

Planning and initiation, where requirements are defined and risks are assessed.

Implementation, where the laptops are configured and deployed.

Which method is an example of secure hardware disposal?

Deleting files and emptying the recycle bin

Physically destroying the storage media

Moving the asset to a different location

Systems Security Certified Practitioner

Domain 1Objective 5

1.5 - Support and Implement Asset Management Lifecycle (i.e., Hardware, Software, and Data) SSCP Practice Questions (Page 3)

Part of the Security Concepts and Practices domain, which accounts for 16% of the SSCP exam. ISC2 does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–13 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

9concepts

16%of the exam

Questions 11–15

11expert · hard
A software company is developing a new application and wants to ensure it is secure from the start. The company has a DevSecOps culture and uses continuous integration/continuous deployment (CI/CD). Which practice is most effective for integrating security into the development process?
Select an answer first
12application · medium
A company has just purchased a new network firewall. The security team must ensure it is securely implemented and compliant with the organization's security policies. Which step is most critical during the implementation and assessment phase?
Select an answer first
13foundation · easy
What is a key difference between managing licenses for open-source and closed-source software?
Select an answer first
14application · medium
A company is planning to acquire new laptops for its employees. The security team must ensure that the laptops are secure and meet the company's needs. Which phase of the asset management lifecycle should the security team focus on to define security requirements?
Select an answer first
15foundation · easy
Which method is an example of secure hardware disposal?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SSCP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “SSCP” is a trademark of its owner, used for identification only.