Systems Lifecycle Management

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

A company is migrating legacy applications to AWS. The ISSMP mandates that changes to the production environment must follow a strict change control process. Which AWS native tool provides the necessary auditing and change management history for infrastructure changes?

What is the primary objective of a 'Security Gate' in an SDLC?

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

A project team is using Jira for issue tracking and wants to implement a formal change control board (CCB) approval workflow. Which feature should the ISSMP configure to ensure changes cannot be merged without approval?

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Which document defines the security requirements that must be met for a third-party vendor to integrate with the company's internal systems?

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Which metric provides the best insight into the effectiveness of the security program within the SDLC?

What is the primary role of a Change Advisory Board (CAB)?

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

Which TWO items must be documented in a Change Control Log after a successful production change?

Which THREE components should be included in an application security requirements document?

Which THREE items are typically verified in a Security Gate check before a production deployment?

Which TWO techniques are effective for securing the software supply chain?

Which TWO of the following are potential risks if an ISSMP fails to integrate security into the 'Requirements Management' phase?