ISC Systems Lifecycle Management — 20 Questions

Question 1

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).. Separation of duties requires that the person who develops the change (DBA) is different from the person who approves the change (Change Manager) and the person who performs the production deployment (Release Engineer).

Answer

The ISSMP personally reviewing every SQL script.

Answer

Allowing the automated CI/CD tool to deploy without human review.

Answer

Having the DBA perform the deployment in staging and production.

Question 2

A company is migrating legacy applications to AWS. The ISSMP mandates that changes to the production environment must follow a strict change control process. Which AWS native tool provides the necessary auditing and change management history for infrastructure changes?

Accepted Answer

AWS CloudTrail. AWS CloudTrail provides the audit trail of API calls and infrastructure changes, which is the cornerstone of change control auditing.

Answer

AWS Shield

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 3

What is the primary objective of a 'Security Gate' in an SDLC?

Accepted Answer

To ensure security activities were completed before moving to the next phase.. Security gates are checkpoints placed at the end of SDLC phases to verify that security requirements have been satisfied before proceeding to the next stage.

Answer

To automate the removal of legacy hardware.

Answer

To stop all software development until the budget is approved.

Answer

To provide a location for developers to submit their resignation.

Question 4

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the foundational document that defines the security controls selected and implemented for a system.

Answer

Acceptable Use Policy (AUP)

Answer

Service Level Agreement (SLA)

Answer

Business Impact Analysis (BIA)

Question 5

A project team is using Jira for issue tracking and wants to implement a formal change control board (CCB) approval workflow. Which feature should the ISSMP configure to ensure changes cannot be merged without approval?

Accepted Answer

Workflow Validators. Using Jira's 'Workflow Validator' or 'Conditions' on the transition to the 'Ready for Production' status enforces that approvals (e.g., from an authorized manager) are logged before code can be merged.

Answer

Automation for Jira

Answer

Issue Security Levels

Answer

Post-functions

Question 6

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

Accepted Answer

Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.. The ISSMP should ensure security requirements are documented as 'Abuse Cases' or 'Security User Stories' within the existing Agile backlog management tool to maintain traceability.

Answer

Mandate that the project manager create a manual SRTM separately from the development tasks.

Answer

Deny the transition until full waterfall documentation is restored.

Answer

Allow the team to omit security requirements to speed up deployment.

Question 7

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

Accepted Answer

Development/Build phase. Security integration requires SAST (Static Application Security Testing) to be performed during the development phase, specifically as part of the commit or build process.

Answer

Decommissioning phase

Answer

Post-deployment monitoring

Answer

Requirements gathering phase

Question 8

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

Accepted Answer

Kubernetes Admission Controllers. Using Kubernetes 'Admission Controllers' (e.g., OPA Gatekeeper) allows the enforcement of security policies (such as preventing privilege escalation) consistently across all deployments.

Answer

Regular penetration testing

Answer

Manual code review of Dockerfiles

Answer

Role-Based Access Control (RBAC) only

Question 9

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

Accepted Answer

Static Analysis for IaC (e.g., tfsec/Checkov).. Integrating static analysis tools for IaC (like 'tfsec' or 'Checkov') into the pipeline identifies insecure configurations before the 'terraform apply' command is executed.

Answer

Manual Terraform code review logs.

Answer

Using AWS IAM policies only.

Answer

Disabling the Terraform 'plan' command.

Question 10

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

Accepted Answer

Using a Service Mesh (e.g., Istio) to enforce mTLS.. Implementing a Service Mesh (e.g., Istio) provides mutual TLS (mTLS) for encrypted communication and cryptographic identity verification between services.

Answer

Hardcoding API keys into environment variables.

Answer

Installing an antivirus agent on every container.

Answer

Using a standard VPN between all services.

Question 11

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

Accepted Answer

Secure sanitization of storage media.. The most critical step in decommissioning is the secure sanitization (clearing or purging) of storage media according to industry standards (e.g., NIST SP 800-88).

Answer

Archiving the data to unencrypted tape drives.

Answer

Notifying all third-party vendors.

Answer

Deleting the source code repository.

Question 12

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 13

Which document defines the security requirements that must be met for a third-party vendor to integrate with the company's internal systems?

Accepted Answer

Interconnection Security Agreement (ISA). The Interconnection Security Agreement (ISA) specifically outlines the security requirements and responsibilities for connecting two systems.

Answer

Memorandum of Understanding (MOU)

Answer

Service Level Agreement

Answer

Acceptable Use Policy

Question 14

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows architects to identify and mitigate design-level security flaws before implementation begins.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 15

During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?

Accepted Answer

Implement Just-In-Time (JIT) privileged access for troubleshooting.. The ISSMP should implement a 'break-glass' access policy where developers can request temporary, audited access via a tool like HashiCorp Boundary or AWS IAM Identity Center, rather than having persistent standing access.

Answer

Remove all access and require developers to submit tickets for DBAs to perform changes.

Answer

Create a shared 'admin' account for all developers.

Answer

Only allow access during business hours.

Question 16

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Accepted Answer

Implementing artifact signing in the CI/CD pipeline.. Code signing (e.g., using Sigstore or GPG) ensures the integrity of artifacts from build to deployment, ensuring that only signed/authorized code reaches production.

Answer

Encrypting the entire source repository.

Answer

Using HTTPS for all internal traffic.

Answer

Running the build on a dedicated hardened server.

Question 17

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Accepted Answer

To identify and manage open-source component risks.. An SBOM provides a comprehensive list of all components, libraries, and modules used in an application, which is crucial for managing supply chain security risks (e.g., identifying vulnerable dependencies).

Answer

To outline the project timeline.

Answer

To track the financial cost of software licenses.

Answer

To document the application architecture.

Question 18

Which metric provides the best insight into the effectiveness of the security program within the SDLC?

Accepted Answer

Mean Time to Remediation (MTTR).. The 'Vulnerability Density' (vulnerabilities per KLOC) or 'Mean Time to Remediation' (MTTR) are the most effective metrics for demonstrating SDLC security health.

Answer

Number of servers decommissioned.

Answer

Number of lines of code written.

Answer

Number of developers hired.

Question 19

What is the primary role of a Change Advisory Board (CAB)?

Accepted Answer

To evaluate the risk and impact of proposed changes.. The CAB's primary role is to evaluate the technical and business impact of proposed changes, ensuring that all risks are identified and mitigated before approval.

Answer

To write the code for new features.

Answer

To perform automated penetration testing.

Answer

To manage the server hardware procurement budget.

Question 20

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Accepted Answer

Reviewing the vendor's SOC2 Type II report.. The ISSMP must perform a 'Third-Party Risk Assessment' (TPRA) that evaluates the vendor's security controls, such as their SOC2 Type II report or ISO 27001 certification, to ensure the integration does not violate company security standards.

Answer

Asking the vendor to sign a standard NDA.

Answer

Verifying the vendor's stock price.

Answer

Checking if the vendor has a nice website.