ISC Systems Lifecycle Management — 20 Questions

Question 1

A company is migrating legacy applications to AWS. The ISSMP mandates that changes to the production environment must follow a strict change control process. Which AWS native tool provides the necessary auditing and change management history for infrastructure changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. While AWS CloudTrail logs API calls, AWS Config is the specific AWS native tool designed for tracking configuration changes, evaluating historical configurations, and providing change management history for infrastructure resources to meet compliance mandates.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Trusted Advisor

Question 2

A project team is using Jira for issue tracking and wants to implement a formal change control board (CCB) approval workflow. Which feature should the ISSMP configure to ensure changes cannot be merged without approval?

Accepted Answer

Automation for Jira. To ensure that external actions or conditions like CCB approvals are met before proceeding (often integrating Jira with CI/CD tools via webhooks or checking status before allowing deployment/merging), Automation for Jira or branch restriction settings in the source control tool are typically used. However, strictly within Jira workflow configuration, validators check input *during* a transition, but enforcing merge restrictions specifically relies on CI/CD integration rules.

Answer

Workflow Validators

Answer

Issue Security Levels

Answer

Post-functions

Question 3

Which document defines the security requirements that must be met for a third-party vendor to integrate with the company's internal systems?

Accepted Answer

Interconnection Security Agreement (ISA). The Interconnection Security Agreement (ISA) specifically outlines the security requirements and responsibilities for connecting two systems.

Answer

Memorandum of Understanding (MOU)

Answer

Service Level Agreement

Answer

Acceptable Use Policy

Question 4

During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?

Accepted Answer

Implement Just-In-Time (JIT) privileged access for troubleshooting.. Implementing Just-In-Time (JIT) privileged access allows developers to request and receive temporary, least-privilege access only when needed for specific troubleshooting tasks, which is then automatically revoked. Persistent standing access violates the principle of least privilege.

Answer

Remove all access and require developers to submit tickets for DBAs to perform changes.

Answer

Create a shared 'admin' account for all developers.

Answer

Only allow access during business hours.

Question 5

Which metric provides the best insight into the effectiveness of the security program within the SDLC?

Accepted Answer

Mean Time to Remediation (MTTR).. The 'Vulnerability Density' (vulnerabilities per KLOC) or 'Mean Time to Remediation' (MTTR) are the most effective metrics for demonstrating SDLC security health.

Answer

Number of servers decommissioned.

Answer

Number of lines of code written.

Answer

Number of developers hired.

Question 6

Which TWO of the following are potential risks if an ISSMP fails to integrate security into the 'Requirements Management' phase?

Accepted Answer

Inherent architectural design flaws. Failing to integrate security early results in 'bolted-on' security which is often flawed, expensive to fix, and leaves the system vulnerable to architectural design defects.

Answer

Better developer morale

Answer

Automatic regulatory compliance

Answer

Faster deployment velocity

Question 7

An ISSMP is leading a project to retire a legacy customer relationship management (CRM) system that contains personally identifiable information (PII). The system runs on a physical server with a RAID array, uses a directly attached tape library for backups, and has data replicated to a disaster recovery (DR) site. The organization must ensure that no PII remains accessible after decommissioning. Which two actions should the ISSMP include in the decommissioning plan? (Choose two.)

Accepted Answer

Perform cryptographic erasure on the RAID array by destroying the encryption keys, and degauss the backup tapes.. The decommissioning plan must address all locations where PII resides: the primary RAID array, backup tapes, and DR replicas. Cryptographic erasure and degaussing effectively sanitize the primary and tape media, while following NIST SP 800-88 and verifying DR erasure ensures that no copies remain. These actions together provide a defensible, auditable process for eliminating PII.

Answer

Use the storage array's built-in secure erase function for the RAID array, and rely on the DR site's replication deletion to remove all copies.

Answer

Overwrite the RAID array with a single pass of zeros, and delete the replicated data at the DR site using the storage array's management interface.

Answer

Shred the physical server's hard drives and obtain a certificate of data destruction for the backup tapes from the tape vendor.

Question 8

An ISSMP is defining the security requirements for a new containerized payment service that will be built and deployed through a CI/CD pipeline. The organization wants to prevent vulnerable images from ever reaching the production registry. Which TWO controls BEST satisfy this objective? (Choose two.)

Accepted Answer

Enforce an admission controller policy that rejects any image lacking a valid cryptographic signature from the organization's trusted build signer.. Preventing vulnerable images from reaching the production registry requires controls at both the creation and admission points. Pipeline scanning fails the build before a vulnerable artifact is published, and an admission controller enforcing signed images blocks anything not produced by the trusted build signer from being deployed. Together they make it impossible for an unvetted or unsigned image to run, whereas alerts, manual workstation scans, and tag immutability either act too late or address unrelated risks.

Answer

Require developers to run a local scanning tool on their workstations and attach the scan report to the pull request before merging.

Answer

Enable immutable tags on the production registry so that an existing image tag cannot be overwritten with different content after it is pushed.

Answer

Configure the production registry to send an alert to the security team whenever an image containing critical vulnerabilities is pulled by a running pod.

Question 9

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

Accepted Answer

Requiring a separate release team to deploy changes approved by a Change Advisory Board (CAB).. Separation of Duties (SoD) requires that no single individual controls all phases of a critical transaction — the person who writes or approves a change should not be the same person who deploys it. Option D satisfies this by splitting responsibilities: the CAB approves the change, and a separate release team executes the deployment, ensuring independent verification and accountability. This creates a documented, auditable chain of custody that demonstrates compliance with ISSMP governance expectations.

Answer

The ISSMP personally reviewing every SQL script.

Answer

Allowing the automated CI/CD tool to deploy without human review.

Answer

Having the DBA perform the deployment in staging and production.

Question 10

What is the primary objective of a 'Security Gate' in an SDLC?

Accepted Answer

To ensure security activities were completed before moving to the next phase.. Security gates are checkpoints placed at the end of SDLC phases to verify that security requirements have been satisfied before proceeding to the next stage.

Answer

To automate the removal of legacy hardware.

Answer

To stop all software development until the budget is approved.

Answer

To provide a location for developers to submit their resignation.

Question 11

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Accepted Answer

System Security Plan (SSP). The System Security Plan (SSP) is the formal document that describes the system boundary, the security controls implemented or planned, and how those controls meet the applicable security requirements. It is developed during the requirements phase of the SDLC and evolves through the lifecycle, making it the primary artifact for documenting applicable security controls.

Answer

Acceptable Use Policy (AUP)

Answer

Service Level Agreement (SLA)

Answer

Business Impact Analysis (BIA)

Question 12

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

Accepted Answer

Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.. The ISSMP should reconcile Agile adoption with security governance by embedding security requirements into the Definition of Done and expressing them as security user stories (A). This preserves traceability and accountability without forcing waterfall artifacts, aligning with frameworks like NIST SSDF and OWASP SAMM that support Agile-native security requirements.

Answer

Mandate that the project manager create a manual SRTM separately from the development tasks.

Answer

Deny the transition until full waterfall documentation is restored.

Answer

Allow the team to omit security requirements to speed up deployment.

Question 13

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

Accepted Answer

Development/Build phase. SAST (Static Application Security Testing) tools analyze source code or binaries for security vulnerabilities without executing the program. They are most effective when integrated into the Development/Build phase of the SDLC, where code is written and compiled. Enforcing SAST at this stage allows developers to identify and remediate security flaws early, reducing cost and effort compared to fixing issues later in production. This aligns with the shift-left security principle in DevOps, ensuring security requirements are met from the start.

Answer

Decommissioning phase

Answer

Post-deployment monitoring

Answer

Requirements gathering phase

Question 14

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

Accepted Answer

Kubernetes Admission Controllers. Kubernetes Admission Controllers intercept requests to the API server before persistence, allowing enforcement of security policies such as pod security standards, resource limits, and image provenance. They ensure consistent application of configurations across all clusters by validating or mutating resources at creation time.

Answer

Regular penetration testing

Answer

Manual code review of Dockerfiles

Answer

Role-Based Access Control (RBAC) only

Question 15

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

Accepted Answer

Static Analysis for IaC (e.g., tfsec/Checkov).. Integrating static analysis tools for IaC (like 'tfsec' or 'Checkov') into the pipeline identifies insecure configurations before the 'terraform apply' command is executed.

Answer

Manual Terraform code review logs.

Answer

Using AWS IAM policies only.

Answer

Disabling the Terraform 'plan' command.

Question 16

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

Accepted Answer

Using a Service Mesh (e.g., Istio) to enforce mTLS.. A Service Mesh (e.g., Istio) provides a dedicated infrastructure layer that can enforce mutual TLS (mTLS) for all inter-service communication, ensuring encryption and mutual authentication between services. It abstracts security concerns from the application code and provides centralized policy management. This is the most effective way to secure microservices communication at scale.

Answer

Hardcoding API keys into environment variables.

Answer

Installing an antivirus agent on every container.

Answer

Using a standard VPN between all services.

Question 17

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

Accepted Answer

Secure sanitization of storage media.. Secure sanitization of storage media is the correct action because it ensures that all residual data is irrecoverably destroyed, satisfying GDPR's requirement for data erasure (Article 17, Right to Erasure) and preventing unauthorized access. This process includes methods like degaussing, cryptographic erasure, or physical destruction, which are necessary when decommissioning systems that held personal data. Other actions, such as archiving or notifying vendors, do not directly address the core privacy requirement of eliminating data remnants.

Answer

Archiving the data to unencrypted tape drives.

Answer

Notifying all third-party vendors.

Answer

Deleting the source code repository.

Question 18

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 19

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows security architects to identify potential threats and design mitigations before code is written or systems are deployed. Conducting it early avoids costly rework and ensures security controls are built into the architecture. The design phase is where data flows, trust boundaries, and components are defined, which are the inputs threat modeling requires.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 20

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Accepted Answer

Implementing artifact signing in the CI/CD pipeline.. Code signing (e.g., using Sigstore or GPG) ensures the integrity of artifacts from build to deployment, ensuring that only signed/authorized code reaches production.

Answer

Encrypting the entire source repository.

Answer

Using HTTPS for all internal traffic.

Answer

Running the build on a dedicated hardened server.