A company is migrating legacy applications to AWS. The ISSMP mandates that changes to the production environment must follow a strict change control process. Which AWS native tool provides the necessary auditing and change management history for infrastructure changes?
A project team is using Jira for issue tracking and wants to implement a formal change control board (CCB) approval workflow. Which feature should the ISSMP configure to ensure changes cannot be merged without approval?
During a software audit, it is found that developers have administrative access to the production database to troubleshoot errors. What change should the ISSMP implement?
An ISSMP is leading a project to retire a legacy customer relationship management (CRM) system that contains personally identifiable information (PII). The system runs on a physical server with a RAID array, uses a directly attached tape library for backups, and has data replicated to a disaster recovery (DR) site. The organization must ensure that no PII remains accessible after decommissioning. Which two actions should the ISSMP include in the decommissioning plan? (Choose two.)
An ISSMP is defining the security requirements for a new containerized payment service that will be built and deployed through a CI/CD pipeline. The organization wants to prevent vulnerable images from ever reaching the production registry. Which TWO controls BEST satisfy this objective? (Choose two.)
During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?
During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?
An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?
An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?
An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?
An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?
An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?
An ISSMP is defining the disposal requirements for a new system that will process regulated financial data. The system uses a combination of on-premises servers with self-encrypting drives, cloud object storage, and encrypted backup tapes. Which action best ensures that data remanence is addressed across ALL media during the disposal phase?
An organization is initiating a project to develop a new mobile banking application. The ISSMP is tasked with ensuring that security requirements are identified and integrated from the very beginning of the systems development life cycle (SDLC). Which action should the ISSMP take FIRST to achieve this?
A financial services firm is acquiring a SaaS-based fraud analytics platform. During the due diligence phase of the system lifecycle, the vendor provides a SOC 2 Type II report covering the last 12 months, a completed security questionnaire, and a penetration test summary dated 18 months ago. The ISSMP must decide whether to accept the vendor for integration into the production environment. Which action best satisfies the ISSMP's responsibility at this lifecycle stage?
An organization is retiring a customer relationship management system that stored personally identifiable information. The system is scheduled for shutdown in 30 days, and the ISSMP must ensure the decommissioning aligns with lifecycle management and data protection obligations. Which action should the ISSMP prioritize?
An ISSMP is reviewing a project that will replace the organization's customer relationship management (CRM) system. The project manager proposes to reuse the existing security test plan from the legacy CRM to save time and cost. The new CRM is a cloud-based SaaS solution with different data flows and integrations. What should the ISSMP recommend?
During a post-implementation review of a new enterprise resource planning (ERP) system, the ISSMP discovers that the project team did not perform a security risk assessment during the design phase. The system is now in production and handles sensitive financial data. What should the ISSMP do FIRST?
An organization is adopting a DevSecOps model and wants to ensure that security requirements are continuously validated throughout the CI/CD pipeline. The ISSMP is asked to define the security control gates. Which approach BEST integrates security into the pipeline while maintaining development velocity?
An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)
An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?
An ISSMP is reviewing the system development lifecycle (SDLC) for a new payroll application. The organization must comply with PCI DSS because the application will process employee salary payments. At which phase should the ISSMP ensure that PCI DSS requirements are identified and documented?
During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?
An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?
An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?