ISC Systems Lifecycle Management Practice Test 2 — 15 Questions

Question 1

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Accepted Answer

Implementing artifact signing in the CI/CD pipeline.. Code signing (e.g., using Sigstore or GPG) ensures the integrity of artifacts from build to deployment, ensuring that only signed/authorized code reaches production.

Answer

Encrypting the entire source repository.

Answer

Using HTTPS for all internal traffic.

Answer

Running the build on a dedicated hardened server.

Question 2

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Accepted Answer

To identify and manage open-source component risks.. An SBOM provides a comprehensive list of all components, libraries, and modules used in an application, which is crucial for managing supply chain security risks (e.g., identifying vulnerable dependencies).

Answer

To outline the project timeline.

Answer

To track the financial cost of software licenses.

Answer

To document the application architecture.

Question 3

Which metric provides the best insight into the effectiveness of the security program within the SDLC?

Accepted Answer

Mean Time to Remediation (MTTR).. The 'Vulnerability Density' (vulnerabilities per KLOC) or 'Mean Time to Remediation' (MTTR) are the most effective metrics for demonstrating SDLC security health.

Answer

Number of servers decommissioned.

Answer

Number of lines of code written.

Answer

Number of developers hired.

Question 4

What is the primary role of a Change Advisory Board (CAB)?

Accepted Answer

To evaluate the risk and impact of proposed changes.. The CAB's primary role is to evaluate the technical and business impact of proposed changes, ensuring that all risks are identified and mitigated before approval.

Answer

To write the code for new features.

Answer

To perform automated penetration testing.

Answer

To manage the server hardware procurement budget.

Question 5

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Accepted Answer

Reviewing the vendor's SOC2 Type II report.. The ISSMP must perform a 'Third-Party Risk Assessment' (TPRA) that evaluates the vendor's security controls, such as their SOC2 Type II report or ISO 27001 certification, to ensure the integration does not violate company security standards.

Answer

Asking the vendor to sign a standard NDA.

Answer

Verifying the vendor's stock price.

Answer

Checking if the vendor has a nice website.

Question 6

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Accepted Answer

Continuous Threat Modeling. A secure SDLC requires both proactive security requirements (Threat Modeling) and detective security validation (Automated Testing) to be integrated into the process.

Answer

Manual annual security reviews

Answer

Standardized desktop operating systems

Answer

Outsourcing all security to a vendor

Question 7

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

Accepted Answer

The organization's threat landscape. Selecting controls involves balancing business requirements, regulatory compliance, and the actual threat landscape to ensure a proportionate risk response.

Answer

The vendor's marketing materials

Answer

The number of employees in the company

Question 8

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Accepted Answer

A detailed backout/rollback plan.. A formal change request must include a 'backout plan' (rollback procedure) to ensure service continuity if the change fails or causes unexpected issues.

Answer

The marketing department's approval.

Answer

A list of all software installed on the server.

Answer

A complete list of developer names.

Question 9

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Accepted Answer

Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs). Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.

Answer

Client-side input validation

Answer

Disabling logging of access attempts

Answer

Using sequential database IDs in URLs

Question 10

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

Accepted Answer

Deleting associated snapshots and backups. Decommissioning in the cloud involves ensuring data is wiped, access rights are removed, and the resources are actually terminated to prevent billing and security exposure.

Answer

Taking a final full-disk backup to a public S3 bucket

Answer

Updating the local hardware inventory

Question 11

Which TWO items must be documented in a Change Control Log after a successful production change?

Accepted Answer

The timestamp of the change. A change log must include the final outcome (status) and the timestamp to ensure traceability and audit accuracy.

Answer

The developer's personal home address

Answer

The names of all employees who saw the change code

Answer

The total budget of the organization

Question 12

Which THREE components should be included in an application security requirements document?

Accepted Answer

Authentication requirements (e.g., MFA). Requirements must include authentication, authorization, and data encryption standards to ensure the application is secure by design.

Answer

The marketing tagline for the product

Answer

The number of features to include

Question 13

Which THREE items are typically verified in a Security Gate check before a production deployment?

Accepted Answer

Formal change request approval is documented. Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).

Answer

The marketing campaign has been approved

Answer

The developer has finished their vacation

Question 14

Which TWO techniques are effective for securing the software supply chain?

Accepted Answer

Automated dependency vulnerability scanning. Supply chain security is best achieved by signing artifacts to prevent tampering and using vulnerability scanners to detect known issues in third-party dependencies.

Answer

Restricting internet access to all developers

Answer

Avoiding all code reviews

Answer

Using only software written in-house

Question 15

Which TWO of the following are potential risks if an ISSMP fails to integrate security into the 'Requirements Management' phase?

Accepted Answer

Inherent architectural design flaws. Failing to integrate security early results in 'bolted-on' security which is often flawed, expensive to fix, and leaves the system vulnerable to architectural design defects.

Answer

Better developer morale

Answer

Automatic regulatory compliance

Answer

Faster deployment velocity