ISC Systems Lifecycle Management Practice Test 2 — 15 Questions

Question 1

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

Accepted Answer

Using a Service Mesh (e.g., Istio) to enforce mTLS.. A Service Mesh (e.g., Istio) provides a dedicated infrastructure layer that can enforce mutual TLS (mTLS) for all inter-service communication, ensuring encryption and mutual authentication between services. It abstracts security concerns from the application code and provides centralized policy management. This is the most effective way to secure microservices communication at scale.

Answer

Hardcoding API keys into environment variables.

Answer

Installing an antivirus agent on every container.

Answer

Using a standard VPN between all services.

Question 2

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

Accepted Answer

Secure sanitization of storage media.. Secure sanitization of storage media is the correct action because it ensures that all residual data is irrecoverably destroyed, satisfying GDPR's requirement for data erasure (Article 17, Right to Erasure) and preventing unauthorized access. This process includes methods like degaussing, cryptographic erasure, or physical destruction, which are necessary when decommissioning systems that held personal data. Other actions, such as archiving or notifying vendors, do not directly address the core privacy requirement of eliminating data remnants.

Answer

Archiving the data to unencrypted tape drives.

Answer

Notifying all third-party vendors.

Answer

Deleting the source code repository.

Question 3

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Accepted Answer

Document a formal Risk Acceptance with the business owner.. The ISSMP must initiate a formal Risk Acceptance process, requiring the business owner to acknowledge the residual risk and documenting it in the risk register.

Answer

Rewrite the application code personally.

Answer

Ignore the finding as it is non-critical.

Answer

Force the patch regardless of impact.

Question 4

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Accepted Answer

Design phase. Threat modeling is most effective during the design phase because it allows security architects to identify potential threats and design mitigations before code is written or systems are deployed. Conducting it early avoids costly rework and ensures security controls are built into the architecture. The design phase is where data flows, trust boundaries, and components are defined, which are the inputs threat modeling requires.

Answer

Release phase

Answer

Operations and Maintenance

Answer

Initiation phase

Question 5

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Accepted Answer

Implementing artifact signing in the CI/CD pipeline.. Code signing (e.g., using Sigstore or GPG) ensures the integrity of artifacts from build to deployment, ensuring that only signed/authorized code reaches production.

Answer

Encrypting the entire source repository.

Answer

Using HTTPS for all internal traffic.

Answer

Running the build on a dedicated hardened server.

Question 6

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

Accepted Answer

To identify and manage open-source component risks.. An SBOM provides a comprehensive list of all components, libraries, and modules used in an application, which is crucial for managing supply chain security risks (e.g., identifying vulnerable dependencies).

Answer

To outline the project timeline.

Answer

To track the financial cost of software licenses.

Answer

To document the application architecture.

Question 7

What is the primary role of a Change Advisory Board (CAB)?

Accepted Answer

To evaluate the risk and impact of proposed changes.. The CAB is a governance body within ITIL/ITSM change management whose core purpose is to review proposed changes (typically Normal Changes) and assess their risk, impact, and resource requirements before authorizing them. It does not execute the change itself but provides oversight and approval decisions, ensuring changes are prioritized and scheduled to minimize disruption to production services.

Answer

To write the code for new features.

Answer

To perform automated penetration testing.

Answer

To manage the server hardware procurement budget.

Question 8

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Accepted Answer

Reviewing the vendor's SOC2 Type II report.. The ISSMP must perform a 'Third-Party Risk Assessment' (TPRA) that evaluates the vendor's security controls, such as their SOC2 Type II report or ISO 27001 certification, to ensure the integration does not violate company security standards.

Answer

Asking the vendor to sign a standard NDA.

Answer

Verifying the vendor's stock price.

Answer

Checking if the vendor has a nice website.

Question 9

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Accepted Answer

Continuous Threat Modeling. Option D (Continuous Threat Modeling) is correct because a secure SDLC requires threat modeling to be an ongoing activity integrated throughout the lifecycle, not a one-time event, so that new attack surfaces and design changes are identified and mitigated as the software evolves. Option E (Automated security testing in the pipeline) is correct because embedding SAST, DAST, SCA, and similar automated checks into CI/CD pipelines enforces security gates on every build, catching vulnerabilities early and consistently rather than relying on sporadic manual review. The unmarked options do not belong: A (Manual annual security reviews) is too infrequent and reactive to be a critical component, B (Standardized desktop operating systems) is an endpoint-hardening control unrelated to the software development process, and C (Outsourcing all security to a vendor) is not a secure SDLC practice since accountability for security cannot be fully delegated and must remain with the developing organization.

Answer

Manual annual security reviews

Answer

Standardized desktop operating systems

Answer

Outsourcing all security to a vendor

Question 10

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

Accepted Answer

The organization's threat landscape. Selecting controls involves balancing business requirements, regulatory compliance, and the actual threat landscape to ensure a proportionate risk response.

Answer

The vendor's marketing materials

Answer

The number of employees in the company

Question 11

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

Accepted Answer

A detailed backout/rollback plan.. A detailed backout/rollback plan is essential for every change request because it defines how to revert the change if it causes an outage, degradation, or unexpected side effects. Change control boards require it to assess risk and ensure the organization can restore service within acceptable recovery objectives.

Answer

The marketing department's approval.

Answer

A list of all software installed on the server.

Answer

A complete list of developer names.

Question 12

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

Accepted Answer

Using non-enumerable, cryptographically strong identifiers (e.g., UUIDs). Preventing IDOR requires both server-side authorization checks and the use of indirect/randomized identifiers rather than sequential, predictable keys.

Answer

Client-side input validation

Answer

Disabling logging of access attempts

Answer

Using sequential database IDs in URLs

Question 13

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

Accepted Answer

Deleting associated snapshots and backups. Decommissioning in the cloud involves ensuring data is wiped, access rights are removed, and the resources are actually terminated to prevent billing and security exposure.

Answer

Taking a final full-disk backup to a public S3 bucket

Answer

Updating the local hardware inventory

Question 14

Which TWO items must be documented in a Change Control Log after a successful production change?

Accepted Answer

The timestamp of the change. A change log must include the final outcome (status) and the timestamp to ensure traceability and audit accuracy.

Answer

The developer's personal home address

Answer

The names of all employees who saw the change code

Answer

The total budget of the organization

Question 15

Which THREE components should be included in an application security requirements document?

Accepted Answer

Authentication requirements (e.g., MFA). Authentication requirements (B) belong because the document must specify how users and services prove identity, including MFA, password policies, and session handling. Encryption standards (C) belong because they define how data is protected in transit and at rest, such as requiring TLS 1.3 and approved cipher suites. Authorization/access control definitions (D) belong because they establish who can access which resources and under what conditions, covering roles, permissions, and least privilege. The marketing tagline (A) is promotional content, not a security control, and the number of features (E) is a product scope decision, not a security requirement.

Answer

The marketing tagline for the product

Answer

The number of features to include