ISC Systems Lifecycle Management Practice Test 3 — 15 Questions

Question 1

Which THREE items are typically verified in a Security Gate check before a production deployment?

Accepted Answer

Formal change request approval is documented. Production gates check for vulnerability remediation, passing functional/security tests, and the presence of required documentation (like the change request).

Answer

The marketing campaign has been approved

Answer

The developer has finished their vacation

Question 2

Which TWO techniques are effective for securing the software supply chain?

Accepted Answer

Automated dependency vulnerability scanning. Supply chain security is best achieved by signing artifacts to prevent tampering and using vulnerability scanners to detect known issues in third-party dependencies.

Answer

Restricting internet access to all developers

Answer

Avoiding all code reviews

Answer

Using only software written in-house

Question 3

An ISSMP is defining the disposal requirements for a new system that will process regulated financial data. The system uses a combination of on-premises servers with self-encrypting drives, cloud object storage, and encrypted backup tapes. Which action best ensures that data remanence is addressed across ALL media during the disposal phase?

Accepted Answer

Implement a cryptographic erasure process by destroying the keys for self-encrypting drives and cloud storage, and sanitize backup tapes according to NIST SP 800-88 guidelines.. Cryptographic erasure is the most effective method for self-encrypting drives and cloud storage because it destroys the keys, making data unrecoverable without the need for physical destruction. For backup tapes, following NIST SP 800-88 ensures proper sanitization. This combined approach addresses all media types in the scenario, ensuring regulatory compliance and preventing data remanence across the entire system.

Answer

Overwrite all storage with a single pass of random data and then delete the cloud storage buckets.

Answer

Degauss all magnetic media and shred all optical media before disposal.

Answer

Delete all data using the native tools of each platform and obtain a certificate of destruction from the cloud provider.

Question 4

An organization is initiating a project to develop a new mobile banking application. The ISSMP is tasked with ensuring that security requirements are identified and integrated from the very beginning of the systems development life cycle (SDLC). Which action should the ISSMP take FIRST to achieve this?

Accepted Answer

Conduct a threat modeling workshop with the development team and key stakeholders during the requirements phase.. Threat modeling during the requirements phase is the most effective first step because it systematically identifies threats and informs the security requirements that must be built into the mobile banking app. This proactive approach ensures that security is considered from the outset, reducing the risk of vulnerabilities and costly redesigns later in the SDLC.

Answer

Create a security awareness training program for all developers before any coding begins.

Answer

Develop a comprehensive security test plan to be executed during the testing phase.

Answer

Perform a penetration test on the application's prototype after the design phase is complete.

Question 5

A financial services firm is acquiring a SaaS-based fraud analytics platform. During the due diligence phase of the system lifecycle, the vendor provides a SOC 2 Type II report covering the last 12 months, a completed security questionnaire, and a penetration test summary dated 18 months ago. The ISSMP must decide whether to accept the vendor for integration into the production environment. Which action best satisfies the ISSMP's responsibility at this lifecycle stage?

Accepted Answer

Request a current penetration test report scoped to the integration interface and verify remediation of prior findings before granting conditional acceptance.. A stale penetration test cannot validate the current security posture of a vendor or the new integration interface, so the ISSMP must obtain fresh, scoped testing and confirm remediation before acceptance. Conditional acceptance preserves the business timeline while satisfying lifecycle due diligence. The SOC 2 Type II report is valuable for control assurance but does not substitute for technical testing of the specific integration.

Answer

Defer the decision entirely to the legal team, because vendor risk acceptance is a contractual matter rather than an ISSMP lifecycle responsibility.

Answer

Reject the vendor immediately because the penetration test is older than 12 months, since any test older than one year is automatically disqualifying under the SDLC security policy.

Answer

Accept the vendor based on the SOC 2 Type II report, because it covers a full 12-month period and supersedes the need for a current penetration test.

Question 6

An organization is retiring a customer relationship management system that stored personally identifiable information. The system is scheduled for shutdown in 30 days, and the ISSMP must ensure the decommissioning aligns with lifecycle management and data protection obligations. Which action should the ISSMP prioritize?

Accepted Answer

Perform a data inventory across all environments, apply the retention schedule, and execute verified secure destruction of personal data with formal certification.. Decommissioning must account for personal data wherever it resides, not just in the production database. A full inventory identifies backups, replicas, and derived datasets, and the retention schedule determines what may be kept lawfully. Verified destruction with certification gives the organization defensible evidence that privacy obligations were met, closing the lifecycle properly rather than leaving orphaned copies behind.

Answer

Delete the production database records and decommission the servers, then document the shutdown in the change management system.

Answer

Archive the production database to a lower-cost cold storage tier and retain it indefinitely in case of future litigation or audit needs.

Answer

Anonymize the production records by removing the customer name column, then retain the remaining data indefinitely for business analytics.

Question 7

An ISSMP is reviewing a project that will replace the organization's customer relationship management (CRM) system. The project manager proposes to reuse the existing security test plan from the legacy CRM to save time and cost. The new CRM is a cloud-based SaaS solution with different data flows and integrations. What should the ISSMP recommend?

Accepted Answer

Require a new security test plan tailored to the SaaS CRM's architecture, data flows, and threat model.. The correct approach is to develop a security test plan specific to the new SaaS CRM. Because the system architecture, data flows, and threat model differ from the legacy on-premises CRM, the old test plan would not cover cloud-specific risks. The ISSMP must ensure that security testing is aligned with the current system and its risk profile, as part of effective systems lifecycle management.

Answer

Delegate the decision to the SaaS vendor's security team since they own the platform.

Answer

Approve the reuse of the legacy test plan because the functional requirements are similar.

Answer

Reuse the legacy plan but add a penetration test after go-live to cover any gaps.

Question 8

During a post-implementation review of a new enterprise resource planning (ERP) system, the ISSMP discovers that the project team did not perform a security risk assessment during the design phase. The system is now in production and handles sensitive financial data. What should the ISSMP do FIRST?

Accepted Answer

Initiate a full security risk assessment of the production ERP system and document the findings.. The first step is to perform a security risk assessment of the production ERP system. This will identify vulnerabilities, threats, and potential impacts, enabling the ISSMP to prioritize remediation and advise on risk treatment. Halting operations, assigning blame, or waiting for an audit do not address the immediate need to understand and manage the risk to sensitive financial data.

Answer

Report the oversight to the project manager's supervisor and request disciplinary action.

Answer

Immediately halt all ERP operations until a risk assessment can be completed.

Answer

Wait until the next scheduled audit to raise the issue and include it in the audit findings.

Question 9

An organization is adopting a DevSecOps model and wants to ensure that security requirements are continuously validated throughout the CI/CD pipeline. The ISSMP is asked to define the security control gates. Which approach BEST integrates security into the pipeline while maintaining development velocity?

Accepted Answer

Automated static and dynamic application security testing (SAST/DAST) integrated into the build and test stages, with quality gates that fail the build on critical findings.. The best approach is to integrate automated SAST and DAST into the CI/CD pipeline with quality gates that fail the build on critical findings. This provides continuous security validation, shifts security left, and maintains development velocity by automating checks. Manual reviews, training, or periodic penetration tests do not offer the same level of continuous, integrated assurance.

Answer

Manual security reviews at the end of each sprint before deployment to production.

Answer

Performing a full penetration test once per quarter and addressing findings in the next release.

Answer

Requiring developers to attend annual secure coding training and sign a security policy acknowledgment.

Question 10

An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)

Accepted Answer

Embedding a security champion within each development team to advocate for and review security practices.. The most effective practices are embedding security champions in each team and defining security requirements as user stories with acceptance criteria. Champions provide local advocacy and expertise, while user stories make security visible and trackable in the agile backlog. Together, they ensure continuous security integration in a distributed environment, unlike late reviews, centralized decision-making, or passive documentation.

Answer

Using a shared document repository for security policies that developers can consult as needed.

Answer

Conducting a comprehensive security review only at the end of the project before release.

Answer

Requiring all security decisions to be made by the central security team to ensure consistency.

Question 11

An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?

Accepted Answer

Require the vendor to undergo a SOC 2 Type II examination and review the report's trust services criteria and complementary user entity controls.. When source code review and on-site assessment are not feasible, the strongest pre-contract assurance comes from an independent examination of the vendor's controls over a period of time. A SOC 2 Type II report, read together with its trust services criteria and complementary user entity controls, tells the ISSMP both what was tested and what the organization must do to rely on those controls. Self-attestations, point-in-time tests, and deferred audits do not close the assurance gap before PII is entrusted to the vendor.

Answer

Request the vendor's most recent penetration test executive summary and treat a passing result as evidence that the product satisfies the security requirements.

Answer

Accept the vendor's completed consensus assessment questionnaire as sufficient evidence because it is signed by the vendor's Chief Information Security Officer.

Answer

Insert a contractual right to audit into the master services agreement and defer all assurance activities until the first annual audit after go-live.

Question 12

An ISSMP is reviewing the system development lifecycle (SDLC) for a new payroll application. The organization must comply with PCI DSS because the application will process employee salary payments. At which phase should the ISSMP ensure that PCI DSS requirements are identified and documented?

Accepted Answer

Requirements phase. PCI DSS requirements should be identified and documented during the requirements phase. This ensures that compliance controls are designed into the system from the start, avoiding costly rework and ensuring that the payroll application meets regulatory obligations. Later phases are for designing, testing, and deploying those requirements, not for discovering them.

Answer

Design phase

Answer

Testing phase

Answer

Deployment phase

Question 13

During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?

Accepted Answer

Open a change request, assess the risk and patch impact, and route the change through the organization's change management process for approval and scheduling.. A vendor-supplied patch for a critical vulnerability is a change to the production environment and must be processed through change management, where impact analysis, testing, approval, and rollback planning are performed. Initiating the change request first preserves both security and availability, and the process can be expedited through an emergency change path if the risk warrants faster action. Applying the patch blindly, relying only on a compensating control, or merely logging the finding all fail to remediate the flaw properly.

Answer

Document the vulnerability in the risk register, assign it a residual risk rating, and defer remediation to the next scheduled release cycle.

Answer

Immediately apply the vendor patch directly to the production servers to eliminate the exposure as quickly as possible.

Answer

Add a compensating network control such as a virtual patching rule at the web application firewall and close the finding without patching the library.

Question 14

An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?

Accepted Answer

Define and execute a data migration and sanitization plan that classifies legacy identity data, migrates only what is required, and cryptographically erases or destroys the remainder before decommissioning the legacy platform.. Managing identity data across a platform replacement means applying the full data lifecycle: classify and minimize what is migrated, protect it in transit and at rest, and ensure the source data is irrecoverably removed before the legacy system is retired. Cryptographic erasure or physical destruction provides evidence that sensitive identity data cannot be recovered, satisfying privacy and retention requirements. Indefinite backups, ordinary file deletion, and leaving the old platform running all fail to close the lifecycle risk.

Answer

Migrate all legacy identity records to the new platform and delete the legacy database files using the operating system's standard file deletion command.

Answer

Keep the legacy identity platform running in read-only mode indefinitely so that users retain access to historical records while the new system is validated.

Answer

Perform a full backup of the legacy identity database and retain it indefinitely in the new platform's backup infrastructure in case historical records are needed.

Question 15

An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?

Accepted Answer

Establish a process to monitor regulatory changes, perform periodic control assessments against the current framework version, and feed identified gaps into the change management process.. A system that must remain compliant for years needs a continuous compliance capability: watch for regulatory changes, reassess controls against the current framework, and remediate gaps through change management. This ensures the security baseline tracks both the evolving framework and the system's changing risk profile. One-time certification, over-engineering, and delegating the watch function to an external auditor all leave the organization unable to demonstrate ongoing compliance.

Answer

Delegate ongoing compliance responsibility to the external auditor who performs the annual assessment, relying on the auditor to notify the organization of any new requirements.

Answer

Certify the system against the framework version in effect at go-live and document that certification as the basis for compliance for the system's lifetime.

Answer

Build the system to the strictest interpretation of every control in the framework so that future updates cannot introduce a compliance gap.