Systems Lifecycle Management

An ISSMP is leading the secure acquisition of a commercial off-the-shelf (COTS) payroll system that will process employee PII. The vendor will not permit source code review but does provide a completed consensus assessment questionnaire. Which action BEST allows the ISSMP to establish assurance that the product meets the organization's security requirements before signing the contract?

Which THREE factors should an ISSMP consider when selecting security controls for a new system?

In the context of the SDLC, what is the primary purpose of a 'Software Bill of Materials' (SBOM)?

An ISSMP is leading the security integration for a new software development project that will use agile methodologies. The project team is distributed across multiple time zones. Which TWO practices are MOST effective for ensuring security requirements are not overlooked in this environment? (Choose two.)

During a system's operations and maintenance phase, the ISSMP learns that a critical vulnerability has been disclosed in a widely used library embedded in the application. The vendor confirms a patch is available. Which action should the ISSMP take FIRST?

An organization uses a microservices architecture. How can the ISSMP ensure that inter-service communication is encrypted and that services are authenticated to one another?

An ISSMP is defining the disposal requirements for a new system that will process regulated financial data. The system uses a combination of on-premises servers with self-encrypting drives, cloud object storage, and encrypted backup tapes. Which action best ensures that data remanence is addressed across ALL media during the disposal phase?

What is the primary objective of a 'Security Gate' in an SDLC?

A company is integrating a Third-Party API into their application. What must the ISSMP ensure is included in the risk assessment process?

Which THREE actions are necessary when preparing to decommission a cloud-based Virtual Machine (VM)?

An organization is retiring a customer relationship management system that stored personally identifiable information. The system is scheduled for shutdown in 30 days, and the ISSMP must ensure the decommissioning aligns with lifecycle management and data protection obligations. Which action should the ISSMP prioritize?

What is the primary role of a Change Advisory Board (CAB)?

When decommissioning an application, which action should the ISSMP prioritize to ensure data privacy requirements (e.g., GDPR) are satisfied?

An organization is replacing its aging identity management system. The ISSMP must ensure that sensitive identity data from the legacy platform is handled securely during migration and that the old platform is properly retired. Which action BEST addresses the data lifecycle risk during this transition?

An ISSMP is reviewing the 'Change Control' process for a critical system. Which of the following is an essential element for every change request?

During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?

An organization is adopting a DevSecOps model and wants to ensure that security requirements are continuously validated throughout the CI/CD pipeline. The ISSMP is asked to define the security control gates. Which approach BEST integrates security into the pipeline while maintaining development velocity?

Which document is primarily responsible for documenting the security controls applicable to a system during the SDLC's requirements phase?

Which TWO of the following are critical components of a secure SDLC (Software Development Life Cycle) implementation?

Which TWO mechanisms are effective for preventing 'insecure direct object references' (IDOR) in a web application during the development phase?

An ISSMP is performing a security assessment on an application using containerized microservices. The team uses Kubernetes. What is the most effective way to ensure security configurations are consistently applied across all clusters?

An ISSMP is reviewing a project that will replace the organization's customer relationship management (CRM) system. The project manager proposes to reuse the existing security test plan from the legacy CRM to save time and cost. The new CRM is a cloud-based SaaS solution with different data flows and integrations. What should the ISSMP recommend?

An organization is adopting Infrastructure-as-Code (IaC) using Terraform. The ISSMP wants to ensure no insecure configurations (e.g., S3 buckets with public read) are deployed. What should be integrated into the CI/CD pipeline?

An ISSMP is reviewing the system development lifecycle (SDLC) for a new payroll application. The organization must comply with PCI DSS because the application will process employee salary payments. At which phase should the ISSMP ensure that PCI DSS requirements are identified and documented?

A financial services firm is acquiring a SaaS-based fraud analytics platform. During the due diligence phase of the system lifecycle, the vendor provides a SOC 2 Type II report covering the last 12 months, a completed security questionnaire, and a penetration test summary dated 18 months ago. The ISSMP must decide whether to accept the vendor for integration into the production environment. Which action best satisfies the ISSMP's responsibility at this lifecycle stage?

An organization is deploying a globally distributed application. The ISSMP needs to ensure that code changes are signed to prevent tampering. Which process should be implemented in the build pipeline?

Which TWO techniques are effective for securing the software supply chain?

An ISSMP is overseeing the integration of security into a new DevOps pipeline using Jenkins. Which stage of the SDLC should the ISSMP enforce the execution of SAST tools to ensure security requirements are met early?

During the maintenance phase, a production database needs a schema change. The ISSMP requires that this change be tested in a staging environment that mirrors production. Which process best demonstrates compliance with the 'Separation of Duties' principle?

Which THREE components should be included in an application security requirements document?

Which phase of the SDLC is most appropriate for conducting a formal Threat Modeling exercise?

Which THREE items are typically verified in a Security Gate check before a production deployment?

A project manager wants to bypass a security vulnerability finding because 'the patch will break the application'. What is the correct ISSMP response?

Which TWO items must be documented in a Change Control Log after a successful production change?

An ISSMP is establishing the security requirements baseline for a system that must comply with a regulatory framework. The framework is updated annually and the system will operate for at least five years. Which approach BEST ensures the system remains compliant across its full lifecycle?

During a post-implementation review of a new enterprise resource planning (ERP) system, the ISSMP discovers that the project team did not perform a security risk assessment during the design phase. The system is now in production and handles sensitive financial data. What should the ISSMP do FIRST?

An organization is initiating a project to develop a new mobile banking application. The ISSMP is tasked with ensuring that security requirements are identified and integrated from the very beginning of the systems development life cycle (SDLC). Which action should the ISSMP take FIRST to achieve this?