I85PREP
⌘ K
ISSEP study materials
ISSEP study resources

ISSEP practice questions

One question at a time. Build your ISSEP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Execute system security engineering processes

During a security engineering effort, a team must show that each security requirement traces forward to design elements and test evidence. Which activity establishes this traceability as part of executing the system security engineering process?

  1. Maintaining a bidirectional requirements-to-design-to-verification traceability matrix Correct answer.
  2. Replacing the security requirements baseline with the latest threat feed after each sprint
  3. Assigning traceability to the test team alone after design freeze
  4. Deferring all traceability work until the operational acceptance review

Explanation

Traceability is a bidirectional record linking each security requirement to the design elements that satisfy it and the verification evidence that proves it. It must be established and maintained throughout the lifecycle, not reconstructed at the end or owned by a single team.

Question 2Execute system security engineering processes

A security engineer is defining verification methods for a new access-control subsystem. Which method provides the strongest direct evidence that the implemented control enforces the intended policy under realistic conditions?

  1. Reviewing the design document for the access-control policy statement
  2. Inspecting the coding standard for authorization guidance
  3. Testing the running system against policy cases with expected allow and deny outcomes Correct answer.
  4. Interviewing developers about their intent when coding the policy

Explanation

Testing exercises the actual implementation and compares observed behavior to expected policy outcomes, giving direct evidence of enforcement. Document review and interviews only show intent or design, not runtime behavior.

Question 3Execute system security engineering processes

Which artifact best captures the agreed security functional and assurance needs that the system must satisfy before design begins?

  1. The security requirements baseline Correct answer.
  2. The test readiness review checklist
  3. The system security context diagram
  4. The configuration management plan

Explanation

The security requirements baseline is the approved, controlled set of functional and assurance requirements against which design and verification are measured. It is established before design and placed under change control.

Question 4Execute system security engineering processes

A system security engineer receives a proposed change that adds a new remote management interface to a system already in the design phase. What is the correct process action?

  1. Submit the change to the configuration control board for impact assessment and approval Correct answer.
  2. Implement the interface immediately and document it after delivery
  3. Reject the change because design has already started
  4. Record the change only in the test plan

Explanation

Changes after baseline are handled through configuration control, where the board assesses impacts on requirements, design, security posture, and verification before approving. Implementing first or rejecting outright bypasses that disciplined evaluation.

Question 5Execute system security engineering processes

In a security engineering process, what is the primary purpose of a threat assessment performed early in the lifecycle?

  1. To assign blame for past vulnerabilities
  2. To certify the system for operation
  3. To replace the system security plan
  4. To identify threats and inform the derivation of security requirements and design constraints Correct answer.

Explanation

Early threat assessment identifies relevant threats and adversary capabilities so that security requirements and design constraints are derived and prioritized. It shapes requirements and architecture rather than certifying or documenting operations.

Question 6Execute system security engineering processes

Which practice ensures that security engineering outputs remain consistent as the system evolves through incremental builds?

  1. Updating security artifacts only at final delivery
  2. Freezing all security artifacts after the preliminary design review
  3. Placing security artifacts under configuration management with version control Correct answer.
  4. Storing security artifacts only in individual engineer workstations

Explanation

Configuration management with version control keeps artifacts consistent, identifiable, and recoverable as the system changes across builds. Freezing or decentralizing artifacts prevents controlled evolution and traceability.

Question 7Execute system security engineering processes

A security engineer is planning verification for a system with stringent assurance needs. Which approach most appropriately combines multiple verification methods to strengthen confidence?

  1. Combining analysis, testing, and independent review to corroborate results Correct answer.
  2. Relying solely on developer self-attestation
  3. Using only automated scanning without human interpretation
  4. Accepting vendor marketing claims as evidence

Explanation

Higher assurance is achieved by corroborating evidence from independent methods such as analysis, testing, and review, which offset each method's blind spots. Single-source or unverified claims provide weak assurance.

Question 8Execute system security engineering processes

Which term describes the documented set of interfaces, data flows, and trust boundaries that security engineers use to scope analysis and verification?

  1. The disposal plan
  2. The security architecture description Correct answer.
  3. The acquisition strategy
  4. The training plan

Explanation

The security architecture description documents interfaces, data flows, and trust boundaries and is the basis for scoping threat analysis and verification. Other plans address acquisition, training, or disposal rather than technical scoping.

Question 9Execute system security engineering processes

A team has completed a threat assessment and derived candidate security requirements. Which action best ensures those requirements are verifiable before they enter the baseline?

  1. Rewriting each requirement so it states an observable outcome and a measurable condition Correct answer.
  2. Adding more requirements to cover every conceivable threat
  3. Removing acceptance criteria to allow engineering flexibility
  4. Approving requirements verbally to speed the schedule

Explanation

A requirement is verifiable when it specifies an observable outcome and the conditions or criteria for judging satisfaction. Adding untestable requirements, removing criteria, or verbal approval undermines verification.

Question 10Execute system security engineering processes

During design, engineers must decide how to allocate a mandatory audit-logging requirement across components. Which engineering consideration is most important when making that allocation?

  1. Distributing the requirement evenly across all components regardless of function
  2. Ensuring the allocated component can reliably enforce and evidence the requirement at its trust boundary Correct answer.
  3. Deferring allocation until after deployment
  4. Assigning the requirement to the component with the most available staff

Explanation

Allocation should place a requirement where it can be reliably enforced and evidenced, typically at the relevant trust boundary. Staffing convenience, arbitrary even distribution, or deferral ignores functional and assurance implications.

Question 11Execute system security engineering processes

A security engineer must select verification evidence for a cryptographic module. Which combination best supports an assurance claim about correct implementation?

  1. A developer statement that the module was reviewed
  2. Known-answer tests plus independent analysis of the implementation against the specification Correct answer.
  3. A performance benchmark of encryption throughput
  4. A single functional test of one algorithm

Explanation

Known-answer tests confirm correct outputs while independent analysis checks the implementation against its specification, together supporting an assurance claim. A single test, self-statement, or throughput benchmark does not establish correctness.

Question 12Execute system security engineering processes

A project introduces an off-the-shelf component into a system with strict security requirements. What is the most appropriate engineering step before accepting the component?

  1. Assess the component against the security requirements and document residual risk Correct answer.
  2. Integrate first and assess only if an incident occurs
  3. Skip assessment because the component is widely used
  4. Assume the vendor's security claims satisfy all requirements

Explanation

Reuse does not automatically satisfy requirements; the component must be assessed against the baseline and residual risk documented and accepted. Assuming compliance or deferring assessment leaves unmanaged risk.

Question 13Execute system security engineering processes

Which action best demonstrates that security engineering activities are being performed as planned across a program?

  1. Assuming activities occurred because the schedule shows them
  2. Relying on anecdotal reports from individual engineers
  3. Documenting activities only after the program closes
  4. Collecting objective evidence of completed activities against the security plan and tracking deviations Correct answer.

Explanation

Process execution is demonstrated by objective evidence mapped to planned activities, with deviations tracked and corrected. Anecdotes, retroactive documentation, or schedule assumptions do not show that work was actually performed.

Question 14Execute system security engineering processes

A security engineer identifies that two requirements conflict: one demands detailed logging of user activity, another demands minimal data retention. What is the appropriate engineering response?

  1. Implement both fully and ignore the contradiction
  2. Delete the retention requirement without analysis
  3. Silently drop the logging requirement
  4. Escalate the conflict for a documented trade-off decision with risk rationale Correct answer.

Explanation

Conflicting requirements require explicit analysis and a documented trade-off decision with rationale and residual risk accepted by the appropriate authority. Silently dropping or ignoring conflicts produces uncontrolled risk and inconsistency.

Question 15Execute system security engineering processes

Which configuration management activity ensures that the exact security-relevant version of each component can be reconstructed for verification?

  1. Relying on memory of which version was tested
  2. Identification and controlled baselining of configuration items with recorded versions Correct answer.
  3. Allowing engineers to overwrite artifacts in place
  4. Periodic deletion of old baselines

Explanation

Controlled baselining with recorded versions lets engineers reconstruct exactly what was verified. Deleting baselines, in-place overwrites, or memory-based tracking destroys the ability to reproduce and verify.

Question 16Execute system security engineering processes

A verification activity reveals that a design element does not meet a security requirement. What is the correct next step in the engineering process?

  1. Lower the requirement to match the observed behavior
  2. Close the finding because testing already occurred
  3. Remove the test case to avoid future failures
  4. Record the nonconformance and drive corrective action through design or implementation change Correct answer.

Explanation

A failed verification is a nonconformance that must be recorded and resolved through corrective action on design or implementation, then re-verified. Lowering requirements or removing tests hides the deficiency.

Question 17Execute system security engineering processes

Which approach best integrates security engineering into an iterative development lifecycle?

  1. Performing all security activities once at project start
  2. Conducting a single security test at final delivery
  3. Assigning security only to a separate team after development
  4. Embedding security activities into each iteration with continuous traceability and verification Correct answer.

Explanation

Iterative lifecycles require security activities, traceability, and verification in each iteration so risk is managed continuously. One-time or end-only activities leave risk unaddressed between checkpoints.

Question 18Execute system security engineering processes

A security engineer must define acceptance criteria for a boundary-protection requirement. Which criterion is best formed?

  1. Security is addressed by the network team
  2. The firewall should be reasonably secure
  3. All inbound traffic from untrusted networks is denied except explicitly authorized flows, verified by test cases Correct answer.
  4. The team feels confident about the boundary

Explanation

Good acceptance criteria are specific, observable, and testable, stating the expected behavior and how it will be verified. Vague, subjective, or deferral statements cannot be objectively verified.

Question 19Execute system security engineering processes

A program requires independent verification of critical security functions. Which arrangement best satisfies independence while preserving engineering efficiency?

  1. Using a separate qualified team that did not develop the function to verify it Correct answer.
  2. Having the same engineer who wrote the code perform all verification
  3. Skipping verification for functions deemed critical
  4. Relying on the developer's unit tests as the only evidence

Explanation

Independence is achieved when verification is performed by qualified personnel who did not develop the item, reducing bias. Self-verification, sole reliance on developer tests, or skipping critical functions undermines assurance.

Question 20Execute system security engineering processes

A security engineer is evaluating whether a design change weakens the system's security posture. Which analysis most directly supports that judgment?

  1. Reviewing the change author's seniority
  2. Checking whether the change compiles successfully
  3. Comparing the change against the threat model and security requirements to assess impact on trust boundaries Correct answer.
  4. Counting the number of lines changed

Explanation

Impact on security posture is judged by analyzing the change against threats, requirements, and trust boundaries. Metrics like line counts, compilation success, or author seniority do not reveal security impact.

Question 21Execute system security engineering processes

During verification planning, a team must decide how much testing is sufficient for a high-assurance requirement. Which principle best guides that decision?

  1. Select coverage and rigor proportionate to the assurance level and risk of the requirement Correct answer.
  2. Stop testing when the schedule runs out
  3. Test only the easiest cases to show progress
  4. Use a fixed number of test cases for every requirement

Explanation

Verification rigor and coverage should be proportionate to assurance needs and risk, so higher-risk requirements receive deeper evidence. Schedule-driven stopping, easy-case selection, or fixed counts ignore risk and assurance.

Question 22Execute system security engineering processes

A security engineer finds that a reused component's documented behavior differs from its observed behavior in integration testing. What is the most rigorous engineering response?

  1. Document the discrepancy but take no action
  2. Trust the documentation and disregard the observation
  3. Investigate the discrepancy, determine the actual behavior, and reassess requirements impact Correct answer.
  4. Remove the integration test that exposed the difference

Explanation

Discrepancies between documented and observed behavior are security-relevant and must be investigated to establish actual behavior and reassess requirement satisfaction. Trusting documentation, removing tests, or documenting without action leaves risk unmanaged.

Question 23Execute system security engineering processes

An organization wants to demonstrate that its security engineering process is repeatable and measured. Which evidence best supports that claim?

  1. Defined process assets, metrics on activity performance, and records showing consistent application across projects Correct answer.
  2. A list of tools purchased for security
  3. A single successful project with no records
  4. Verbal assurances from the program manager

Explanation

Repeatability and measurement are shown by defined process assets, performance metrics, and records demonstrating consistent use across projects. Single anecdotes, verbal assurances, or tool purchases do not evidence process maturity.

Question 24Execute system security engineering processes

A security engineer must justify why a particular verification method was chosen for an assurance requirement. Which rationale is most defensible?

  1. The method was the cheapest available
  2. The method provides evidence that directly addresses the specific assurance claim with acceptable independence Correct answer.
  3. The method requires the least documentation
  4. The method was used on a previous unrelated project

Explanation

A defensible rationale ties the method to the specific assurance claim and the independence needed to support it. Cost, prior unrelated use, or minimal documentation do not justify adequacy of evidence.

Question 25Execute system security engineering processes

Which activity ensures that security requirements derived from threat assessment remain aligned with the system's evolving architecture throughout execution?

  1. Periodically re-evaluating the threat model against the current architecture and updating requirements through change control Correct answer.
  2. Relying on the initial architecture description only
  3. Deleting requirements that no longer seem relevant without review
  4. Freezing the threat model at project start

Explanation

Threats and architecture evolve, so periodic re-evaluation with controlled requirement updates keeps alignment. Freezing the model, unreviewed deletion, or reliance on stale architecture allows misalignment and unmanaged risk.

Question 26Execute system security engineering processes

An engineer is executing the security engineering process for a new system and must establish the traceability baseline before design begins. Which artifact set forms the authoritative linkage from stakeholder needs to verifiable security requirements?

  1. A risk register that records residual risk acceptance signatures from the authorizing official
  2. A test log summarizing the outcomes of the last regression cycle
  3. A configuration index listing every component version deployed in the integration lab
  4. A bidirectional requirements traceability matrix linking stakeholder needs, threat-derived security requirements, design elements, and verification evidence Correct answer.

Explanation

Traceability in security engineering must be bidirectional so that each security requirement can be traced upward to a stakeholder need or threat and downward to a design element and verification evidence. A configuration index, risk register, and test log are supporting records but do not establish that linkage.

Question 27Execute system security engineering processes

During execution of the security engineering process, a system is decomposed into subsystems and each subsystem is assigned a portion of the overall security functionality. Which principle should govern how protection mechanisms and their supporting functions are distributed?

  1. Co-locate all protection mechanisms in a single component to simplify administration
  2. Rely on the operating system alone for all protection so that application layers need no security functions
  3. Distribute each mechanism randomly across layers so that no single failure disables protection
  4. Assign each protection mechanism to the layer where it can mediate every relevant access with minimal reliance on other layers Correct answer.

Explanation

Security architecture allocates mechanisms to the layer that can completely mediate the accesses in question, following the reference-monitor concept of complete mediation. Concentrating everything in one component or scattering mechanisms arbitrarily undermines both mediation and defense in depth.

Question 28Execute system security engineering processes

A security engineer is executing the process and must record how a specific security control is implemented so that an assessor can later confirm it. Which work product most directly serves this purpose?

  1. A glossary defining security terminology used across the program
  2. A lessons-learned memo from a prior program
  3. A project schedule showing when each control will be purchased
  4. A security control implementation statement that names the mechanism, its configuration, and the evidence source for each assigned control Correct answer.

Explanation

Control implementation statements document, for each assigned control, the mechanism used, how it is configured, and where evidence of its operation can be obtained. This gives assessors a direct path from control to implementation to evidence.

Question 29Execute system security engineering processes

A security engineer is executing the process on a system with a hard real-time constraint. A mandatory cryptographic integrity check would add latency that violates the timing requirement. Which course of action is most consistent with sound security engineering?

  1. Document the conflict, perform a trade study, and record the accepted risk with compensating controls and approval by the authorizing official Correct answer.
  2. Increase the latency budget without informing stakeholders so the requirement can be satisfied
  3. Implement the check only in the test environment and omit it in production
  4. Delete the integrity requirement because it cannot be met within the latency budget

Explanation

When requirements conflict, the process requires explicit analysis and documented risk acceptance rather than silent deviation. A trade study identifies options, compensating controls reduce exposure, and the authorizing official owns the acceptance decision.

Question 30Execute system security engineering processes

A security engineering team is executing verification activities and wants to show that each security requirement has at least one planned method of verification before testing starts. Which artifact should be produced and reviewed at that point?

  1. A verification cross-reference matrix mapping each security requirement to its verification method and success criteria Correct answer.
  2. A software bill of materials for third-party libraries
  3. A disaster recovery plan
  4. A network diagram annotated with trust boundaries

Explanation

A verification cross-reference matrix ties every security requirement to a planned verification method, such as inspection, analysis, demonstration, or test, along with the criteria for success. Reviewing it before testing exposes requirements that lack any means of verification.

Question 31Execute system security engineering processes

While executing the security engineering process, an engineer must decide whether a given security requirement can be verified by test, analysis, inspection, or demonstration. Which consideration most strongly drives that selection?

  1. The order in which requirements appear in the specification
  2. The preference of the development team for a particular tool
  3. The nature of the requirement and the cost and fidelity of obtaining credible evidence for it Correct answer.
  4. The number of personnel available during the verification window

Explanation

Method selection follows from what the requirement asserts and from which evidence would credibly demonstrate satisfaction at acceptable cost and fidelity. Some properties, such as architectural constraints, are better shown by inspection or analysis than by dynamic test.

Question 32Execute system security engineering processes

A security engineer is executing the process and must ensure that security-relevant changes to a fielded system are evaluated before deployment. Which mechanism best accomplishes this?

  1. A freeze on all changes for the life of the system
  2. A developer honor system in which engineers self-certify that changes are secure
  3. An annual audit that samples changes after they have been deployed
  4. A change control board that reviews each change for security impact and requires re-verification of affected requirements before approval Correct answer.

Explanation

Security impact analysis must occur before a change is fielded, and affected requirements must be re-verified. A change control board provides the gate where impact is assessed and re-verification is mandated prior to approval.

Question 33Execute system security engineering processes

An engineer is executing the security engineering process and must decide how to treat a newly identified threat that was not in the original threat assessment. The system is already in integration testing. Which sequence best reflects the process?

  1. Add a firewall rule immediately and close the threat without further analysis
  2. Log the threat for the next program increment and continue testing unchanged
  3. Update the threat assessment, derive or modify security requirements, assess design impact, and re-plan verification for affected elements Correct answer.
  4. Escalate directly to the authorizing official and suspend all testing until a decision is made

Explanation

The process is iterative: new threats feed back into threat assessment, which drives requirement changes, design impact analysis, and updated verification. This keeps requirements aligned with the evolving threat environment without halting unrelated work.

Question 34Execute system security engineering processes

A program is executing the security engineering process and wants objective evidence that security requirements are being satisfied at each integration milestone rather than only at final acceptance. Which approach best provides this?

  1. Accumulating all verification evidence into a single final test report
  2. Defining security entry and exit criteria for each integration milestone and collecting verification evidence against them incrementally Correct answer.
  3. Relying on developer code reviews as the sole source of security evidence
  4. Deferring verification until the operational test phase to reduce cost

Explanation

Milestone entry and exit criteria make security progress measurable throughout integration and produce evidence as each increment is completed. Incremental evidence exposes deficiencies early, when correction is cheaper and before they propagate.

Question 35Technical procurement and management

An organization is acquiring a commercial SIEM platform. Which procurement artifact should define measurable acceptance criteria that the vendor must satisfy before final payment?

  1. The project charter
  2. The vendor's standard license agreement
  3. The statement of work with acceptance test procedures Correct answer.
  4. The request for information response

Explanation

Acceptance criteria and the tests that verify them belong in the statement of work (or its acceptance annex), because that is the contractual instrument binding deliverables to payment. The license agreement governs usage rights, not deliverable verification, and an RFI response is pre-award marketing material.

Question 36Technical procurement and management

During evaluation of security products, the team wants to compare vendor claims against a common baseline without committing to a contract. Which document type best serves that purpose?

  1. Purchase order
  2. Request for proposal
  3. Request for information Correct answer.
  4. Memorandum of understanding

Explanation

A request for information gathers capability data from the market before requirements and evaluation criteria are fixed, making it the right instrument for baseline comparison. An RFP presumes defined requirements and creates a competitive commitment, and a purchase order is a buying instrument.

Question 37Technical procurement and management

A security architect must ensure a new endpoint detection product can be evaluated against known adversary behavior rather than vendor demonstrations. Which evaluation approach provides the strongest independent evidence?

  1. Interviewing reference customers supplied by the vendor
  2. Reviewing the vendor's published benchmark scores
  3. Running a controlled red-team emulation against the product in the lab Correct answer.
  4. Reading the product's Common Criteria certificate

Explanation

Controlled adversary emulation tests the product against behaviors the buyer cares about under the buyer's own conditions, producing evidence the vendor cannot curate. Vendor benchmarks and vendor-selected references are subject to selection bias, and a certification covers a defined assurance scope rather than operational detection efficacy.

Question 38Technical procurement and management

Which contract clause most directly protects the acquirer if a security vendor fails to meet an agreed remediation timeline for a critical vulnerability in its product?

  1. Force majeure
  2. Limitation of liability cap
  3. Most favored customer pricing
  4. Service level agreement with service credits Correct answer.

Explanation

A service level agreement defines measurable obligations and remedies such as service credits when timelines are missed. A liability cap limits exposure rather than compelling performance, and pricing or force majeure clauses do not address remediation timeliness.

Question 39Technical procurement and management

An acquirer requires a vendor to demonstrate that its development lifecycle includes security testing at defined gates. Which evidence request is most appropriate?

  1. A completed security questionnaire plus recent independent assessment reports Correct answer.
  2. A list of the vendor's largest customers
  3. A copy of the vendor's marketing brochure on secure development
  4. The vendor's organizational chart

Explanation

A structured questionnaire combined with independent assessment reports gives verifiable evidence of lifecycle controls rather than assertions. Brochures, org charts, and customer lists do not demonstrate that security gates exist or operate.

Question 40Technical procurement and management

A procurement team is buying cloud infrastructure and must confirm that data residency obligations are enforceable. Which contract mechanism is most effective?

  1. A contractual data location commitment with audit rights Correct answer.
  2. A general statement of compliance with industry frameworks
  3. A privacy policy posted on the vendor website
  4. A verbal assurance from the account manager

Explanation

Enforceability requires a binding contractual commitment plus a right to verify it through audit or evidence. Verbal assurances and unilateral policy pages can change without notice, and framework compliance statements do not specify where data is stored.

Question 41Technical procurement and management

When integrating a third-party security component into a system, which practice best manages supply chain risk from that component?

  1. Accepting the vendor's self-attestation without further review
  2. Relying on the component's popularity in the market
  3. Deferring component review until after deployment
  4. Maintaining a software bill of materials and tracking component provenance Correct answer.

Explanation

A software bill of materials with provenance tracking lets the acquirer identify components, versions, and upstream sources so vulnerabilities can be traced and patched. Self-attestation alone is unverified, popularity is not evidence of integrity, and post-deployment review leaves exposure unmanaged.

Question 42Technical procurement and management

Which metric best demonstrates that a newly procured vulnerability management platform is delivering value after go-live?

  1. Number of user accounts created in the platform
  2. Total number of scan licenses purchased
  3. Percentage of critical vulnerabilities remediated within the defined SLA Correct answer.
  4. Count of vendor support tickets opened

Explanation

Outcome metrics tied to risk reduction, such as remediation timeliness against an agreed SLA, show whether the investment improved security posture. Licensing counts and account creation measure activity rather than effectiveness.

Question 43Technical procurement and management

A vendor proposes to host a security analytics platform in a region where the acquirer has no legal presence. What is the primary risk the acquirer should assess before acceptance?

  1. The platform may require more storage than planned
  2. The vendor may charge different currency rates
  3. The vendor's branding may not match the acquirer's standards
  4. Legal access obligations in that jurisdiction may conflict with data protection commitments Correct answer.

Explanation

Hosting location determines which legal authorities can compel access to data, which can conflict with the acquirer's contractual and regulatory obligations. Branding, storage sizing, and currency are commercial or technical concerns that do not carry the same legal exposure.

Question 44Technical procurement and management

Which approach best ensures that a security product's configuration meets the acquirer's hardening standard before it enters production?

  1. Accepting the vendor's default configuration
  2. Deferring configuration review to the next annual audit
  3. Allowing administrators to configure the product freely after deployment
  4. Requiring a documented configuration baseline validated during acceptance testing Correct answer.

Explanation

A documented baseline validated during acceptance testing confirms that hardening requirements are met before operational use. Default configurations are rarely aligned to the acquirer's standard, and deferring review leaves systems exposed.

Question 45Technical procurement and management

An acquirer is negotiating a contract for a managed detection service. Which requirement most directly addresses the risk of the provider's staff accessing sensitive data beyond what is needed?

  1. Least-privilege access controls with logging and periodic attestation Correct answer.
  2. An option to renew the contract automatically
  3. A clause requiring annual price review
  4. A requirement that the provider use the acquirer's preferred ticketing tool

Explanation

Least-privilege access with logging and periodic attestation constrains and verifies what provider personnel can reach, directly limiting insider and misuse risk. Pricing, tooling preferences, and renewal terms do not restrict access.

Question 46Technical procurement and management

An organization must evaluate two security products with different capability sets and cost structures. Which decision method best supports a defensible selection?

  1. Using a weighted scoring model tied to prioritized requirements Correct answer.
  2. Choosing the product with the lowest purchase price
  3. Choosing the product recommended by the vendor's sales engineer
  4. Selecting the product with the largest market share

Explanation

A weighted scoring model maps evaluation criteria to prioritized requirements and makes tradeoffs explicit and reviewable. Lowest price ignores capability, market share is not a proxy for fit, and vendor recommendations are not independent.

Question 47Technical procurement and management

During acceptance testing, a security appliance passes functional tests but fails to produce logs in the format required by the SIEM. What is the most appropriate procurement action?

  1. Accept the appliance because core functions passed
  2. Record the failure as a nonconformance and require remediation before acceptance Correct answer.
  3. Reopen the entire competitive solicitation
  4. Accept the appliance and fix the log format internally

Explanation

Interoperability requirements stated in the statement of work are part of acceptance, so a failure should be logged as a nonconformance with a remediation obligation. Accepting the product shifts integration cost and risk to the acquirer, and recompeting the solicitation is disproportionate.

Question 48Technical procurement and management

Which practice best supports ongoing assurance that a long-term security service provider continues to meet its obligations after award?

  1. Scheduled performance reviews with evidence submission and defined escalation Correct answer.
  2. Reviewing the contract only at renewal
  3. Relying on informal conversations with the account team
  4. Relying on the initial award evaluation indefinitely

Explanation

Recurring performance reviews with required evidence and escalation paths keep oversight continuous and create documented accountability. Initial evaluation, informal contact, and renewal-only review leave gaps during the contract term.

Question 49Technical procurement and management

A security team wants to procure a tool that will process regulated personal data. Which combination of requirements most directly supports compliance verification?

  1. A discount for multi-year commitment
  2. Encryption at rest and a vendor marketing claim of compliance
  3. A requirement that the vendor use the acquirer's corporate font
  4. Defined data handling obligations, audit rights, and breach notification timelines Correct answer.

Explanation

Compliance verification depends on enforceable handling obligations, the right to audit or obtain evidence, and defined breach notification timelines. Encryption alone addresses one control, and marketing claims, discounts, and cosmetic requirements are not verification mechanisms.

Question 50Technical procurement and management

An acquirer discovers that a proposed security product depends on an open-source library with a known critical vulnerability and no maintained fix. What is the most sound procurement decision?

  1. Ignore the issue if the vendor offers a discount
  2. Proceed and monitor the vulnerability after deployment
  3. Proceed because the vulnerability is in third-party code
  4. Require a remediation plan or compensating controls before acceptance Correct answer.

Explanation

Unmaintained critical vulnerabilities in a dependency are part of the delivered risk, so acceptance should be conditioned on a credible remediation plan or documented compensating controls. Proceeding on the basis of code ownership or price does not reduce exposure.