CSPM Security Project Execution & Monitoring 2 — Questions and Answers
Question 1: During execution of a security project, a critical vulnerability is discovered in a third-party library used by the system under development. What is the BEST immediate action?
- Continue development and patch in the next sprint
- Raise a risk event, assess impact, and escalate per the risk management plan (Correct answer)
- Halt all development until the vendor releases a patch
- Remove the library and rewrite the functionality
Correct answer: Raise a risk event, assess impact, and escalate per the risk management plan
Discovering a vulnerability during execution requires raising a risk event, assessing its impact on project scope and timeline, and escalating according to the pre-defined risk management plan.
Question 2: Which monitoring technique involves comparing planned security deliverables against actual completions using a cumulative S-curve?
- Variance analysis
- Earned Value Management (EVM) (Correct answer)
- Critical path method
- Monte Carlo simulation
Correct answer: Earned Value Management (EVM)
Earned Value Management uses S-curves to plot cumulative planned value against earned value and actual cost, enabling performance assessment of security deliverables.
Question 3: A security project manager notices the Schedule Performance Index (SPI) is 0.82. What does this indicate?
- The project is 18% under budget
- The project is ahead of schedule by 18%
- The project is behind schedule — only 82% of planned work is complete (Correct answer)
- The project has consumed 82% of its float
Correct answer: The project is behind schedule — only 82% of planned work is complete
An SPI below 1.0 means the project is behind schedule; an SPI of 0.82 means only 82 cents of planned work has been accomplished for every dollar of scheduled work.
Question 4: What is the PRIMARY purpose of a security project status report during the monitoring phase?
- To document lessons learned for future projects
- To communicate current progress, risks, and issues to stakeholders (Correct answer)
- To obtain formal acceptance of security deliverables
- To update the work breakdown structure
Correct answer: To communicate current progress, risks, and issues to stakeholders
Status reports during monitoring primarily serve to communicate current project health, including progress against the baseline, active risks, and open issues to stakeholders.
Question 5: When conducting security control testing during project execution, which approach ensures coverage without duplicating effort?
- Test all controls simultaneously at project closure
- Use a requirements traceability matrix to map controls to test cases (Correct answer)
- Rely solely on automated scanning tools
- Delegate all testing to the development team
Correct answer: Use a requirements traceability matrix to map controls to test cases
A requirements traceability matrix links each security control requirement to specific test cases, ensuring complete coverage while preventing redundant testing efforts.
Question 6: A security project team is implementing a SIEM solution. The project manager observes that log ingestion rates are 40% below target. Which is the MOST appropriate corrective action?
- Close the issue and accept reduced log coverage
- Perform root cause analysis and adjust the implementation plan accordingly (Correct answer)
- Immediately increase server resources without analysis
- Report the deviation only at project closure
Correct answer: Perform root cause analysis and adjust the implementation plan accordingly
Underperformance against a target metric requires root cause analysis to identify whether the gap stems from configuration, infrastructure, or scope issues before applying corrective action.
Question 7: Which document formally authorizes the project team to begin executing security project work packages?
- Risk register
- Work authorization system output (Correct answer)
- Issue log
- Lessons learned register
Correct answer: Work authorization system output
A work authorization system provides formal approval to begin specific work packages, ensuring security activities are executed in the correct sequence and by authorized resources.
CSPM Security Project Execution & Monitoring 2
During execution of a security project, a critical vulnerability is discovered in a third-party library used by the system under development.
What is the BEST immediate action?