Discuss ISC2 CISSP Exam Topic 2 Question 117

Which of the following phases in the software acquisition process does developing evaluation criteria take place?

AFollow-On

BPlanning

CContracting

DMonitoring and Acceptance

Suggested Answer: B

The software acquisition process is the process of acquiring software from external sources, such as vendors or contractors. It involves several phases, such as planning, contracting, monitoring and acceptance, and follow-on. Developing evaluation criteria is part of the planning phase, where the organization defines the requirements, objectives, and constraints of the software acquisition project. Evaluation criteria are the standards or measures that are used to assess the quality, suitability, and value of the software products or services offered by the potential suppliers. Developing evaluation criteria in the planning phase helps the organization to select the best software solution for its needs and goals.Reference:CISSP - Certified Information Systems Security Professional, Domain 8. Software Development Security, 8.4 Assess the security impact of acquired software, 8.4.1 Define and apply security requirements in the acquisition process;CISSP Exam Outline, Domain 8. Software Development Security, 8.4 Assess the security impact of acquired software, 8.4.1 Define and apply security requirements in the acquisition process

Get Premium CISSP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

22 comments · newest first

Kindra 2 days ago

Agreed! Planning is crucial for evaluation.

Elena 7 days ago

I think it's B) Planning. Makes sense to set criteria early.

Bronwyn 12 days ago

But if you don’t plan first, how can you evaluate later? B is the way!

Elliott 18 days ago

I’m leaning towards C) Contracting. Criteria can be finalized there too.

Pearly 23 days ago

No way, it's definitely B) Planning. You need a solid foundation.

Crista 28 days ago

I feel like it should be in A) Follow-On. Criteria can change after initial use.

Mabelle 1 month ago

Agreed! Planning is crucial for evaluation.

Shenika 1 month ago

I think it's B) Planning. Makes sense to set criteria early.

Curt 1 month ago

I agree with B) Planning, but I can see why others might think differently.

Lashawna 2 months ago

Wait, are we sure it’s not C) Contracting? That seems relevant.

Mauricio 2 months ago

B) Planning makes the most sense to me.

Carissa 2 months ago

I thought it was A) Follow-On. Seems like it fits there too.

Ligia 2 months ago

Definitely B) Planning. That's where you set the criteria.

Kristofer 2 months ago

I’m not convinced it’s just B. There could be more to it!

Twila 2 months ago

Wait, are we sure it's not C) Contracting? That seems relevant too.

Devora 3 months ago

B) Planning makes the most sense to me.

Christiane 3 months ago

I thought it was A) Follow-On. Seems like a good time to evaluate.

Jose 3 months ago

Definitely B) Planning. That's where you set the criteria!

Lemuel 3 months ago

Monitoring and Acceptance seems too late for developing criteria, but I can't shake the feeling that it might be involved in some way.

Ivette 3 months ago

I’m leaning towards Planning too, but I recall some confusion about where exactly evaluation fits in the overall process.

Royal 4 months ago

I remember a practice question that mentioned evaluation criteria in relation to the Contracting phase. Could it be that?

Elliott 5 months ago

I think developing evaluation criteria is part of the Planning phase, but I'm not entirely sure. It feels like something we discussed in class.

ISC2 CISSP Exam - Topic 2 Question 117 Discussion