CSSLP Practice Test 4 — 25 Questions

Question 1

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 2

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 3

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.

Question 4

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 5

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Accepted Answer

Integrating security unit tests into the automated test suite.. Automated testing, threat modeling sessions, and security-focused user stories all support high-velocity security integration.

Answer

Performing manual penetration tests on every commit.

Answer

Waiting for the final release to review security documentation.

Question 6

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

Accepted Answer

The build platform must be hardened and provenance must be authenticated.. SLSA Level 3 requires the build platform to be 'hardened' and 'non-falsifiable', meaning the build integrity is protected and the provenance is cryptographically signed.

Answer

The code must be written in a memory-safe language.

Answer

The project must have 100% open-source components.

Answer

All developers must use a Linux-based OS.

Question 7

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Accepted Answer

To update the SDLC to prevent similar future vulnerabilities.. Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Answer

To calculate the financial loss of the incident.

Answer

To satisfy external auditors' compliance requirements.

Answer

To assign blame to the developer who wrote the code.

Question 8

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 9

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Accepted Answer

Establishing and tracking security performance metrics.. Policy definition and measurable security metrics are foundational for governing software security activities.

Answer

Outsourcing all security tasks to third-party vendors.

Answer

Mandating that all developers become certified hackers.

Answer

Discontinuing all legacy applications.

Question 10

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

Accepted Answer

Session Management configuration in the Context settings.. ZAP's Session Management settings allow the user to define how the application tracks sessions, such as via specific cookies or headers.

Answer

The 'Forced User' mode in the site tree.

Answer

The 'Spider' tab's login configuration.

Answer

The 'Ajax Spider' timeout configuration.

Answer

null

Question 11

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

Accepted Answer

Integrating security risk management with enterprise risk management.. Executive sponsorship and integration with business risk management are vital for security to be a strategic rather than peripheral activity.

Answer

Limiting access to all security documentation.

Answer

Focusing exclusively on technical tool implementation.

Answer

Increasing the number of security alerts for developers.

Question 12

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Accepted Answer

Providing secure coding training to developers.. Risk assessment, secure coding training, and audit logging requirements are all essential management activities in the SDLC.

Answer

Requiring developers to use only one specific programming language.

Answer

Buying insurance for all cyber incidents.

Question 13

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

Accepted Answer

Identification of end-of-life (EOL) software components.. An SBOM allows for identifying vulnerable components (CVEs), managing end-of-life components, and identifying components with restrictive/incompatible licenses.

Answer

Mitigation of SQL injection flaws in custom code.

Answer

Prevention of brute-force attacks on application login.

Question 14

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

Accepted Answer

Lack of security expertise within development teams.. Resistance to change, tool integration difficulties, and lack of security expertise are frequently cited challenges.

Answer

The speed of software development is too slow.

Answer

Having too much budget for security tools.

Question 15

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Accepted Answer

Automated vulnerability scanning of stored artifacts.. A secure registry should support immutable tags, vulnerability scanning of uploaded images, and Role-Based Access Control (RBAC) to control who can push/pull images.

Answer

Auto-scaling of the registry's storage capacity.

Answer

Automatic translation of code into multiple languages.

Question 16

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase

Question 17

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline

Question 18

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Accepted Answer

To identify missing security controls against a baseline or standard. A gap analysis compares the existing state or desired requirements against security standards to identify missing controls.

Answer

To find bugs in the application code

Answer

To calculate the ROI of security spending

Answer

To document the project budget

Question 19

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

Accepted Answer

Snyk Open Source integration.. Snyk is widely used in CI/CD pipelines as a gatekeeper to block builds based on vulnerability thresholds.

Answer

GitHub Projects.

Answer

Git LFS.

Answer

GitHub Pages.

Question 20

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

Accepted Answer

Disable network access during the build process.. Hermetic builds require that all dependencies are declared and pinned, and that the build environment has no network access to avoid fetching unauthorized external dependencies.

Answer

Enable verbose logging to standard output.

Answer

Automatically pull the latest compiler version.

Answer

Allow developers to trigger manual builds via SSH.