CSSLP Secure Software Lifecycle Management — 25 Questions

Question 1

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

Accepted Answer

Governance.. In OWASP SAMM, the Governance business function contains the Strategy & Metrics, Policy & Compliance, and Education & Guidance practices, which are precisely the practices that establish how security activities are woven into the SDLC. Governance defines the policies, roles, and training that make security a repeatable part of development rather than an afterthought. The other business functions (Design, Implementation, Verification, Operations) are where those governance mandates are executed, not where the integration process itself is governed.

Answer

Implementation.

Answer

Verification.

Answer

Operations.

Question 2

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Accepted Answer

Digitally signing code commits and build artifacts.. Code signing and dependency analysis are essential for verifying the source of code and the security of imported libraries.

Answer

Increasing the frequency of manual code uploads.

Answer

Using only open-source libraries without vetting.

Answer

Ensuring all developers have root access to production.

Question 3

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE's Information Disclosure category covers the exposure of information to unauthorized parties, which is exactly what traffic sniffing achieves — an attacker on the network path reads data that should be confidential. Sniffing between a client and web server exposes credentials, session tokens, or sensitive payloads, so the threat being modeled is Information Disclosure. The other STRIDE categories describe different attacker goals (spoofing identity, tampering with data, etc.), not confidentiality loss.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 4

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 5

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Accepted Answer

Enabling 'Secret scanning' and 'Push protection' in the repository settings.. GitHub's native Secret scanning with Push protection is the most effective DevSecOps control because it detects known secret patterns (and partner-verified tokens) at the platform level and blocks the push before the secret ever lands in the remote repository. This shifts detection left into the developer's workflow with zero custom tooling, and it covers the entire history of pushes rather than a single manual check. Because it is enforced server-side by GitHub, it cannot be bypassed by a developer forgetting to run a local script.

Answer

Writing a custom shell script to grep all files for common regex patterns.

Answer

Relying on developers to manually check for secrets before every push.

Answer

Configuring an external firewall to block all traffic containing API keys.

Question 6

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 7

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 8

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 9

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 10

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. The goal of an SBOM is to provide transparency into the software components and dependencies that make up an application, enabling organizations to identify, assess, and manage dependency-related risks such as vulnerable or unlicensed components. It is a visibility and risk-management artifact, not an automation or training replacement. This transparency is foundational to software supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.

Question 11

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 12

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

Accepted Answer

Perform incremental scans of the changed code.. Incremental scanning analyzes only the code changed since the last scan, dramatically reducing scan time and noise so developers get fast, relevant feedback on their own commits. This preserves SAST value in CI/CD while minimizing the friction that causes teams to disable or bypass security gates. Full scans can still run nightly or on release branches for complete coverage.

Answer

Disable all rules except for critical-level vulnerabilities.

Answer

Run full scans on every single commit.

Answer

Set the tool to break the build for every warning.

Question 13

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Accepted Answer

To act as a security advocate and bridge between security and dev teams.. Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Answer

To perform all manual code reviews for the entire department.

Answer

To handle all incident responses for the organization.

Answer

To replace the need for professional security audits.

Question 14

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 15

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.

Question 16

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Accepted Answer

To update the SDLC to prevent similar future vulnerabilities.. Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Answer

To calculate the financial loss of the incident.

Answer

To satisfy external auditors' compliance requirements.

Answer

To assign blame to the developer who wrote the code.

Question 17

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Accepted Answer

Integrating security unit tests into the automated test suite.. Option A is correct because integrating security unit tests (e.g., SAST checks, input-validation and authentication tests) into the CI/CD automated test suite lets the team catch vulnerabilities on every build without slowing the sprint cadence, which directly sustains security velocity. Option D is correct because regular threat modeling sessions (for example, using STRIDE during backlog refinement or design sprints) identify design-level risks early, when they are cheapest to fix, rather than after code is written. Option E is correct because incorporating security requirements into user stories, with explicit acceptance criteria such as OWASP ASVS controls or abuse cases, makes security work visible, estimable, and testable inside the normal Agile workflow. Option B does not belong because manual penetration testing on every commit is impractical, slow, and not automatable, which destroys velocity; pen tests are better performed periodically or on significant releases. Option C does not belong because deferring security documentation review to the final release contradicts Agile's iterative delivery and creates a late-stage bottleneck where remediation is far more costly.

Answer

Performing manual penetration tests on every commit.

Answer

Waiting for the final release to review security documentation.

Question 18

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Accepted Answer

Integrating security linting into the IDE.. Option A is correct because integrating security linting into the IDE catches insecure coding patterns (e.g., hardcoded secrets, unsafe API usage) at the moment code is written, which is the earliest practical point in the lifecycle and embodies the Shift-Left principle of moving controls leftward. Option B is correct because security design reviews before coding begins address architectural flaws such as missing authentication, improper trust boundaries, or weak cryptography when they are cheapest to fix, rather than after implementation. Option D is correct because running SAST during the development phase analyzes source code for vulnerabilities like injection or buffer overflows before the artifact reaches testing or production, directly shifting detection earlier. Option C does not belong because post-deployment vulnerability scanning occurs after release, which is a Shift-Right activity, not Shift-Left. Option E does not belong because relying solely on external bug bounty programs is a reactive, post-release detection strategy that outsources discovery rather than preventing defects earlier in the lifecycle.

Answer

Conducting post-deployment vulnerability scanning.

Answer

Relying solely on external bug bounty programs.

Question 19

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Accepted Answer

Establishing and tracking security performance metrics.. Option D is correct because a robust Software Security Governance framework requires measurable oversight: establishing and tracking security performance metrics (e.g., mean time to remediate vulnerabilities, percentage of code scanned, open critical findings) enables an organization to monitor compliance, demonstrate accountability, and drive continuous improvement of its security posture. Option E is correct because governance fundamentally rests on defining clear security policies and standards (such as secure coding standards, SDLC security gates, and risk acceptance criteria) that set mandatory expectations and provide the baseline against which all development and security activities are measured and audited. The remaining options do not belong: outsourcing all security tasks to third-party vendors (A) transfers execution but does not constitute governance, which remains the organization's responsibility; mandating that all developers become certified hackers (B) is neither feasible nor a recognized governance control; and discontinuing all legacy applications (C) is an operational risk decision, not a governance component, and may be impractical or unnecessary.

Answer

Outsourcing all security tasks to third-party vendors.

Answer

Mandating that all developers become certified hackers.

Answer

Discontinuing all legacy applications.

Question 20

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

Accepted Answer

Integrating security risk management with enterprise risk management.. Option B is correct because integrating security risk management with enterprise risk management (ERM) ensures that security risks are evaluated, prioritized, and reported using the same governance framework and risk appetite as other business risks, directly aligning security decisions with organizational objectives. Option C is correct because securing executive sponsorship and support provides the authority, funding, and strategic direction needed to embed security into business processes and hold the organization accountable to governance goals. Options A, D, and E do not belong: limiting access to all security documentation impedes transparency and informed decision-making, focusing exclusively on technical tool implementation ignores strategic and process-level governance, and increasing the number of security alerts for developers creates noise rather than alignment with business goals.

Answer

Limiting access to all security documentation.

Answer

Focusing exclusively on technical tool implementation.

Answer

Increasing the number of security alerts for developers.