CSSLP Secure Software Lifecycle Management — Timed 10 Questions

Question 1

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

Accepted Answer

Governance.. In OWASP SAMM, the Governance business function contains the Strategy & Metrics, Policy & Compliance, and Education & Guidance practices, which are precisely the practices that establish how security activities are woven into the SDLC. Governance defines the policies, roles, and training that make security a repeatable part of development rather than an afterthought. The other business functions (Design, Implementation, Verification, Operations) are where those governance mandates are executed, not where the integration process itself is governed.

Answer

Implementation.

Answer

Verification.

Answer

Operations.

Question 2

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Accepted Answer

Digitally signing code commits and build artifacts.. Code signing and dependency analysis are essential for verifying the source of code and the security of imported libraries.

Answer

Increasing the frequency of manual code uploads.

Answer

Using only open-source libraries without vetting.

Answer

Ensuring all developers have root access to production.

Question 3

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE's Information Disclosure category covers the exposure of information to unauthorized parties, which is exactly what traffic sniffing achieves — an attacker on the network path reads data that should be confidential. Sniffing between a client and web server exposes credentials, session tokens, or sensitive payloads, so the threat being modeled is Information Disclosure. The other STRIDE categories describe different attacker goals (spoofing identity, tampering with data, etc.), not confidentiality loss.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 4

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 5

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Accepted Answer

Enabling 'Secret scanning' and 'Push protection' in the repository settings.. GitHub's native Secret scanning with Push protection is the most effective DevSecOps control because it detects known secret patterns (and partner-verified tokens) at the platform level and blocks the push before the secret ever lands in the remote repository. This shifts detection left into the developer's workflow with zero custom tooling, and it covers the entire history of pushes rather than a single manual check. Because it is enforced server-side by GitHub, it cannot be bypassed by a developer forgetting to run a local script.

Answer

Writing a custom shell script to grep all files for common regex patterns.

Answer

Relying on developers to manually check for secrets before every push.

Answer

Configuring an external firewall to block all traffic containing API keys.

Question 6

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 7

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 8

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 9

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 10

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. The goal of an SBOM is to provide transparency into the software components and dependencies that make up an application, enabling organizations to identify, assess, and manage dependency-related risks such as vulnerable or unlicensed components. It is a visibility and risk-management artifact, not an automation or training replacement. This transparency is foundational to software supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.