CSSLP Secure Software Lifecycle Management — Timed 15 Questions

Question 1

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Sniffing traffic is categorized as Information Disclosure.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 2

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 3

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Accepted Answer

Enabling 'Secret scanning' and 'Push protection' in the repository settings.. The 'secret scanning' feature in GitHub automatically detects patterns associated with secrets and prevents them from being pushed or alerts the user if they are committed.

Answer

Writing a custom shell script to grep all files for common regex patterns.

Answer

Relying on developers to manually check for secrets before every push.

Answer

Configuring an external firewall to block all traffic containing API keys.

Question 4

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 5

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

Accepted Answer

Governance.. The 'Governance' business function in SAMM includes the 'Strategy & Metrics', 'Policy & Compliance', and 'Education & Guidance' practices, which focus on SDLC integration.

Answer

Implementation.

Answer

Verification.

Answer

Operations.

Question 6

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 7

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 8

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 9

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. An SBOM provides a comprehensive list of all third-party and open-source components, facilitating vulnerability management and supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.

Question 10

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) tracks how quickly security vulnerabilities are addressed, reflecting both the efficiency of the remediation process and the maturity of the security program.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 11

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

Accepted Answer

Perform incremental scans of the changed code.. Incremental scanning focuses on the changed code rather than the entire codebase, significantly reducing the scan time and the number of alerts presented to developers in every build.

Answer

Disable all rules except for critical-level vulnerabilities.

Answer

Run full scans on every single commit.

Answer

Set the tool to break the build for every warning.

Question 12

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Accepted Answer

To act as a security advocate and bridge between security and dev teams.. Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Answer

To perform all manual code reviews for the entire department.

Answer

To handle all incident responses for the organization.

Answer

To replace the need for professional security audits.

Question 13

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 14

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.

Question 15

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Accepted Answer

To update the SDLC to prevent similar future vulnerabilities.. Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Answer

To calculate the financial loss of the incident.

Answer

To satisfy external auditors' compliance requirements.

Answer

To assign blame to the developer who wrote the code.