CSSLP Secure Software Lifecycle Management — Timed 15 Questions

Question 1

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

Accepted Answer

Governance.. In OWASP SAMM, the Governance business function contains the Strategy & Metrics, Policy & Compliance, and Education & Guidance practices, which are precisely the practices that establish how security activities are woven into the SDLC. Governance defines the policies, roles, and training that make security a repeatable part of development rather than an afterthought. The other business functions (Design, Implementation, Verification, Operations) are where those governance mandates are executed, not where the integration process itself is governed.

Answer

Implementation.

Answer

Verification.

Answer

Operations.

Question 2

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Accepted Answer

Digitally signing code commits and build artifacts.. Code signing and dependency analysis are essential for verifying the source of code and the security of imported libraries.

Answer

Increasing the frequency of manual code uploads.

Answer

Using only open-source libraries without vetting.

Answer

Ensuring all developers have root access to production.

Question 3

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE's Information Disclosure category covers the exposure of information to unauthorized parties, which is exactly what traffic sniffing achieves — an attacker on the network path reads data that should be confidential. Sniffing between a client and web server exposes credentials, session tokens, or sensitive payloads, so the threat being modeled is Information Disclosure. The other STRIDE categories describe different attacker goals (spoofing identity, tampering with data, etc.), not confidentiality loss.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 4

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 5

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Accepted Answer

Enabling 'Secret scanning' and 'Push protection' in the repository settings.. GitHub's native Secret scanning with Push protection is the most effective DevSecOps control because it detects known secret patterns (and partner-verified tokens) at the platform level and blocks the push before the secret ever lands in the remote repository. This shifts detection left into the developer's workflow with zero custom tooling, and it covers the entire history of pushes rather than a single manual check. Because it is enforced server-side by GitHub, it cannot be bypassed by a developer forgetting to run a local script.

Answer

Writing a custom shell script to grep all files for common regex patterns.

Answer

Relying on developers to manually check for secrets before every push.

Answer

Configuring an external firewall to block all traffic containing API keys.

Question 6

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 7

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 8

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 9

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 10

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. The goal of an SBOM is to provide transparency into the software components and dependencies that make up an application, enabling organizations to identify, assess, and manage dependency-related risks such as vulnerable or unlicensed components. It is a visibility and risk-management artifact, not an automation or training replacement. This transparency is foundational to software supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.

Question 11

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 12

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

Accepted Answer

Perform incremental scans of the changed code.. Incremental scanning analyzes only the code changed since the last scan, dramatically reducing scan time and noise so developers get fast, relevant feedback on their own commits. This preserves SAST value in CI/CD while minimizing the friction that causes teams to disable or bypass security gates. Full scans can still run nightly or on release branches for complete coverage.

Answer

Disable all rules except for critical-level vulnerabilities.

Answer

Run full scans on every single commit.

Answer

Set the tool to break the build for every warning.

Question 13

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Accepted Answer

To act as a security advocate and bridge between security and dev teams.. Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Answer

To perform all manual code reviews for the entire department.

Answer

To handle all incident responses for the organization.

Answer

To replace the need for professional security audits.

Question 14

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 15

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.