Courseiva

CCNA Secure Software Deployment Operations And Management Questions

20 questions · Secure Software Deployment Operations And Management topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQhard

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

A.Clear the application's cache to remove any temporary sensitive data.
B.Increase the logging level to 'DEBUG' to track the attacker's actions.
C.Change the password for the database user and update the application deployment manifest.
D.Re-deploy the application using the same configuration to ensure a clean state.
AnswerC

Exposed environment variables mean the database credential is compromised, so it must be rotated immediately by changing the password and updating the deployment manifest to distribute the new value. This invalidates the leaked credential before the attacker can reuse it.

Why this answer

When environment variables containing credentials are compromised, the immediate step is to rotate the exposed credentials—specifically, change the database user's password and update the application deployment manifest to use the new password. This invalidates the attacker's access and restores secure authentication. The other options do not address the credential compromise directly.

Exam trap

The trap is focusing on investigative steps (logging, cache clearing) instead of the immediate containment action of credential rotation, which is the priority in incident response.

How to eliminate wrong answers

Option A is wrong because clearing the cache does not revoke the attacker's access to the compromised credentials; they may still use them. Option B is wrong because increasing logging to DEBUG may help investigation but does not mitigate the immediate risk of credential misuse. Option D is wrong because re-deploying with the same configuration would reuse the compromised credentials, leaving the vulnerability in place.

Practice this question →
2
MCQmedium

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

A.Check the file timestamp using the operating system's file system metadata.
B.Upload the artifact to a public VirusTotal scan before deploying.
C.Compare the file size of the artifact with the size listed in the manifest file.
D.Verify the digital signature using a trusted public key from your organization's key store.
AnswerD

Verifying the artifact's digital signature with the organisation's trusted public key proves the build system signed those exact bytes; any tampering invalidates the signature. This satisfies the stem's integrity constraint, unlike checksums, which an attacker who alters the artifact could also recompute.

Why this answer

Cryptographic signing (such as GPG or Cosign for containers) creates a verifiable link between the source code and the binary.

Practice this question →
3
Multi-Selecthard

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

Select 2 answers
A.Implementing granular network segmentation to limit lateral movement.
B.Disabling all security logging to prevent alert fatigue.
C.Relying solely on perimeter-based firewalls for security.
D.Updating the application to the latest version once per year.
E.Deploying RASP (Runtime Application Self-Protection) agents to monitor and block malicious behavior.
AnswersA, E

Granular segmentation constrains east-west traffic, so a zero-day exploit on one host cannot pivot freely. Since no signature exists to block the initial compromise, limiting lateral movement contains blast radius and satisfies the hardening constraint.

Why this answer

Option A is correct because granular network segmentation (e.g., VLANs, microsegmentation, and least-privilege firewall rules) limits lateral movement, so even an unknown zero-day exploit that compromises one host cannot easily spread to other production systems. Option E is correct because RASP agents instrument the application runtime itself, detecting and blocking malicious behavior such as unexpected command execution or injection attempts in real time, which defends against zero-day flaws for which no signature or patch yet exists. Options B, C, and D are not appropriate: disabling security logging destroys the audit trail and detection capability needed to identify zero-day exploitation, perimeter-only firewalls fail against attacks that bypass or originate inside the perimeter, and annual patching is far too infrequent to address rapidly emerging vulnerabilities.

Practice this question →
4
MCQeasy

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

A.Maintaining a consistent and hardened state across all environments.
B.Reducing the total cost of ownership of the cloud infrastructure.
C.Ensuring that developers have administrative access to production databases.
D.Maximizing the number of features delivered in each release.
AnswerA

Secure configuration management enforces baselines that keep development, test and production environments in an identical hardened state, eliminating drift that attackers exploit. This directly satisfies the stem's requirement for a primary objective: consistency across all environments, achieved through automated configuration enforcement rather than one-off manual hardening.

Why this answer

Secure Configuration Management ensures systems are deployed and maintained in a known, hardened, consistent state across development, test, and production — removing default accounts, disabling unnecessary services, applying CIS benchmarks, and detecting drift. Consistency across environments prevents 'it works in dev but is insecure in prod' gaps and supports reproducible audits.

Exam trap

The trap is choosing business-oriented answers (cost, features, developer access) that sound beneficial but are not security objectives — the exam wants the answer tied to hardening, consistency, and least privilege.

How to eliminate wrong answers

Option B is wrong because reducing cloud TCO is a cost-optimization goal, not a security objective, though good configuration management may incidentally reduce waste. Option C is wrong because granting developers administrative access to production databases violates least privilege and separation of duties, directly undermining secure configuration. Option D is wrong because maximizing features per release is a delivery metric that often conflicts with security if it encourages skipping hardening and review.

Practice this question →
5
MCQhard

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

A.Run all build processes in an isolated network segment without internet access.
B.Define specific versions for all dependencies in a lock file and use a private repository with scoped registries.
C.Use only open-source software libraries.
D.Regularly scan the public registries for malicious packages.
AnswerB

Pinning exact versions in a lock file plus scoped registries on a private repository ensures resolution targets internal packages, satisfying the stem's dependency-confusion constraint. Scoping prevents public registry packages from shadowing internal names, and lock files block silent version substitution.

Why this answer

Dependency confusion attacks exploit misconfigured package managers that check public registries for packages not found internally. Option B directly mitigates this by using a lock file to pin exact versions (preventing automatic pulling of newer malicious versions) and a private repository with scoped registries (ensuring that internal packages are only fetched from trusted sources, not public ones). This combination prevents the attacker from registering a public package with the same name as an internal one and having it pulled during build.

Exam trap

CSSLP often tests the misconception that network isolation or scanning public registries is sufficient to prevent dependency confusion, when the real fix is proper package manager configuration with lock files and scoped private registries.

How to eliminate wrong answers

Option A is wrong because isolating the build network from the internet would prevent necessary external dependencies from being fetched, breaking the build; it's an impractical overkill that doesn't address the root cause. Option C is wrong because using only open-source software does not prevent dependency confusion; open-source packages can still be malicious or typosquatted, and internal packages may still be targeted. Option D is wrong because scanning public registries is reactive and cannot reliably detect all malicious packages before they are pulled; it does not prevent the attack from occurring.

Practice this question →
6
MCQeasy

Which of the following is a key component of a 'Secure Software Deployment' plan?

A.A list of all developers who worked on the release.
B.A rollback procedure that allows returning to a known good state.
C.A plan for decommissioning all previous versions of the software.
D.An automated script that changes the administrator password on every server.
AnswerB

A rollback procedure restores the previous known good release if deployment fails or introduces vulnerabilities, directly satisfying the stem's deployment-plan requirement. It differs from backup alone by including the tested mechanism and decision criteria for reverting, preserving availability and integrity during failed releases.

Why this answer

A secure software deployment plan must include a tested rollback procedure so that if a release introduces a vulnerability, breaks functionality, or is exploited, the team can rapidly return to a known good state. Rollback is a core deployment safety control because it bounds the blast radius and downtime of a failed or compromised release. Without it, recovery from a bad deployment depends on ad-hoc fixes under pressure, which is exactly when security mistakes happen.

Exam trap

The trap is picking an option that sounds operationally responsible (like rotating admin passwords, D) instead of the one that is actually a deployment safety control — candidates conflate 'security hardening' with 'secure deployment planning.'

How to eliminate wrong answers

Option A is wrong because a list of developers is an attribution artifact, not a security control — it does nothing to protect the deployment or enable recovery. Option C is wrong because decommissioning all previous versions is the opposite of what you want; retaining a known good version is what makes rollback possible, and premature decommissioning removes your safety net. Option D is wrong because automatically rotating administrator passwords on every server is an operational change that can break service accounts and integrations, and it is not a deployment plan component — it is an unrelated (and risky) hardening action.

Practice this question →
7
MCQmedium

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

A.Configure a post-deployment notification to Slack using a webhook.
B.Manually verify image signatures using Docker Content Trust after deployment.
C.Enable Jenkins 'Build periodically' to scan images in the registry.
D.Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.
AnswerD

The Snyk plugin runs during the image build step, scanning layers for known vulnerabilities before the image is tagged and promoted. This gates the pipeline at the earliest point, satisfying the requirement to scan prior to production promotion.

Why this answer

Integrating the Snyk Security plugin into the Jenkins build step scans the container image at build time, before promotion, enabling fail-fast remediation. This shifts security left and blocks vulnerable images from reaching production. It is the most effective because scanning occurs in the pipeline stage where the image is created.

Exam trap

The trap is choosing a detection-only control (Slack notification, periodic scan) over a preventive control at the right pipeline stage — CSSLP tests whether you shift security left and block promotion, not just alert after deployment.

How to eliminate wrong answers

Option A is wrong because a post-deployment Slack notification only alerts after the vulnerable image is already running in production — detection without prevention. Option B is wrong because Docker Content Trust verifies signatures for integrity/provenance, not vulnerabilities, and doing it after deployment is too late. Option C is wrong because periodic registry scans are not tied to the promotion gate and may scan images that are already deployed.

Practice this question →
8
MCQmedium

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

A.To act as a backup for the main container if it crashes.
B.To intercept and manage network traffic to enforce mTLS and authorization policies.
C.To provide additional CPU and memory resources to the main container.
D.To store persistent data for the main application.
AnswerB

A sidecar proxy intercepts all inbound and outbound traffic for its paired workload, terminating and originating mTLS connections while evaluating authorisation policies per request. This satisfies the stem's service mesh requirement, since encryption and access control are enforced transparently at the data plane without altering application code.

Why this answer

A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Exam trap

The trap is assuming the sidecar is a redundancy or resource mechanism — candidates pick 'backup container' (A) or 'adds resources' (C) because 'sidecar' sounds auxiliary, missing that its real role is traffic interception and policy enforcement.

How to eliminate wrong answers

Option A is wrong because a sidecar is not a failover or high-availability mechanism — if the main container crashes, the sidecar does not take over its workload; Kubernetes restarts the container instead. Option C is wrong because sidecars share the pod's resource allocation and do not add CPU or memory to the main container; they actually consume resources. Option D is wrong because persistent storage is provided by volumes (PersistentVolumeClaims) mounted into the pod, not by a sidecar container, which is stateless with respect to application data.

Practice this question →
9
MCQhard

A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?

A.Enable the Kubernetes Audit Log and monitor for kubectl exec commands.
B.Configure PodSecurityPolicies to restrict the containers to non-root users.
C.Install a Service Mesh like Istio to enforce mTLS.
D.Apply a NetworkPolicy object that defines specific egress rules for the application namespace.
AnswerD

NetworkPolicy is Kubernetes' native pod-level firewall, and its egress rules restrict outbound connections by namespace and label selector. This directly satisfies the stem's constraint of limiting the microservice's anomalous outbound traffic to only known authorised endpoints, which security groups or service mesh policies cannot enforce at pod granularity.

Why this answer

A NetworkPolicy object with specific egress rules is correct because Kubernetes NetworkPolicy provides pod-level, namespace-scoped control over ingress and egress traffic. By defining egress rules that allow only known authorized endpoints (IP blocks, ports, or namespace selectors), the analyst can restrict the microservice's outbound traffic. This directly addresses anomalous outbound connections at the network layer.

Exam trap

CSSLP often tests the difference between preventive network controls (NetworkPolicy) and detective or identity controls (audit logs, PodSecurityPolicies, mTLS), tempting candidates to choose monitoring or authentication options that do not restrict egress.

How to eliminate wrong answers

Option A is wrong because audit logs are detective, not preventive; monitoring kubectl exec does not restrict outbound traffic from the container. Option B is wrong because PodSecurityPolicies (deprecated in Kubernetes 1.21+ and replaced by Pod Security Admission) govern pod security context such as non-root execution, not network egress. Option C is wrong because a service mesh like Istio enforces mTLS and traffic policy between services, but it does not by itself restrict egress to external or unknown endpoints unless combined with egress gateways and policies; NetworkPolicy is the native, direct control.

Practice this question →
10
MCQmedium

A retail company runs a payment microservice in production. During a security review, the team must confirm that the service can detect and respond to anomalous administrative actions in near real time. The service runs on a container platform and writes structured events to a central log store. Which practice best ensures that administrative actions are detected and acted upon promptly?

A.Configure the platform audit log to record administrative API calls, forward those events to a SIEM, and create correlation rules that alert the on-call team when anomalous patterns occur.
B.Deploy a host-based intrusion detection agent on each node and depend on its generic signature set to flag administrative misuse.
C.Rely on the container platform's default event stream and review it weekly during the operations stand-up meeting.
D.Enable verbose application logging at the debug level for all requests and retain logs for thirty days in the central store.
AnswerA

Platform audit logs capture administrative API activity such as role changes, secret access, and workload modifications. Forwarding them to a SIEM and applying correlation rules enables near-real-time detection of anomalous patterns, and alerting the on-call team ensures a timely response. This directly satisfies the requirement to detect and respond to administrative actions quickly in the payment microservice environment.

Why this answer

Audit logs from the container platform capture authoritative records of administrative API calls. Forwarding them to a SIEM with correlation rules enables near-real-time detection of anomalous patterns, and routing alerts to the on-call team closes the response loop. This combination directly addresses both detection speed and response capability required for the payment microservice.

Exam trap

The trap here is treating high-volume application logging or generic host signatures as a substitute for control-plane audit logs, when administrative misuse is best detected from the platform's own audit trail with automated correlation and alerting.

Practice this question →
11
Multi-Selecthard

Which THREE configuration management practices help reduce 'Configuration Drift' in a secure software environment?

Select 3 answers
A.Implementing automated drift detection and remediation tools.
B.Treating infrastructure as 'immutable' by replacing rather than patching instances.
C.Disabling all automated deployment pipelines.
D.Using declarative Infrastructure as Code (IaC) tools like Terraform or CloudFormation.
E.Allowing manual configuration changes via the SSH console.
AnswersA, B, D

Automated drift detection continuously compares deployed configurations against the approved baseline, then remediates deviations before they accumulate. This directly satisfies the stem's requirement to reduce configuration drift, since manual comparison cannot scale across dynamic environments and leaves unauthorised changes undetected until they undermine the secure software baseline.

Why this answer

Option A is correct because automated drift detection and remediation tools continuously compare running configurations against a known-good baseline and automatically reapply the desired state, catching and correcting unauthorized or accidental changes before they persist. Option B is correct because immutable infrastructure replaces instances with freshly built, versioned images instead of patching live systems, so no long-lived server accumulates undocumented changes and drift cannot compound over time. Option D is correct because declarative IaC tools such as Terraform or CloudFormation define the desired end state in version-controlled code and reconcile actual resources to that state, making configuration reproducible and auditable.

Option C is wrong because disabling automated deployment pipelines removes the consistent, repeatable mechanism that prevents drift and forces error-prone manual changes. Option E is wrong because allowing manual configuration changes via the SSH console is itself a primary cause of configuration drift, since out-of-band edits bypass version control and baseline enforcement.

Exam trap

CSSLP often tests the idea that automation and immutability reduce drift, while manual changes and disabled pipelines increase it; candidates may incorrectly think that disabling automation improves control.

Practice this question →
12
MCQeasy

When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?

A.Rename the state file to 'secret.tfstate' to hide it from attackers.
B.Store state files in a version-controlled Git repository for change tracking.
C.Use a remote backend like S3 with server-side encryption enabled and restricted IAM policies.
D.Manually delete the state file after every Terraform apply command.
AnswerC

Terraform state files store resource attributes and secrets in plaintext, so a remote backend such as S3 with server-side encryption and tightly scoped IAM policies protects that data at rest and restricts who can read or alter it.

Why this answer

Terraform state files contain sensitive data such as resource IDs, IP addresses, and sometimes plaintext secrets. Storing them in a remote backend like Amazon S3 with server-side encryption (SSE) and tightly scoped IAM policies ensures that the state is encrypted at rest, access is audited and controlled, and the file is not exposed on local disks or in version control. This practice aligns with the principle of least privilege and defense in depth for infrastructure secrets.

Exam trap

The trap here is that candidates often assume version control (Git) is a secure way to manage state because it provides change tracking, but it actually exposes secrets; the exam tests whether you know that remote backends with encryption and IAM are the secure standard.

How to eliminate wrong answers

Option A is wrong because renaming the state file to 'secret.tfstate' provides no actual security—it is security through obscurity and does not prevent unauthorized access if the file is stored in a readable location. Option B is wrong because storing state files in a version-controlled Git repository exposes sensitive data to anyone with repository access and persists secrets in commit history, even if later removed. Option D is wrong because manually deleting the state file after every apply destroys Terraform's ability to track resource mappings, leading to orphaned resources, drift, and potential outages; it also does not address secure storage during operations.

Practice this question →
13
MCQhard

A financial services firm is rolling out a new release of its customer portal. The release includes updated third-party libraries and a modified container base image. Before promoting the build to production, the release manager must ensure the integrity and provenance of the artifacts. Which action best provides verifiable provenance and tamper detection for the container image?

A.Compute an MD5 checksum of the compiled binary and publish it alongside the release notes so operators can compare it after download.
B.Restrict registry access with role-based credentials so only the release team can push images, and rely on that access control as the integrity guarantee.
C.Sign the container image with a cryptographic private key and record the signature plus build metadata in an attestation that consumers verify with the corresponding public key before deployment.
D.Scan the image with a vulnerability scanner and block promotion if any critical CVEs are found, treating a clean scan as proof of integrity.
AnswerC

Signing the image with a private key and publishing a verifiable attestation binds the artifact to a known builder identity and lets consumers detect any post-build modification. Recording build metadata such as source commit and builder details establishes provenance. Verifying with the public key before deployment ensures only trusted, unaltered images reach production, satisfying both integrity and provenance objectives.

Why this answer

Cryptographic signing of the container image, combined with an attestation of build metadata, delivers both provenance and tamper detection because consumers can verify the signature against a trusted public key before deployment. Access controls and vulnerability scans address adjacent risks but cannot prove that the artifact is unmodified or identify its origin, which is what the release gate requires.

Exam trap

The trap here is conflating access control or vulnerability scanning with artifact integrity, when only cryptographic verification of a signature and provenance metadata actually detects tampering and establishes origin.

Practice this question →
14
MCQmedium

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

A.Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.
B.Store all application logs in a publicly accessible S3 bucket for easy debugging.
C.Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.
D.Increase the log verbosity to the maximum level in production indefinitely.
AnswerA

Automated masking strips session tokens and PII at the pipeline boundary, before log data reaches aggregation storage. This satisfies the stem's secure logging requirement by preventing sensitive values from persisting in a repository with broader access and longer retention than the originating service.

Why this answer

Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Practice this question →
15
Multi-Selecthard

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Select 3 answers
A.Using a secure credential vault to inject secrets at runtime.
B.Scanning source code for vulnerabilities using SAST tools.
C.Granting 'Admin' privileges to all developers on the CI/CD server.
D.Isolating build runners in a restricted network segment.
E.Storing pipeline secrets in plain text within the Jenkinsfile.
AnswersA, B, D

A credential vault injects secrets at runtime, so pipeline logs, build scripts and source repositories never contain plaintext keys. This removes long-lived credentials from artefacts and satisfies the secure CI/CD requirement to protect secrets throughout build and deployment.

Why this answer

Option A is correct because a secure credential vault (e.g., HashiCorp Vault, AWS Secrets Manager, or Jenkins Credentials Binding) injects secrets at runtime so they are never hardcoded or persisted in source control or build logs. Option B is correct because SAST tools (e.g., SonarQube, Checkmarx, Semgrep) analyze source code for vulnerabilities such as injection flaws and insecure deserialization before artifacts are built, shifting security left in the pipeline. Option D is correct because isolating build runners in a restricted network segment limits lateral movement and blast radius if a build agent is compromised, enforcing least-privilege network access to only required dependencies and registries.

Option C is wrong because granting Admin privileges to all developers violates least privilege and enables unauthorized pipeline, credential, and configuration changes. Option E is wrong because storing secrets in plain text within a Jenkinsfile exposes them to anyone with repository read access and to build log leakage, rather than using masked, runtime-injected credentials.

Practice this question →
16
Multi-Selecteasy

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Select 2 answers
A.The speed at which the deployment occurs.
B.The number of instances deployed in the auto-scaling group.
C.The use of secure vaulting mechanisms for application secrets and keys.
D.The color scheme used in the application UI.
E.Enforcing TLS/SSL for all data in transit between components.
AnswersC, E

Secure vaulting stores application secrets and keys encrypted, with access strictly controlled and audited, so credentials are never exposed in configuration files, repositories or logs. This directly prevents unauthorised disclosure of sensitive data during deployment, satisfying the confidentiality requirement.

Why this answer

Option C is correct because storing application secrets and keys in a secure vaulting mechanism (such as AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault) prevents unauthorized disclosure of credentials that protect application data, directly preserving confidentiality. Option E is correct because enforcing TLS/SSL for all data in transit between components encrypts network traffic, preventing eavesdropping or man-in-the-middle interception that would otherwise expose confidential data. The speed at which deployment occurs (A) affects availability and change risk, not confidentiality.

The number of instances in an auto-scaling group (B) affects availability and scalability, not confidentiality. The UI color scheme (D) is purely cosmetic and has no bearing on data confidentiality.

Practice this question →
17
Multi-Selectmedium

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

Select 3 answers
A.Maintaining an updated contact list and clear incident escalation paths.
B.Allowing the threat actor to continue accessing the system to observe their tactics.
C.Immediately deleting all production logs to hide the incident from auditors.
D.Conducting a post-mortem analysis to identify root causes and improve future security.
E.Isolating the affected systems to prevent the spread of the attack.
AnswersA, D, E

An updated contact list with clear escalation paths ensures the right responders are engaged promptly during a live incident, satisfying the stem's requirement for an essential Incident Response action. Defined escalation routes prevent delays and miscommunication, which are common causes of prolonged exposure when deployed software is compromised.

Why this answer

Option A is correct because an updated contact list and clearly defined escalation paths ensure the right responders are notified quickly and incidents are routed to the appropriate teams, which is foundational to any Incident Response (IR) plan. Option D is correct because a post-mortem analysis identifies root causes and lessons learned, enabling corrective actions and continuous improvement of security controls and IR procedures. Option E is correct because isolating affected systems (for example, network segmentation or host containment) limits lateral movement and prevents the attack from spreading to other assets.

Option B is not appropriate because deliberately allowing a threat actor to continue accessing systems risks further compromise and data loss; observation should only occur under controlled, authorized threat-hunting or deception operations, not as a general IR action. Option C is wrong because deleting production logs destroys forensic evidence, violates audit and legal retention requirements, and undermines the ability to investigate and remediate the incident.

Exam trap

CSSLP often tests the misconception that 'observing the attacker' is a valid IR step — it is only legitimate under a formally authorized deception/honeypot program, never as a default response to a live production incident.

Practice this question →
18
Multi-Selectmedium

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Select 2 answers
A.Share all internal server IP addresses in the public DNS records.
B.Implement centralized log aggregation with automated alerting for security events.
C.Enforce strict egress filtering policies to block communication with unknown IP addresses.
D.Permit all inbound traffic on port 80 to ensure maximum availability.
E.Disable all egress traffic from the application servers to prevent data exfiltration.
AnswersB, C

Centralised log aggregation with automated alerting satisfies the operational-lifecycle monitoring requirement by consolidating events from distributed components and triggering real-time responses to security incidents, enabling detection across the deployed application rather than relying on isolated host logs.

Why this answer

Option B is correct because centralized log aggregation (e.g., shipping application and server logs to a SIEM such as Splunk, ELK, or a cloud-native service) combined with automated alerting enables continuous detection of security events like brute-force attempts, privilege escalation, or anomalous access patterns during the operational lifecycle. Option C is correct because strict egress filtering — allowing outbound traffic only to known, required destinations and ports via firewall or security group rules — limits command-and-control callbacks, data exfiltration, and lateral movement if the application is compromised. Option A is wrong because publishing internal server IP addresses in public DNS records exposes the internal topology and increases the attack surface rather than securing the application.

Option D is wrong because permitting all inbound traffic on port 80 (HTTP) unconditionally removes access controls and enables exploitation of web-facing vulnerabilities; availability should be achieved through redundancy, not open ports. Option E is wrong because disabling all egress traffic breaks legitimate application functionality (updates, APIs, database calls) and is an over-restrictive measure; egress should be filtered to approved destinations, as in option C.

Exam trap

CSSLP often tests the balance between availability and security, so candidates must avoid extremes like 'permit all inbound' or 'disable all egress' and instead choose controls that provide visibility and least-privilege without breaking legitimate operations.

Practice this question →
19
MCQmedium

A security engineer at a healthcare SaaS provider is planning the disposal of decommissioned application servers that hosted an electronic health records system. The servers held encrypted databases and application logs. Which action best satisfies secure decommissioning requirements for the data at rest on these disks while preserving the ability to repurpose the hardware internally?

A.Run the vendor's secure erase command that issues an ATA Secure Erase to the drive controller, then immediately return the disks to the spare pool without further validation.
B.Cryptographically erase the data by destroying the key-encryption keys and the wrapped data-encryption keys held in the application key store, then verify the disks contain only ciphertext.
C.Perform a single-pass overwrite of the entire disk with zeros using the manufacturer's low-level format utility, then reinstall the base operating system image.
D.Remove the disks, store them in a locked evidence cage indefinitely, and redeploy only the chassis with new disks to the internal lab.
AnswerB

Because the EHR databases and logs were encrypted at rest, destroying the key-encryption keys and wrapped data-encryption keys renders the remaining ciphertext permanently unrecoverable. This cryptographic erasure approach is efficient, auditable, and preserves the hardware for internal reuse. Verifying that only ciphertext remains confirms the sanitization objective for regulated health data was met.

Why this answer

When data at rest is protected by full-disk or database-level encryption, cryptographic erasure is the most reliable and verifiable decommissioning technique because it removes the means to decrypt rather than relying on overwriting every block. Destroying key-encryption keys and wrapped data-encryption keys, then confirming only ciphertext remains, neutralizes the data while allowing the hardware to be repurposed internally.

Exam trap

The trap here is assuming that any overwrite or vendor secure-erase command is automatically sufficient, when the real requirement is to render the encrypted data unrecoverable, most reliably by destroying its keys and validating the result.

Practice this question →
20
Multi-Selectmedium

Which TWO actions should be taken when preparing a software build for a secure production deployment?

Select 2 answers
A.Embed hardcoded credentials for the database in the build artifact to ensure connectivity.
B.Bypass unit tests to speed up the deployment pipeline.
C.Perform a Software Composition Analysis (SCA) to identify vulnerable dependencies.
D.Sign the final build artifact using a secure private key.
E.Compile the code with debugging symbols enabled for easier production troubleshooting.
AnswersC, D

Software Composition Analysis inventories third-party and open-source dependencies, matching them against vulnerability databases to identify known flaws before production. This satisfies the requirement to detect vulnerable components in the build, enabling remediation or version upgrades prior to secure deployment.

Why this answer

Option C is correct because performing a Software Composition Analysis (SCA) scans third-party and open-source dependencies for known CVEs and license issues, which is essential before shipping a build to production. Option D is correct because signing the final build artifact with a secure private key (e.g., via GPG or sigstore/cosign) provides integrity and provenance, allowing production systems to verify the artifact has not been tampered with. Option A is wrong because hardcoded credentials in build artifacts leak secrets and violate secure secret-management practices such as using a vault or environment-injected secrets.

Option B is wrong because bypassing unit tests removes a key quality gate and increases the risk of shipping defective or vulnerable code. Option E is wrong because compiling with debugging symbols in production exposes internal details and increases attack surface; symbols should be stripped or kept in a separate symbol store.

Exam trap

The trap is treating build speed or troubleshooting convenience as legitimate reasons to weaken controls — options like 'bypass tests' or 'enable debug symbols' sound operationally reasonable but are security anti-patterns in production.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Secure Software Deployment Operations And Management questions.

Start 20-question session