CSSLP Secure Software Requirements Practice Question
You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mandate the migration to an encrypted transport layer in the SRS
The primary objective of security requirements is to eliminate known vulnerabilities at the design stage, which means mandating modern protocols (like TLS 1.3) as a requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Request a waiver for the legacy system
Why it's wrong here
Waivers should be a last resort, not the initial requirement strategy.
- ✗
Suggest the use of a VPN for the entire network
Why it's wrong here
While a VPN helps, it does not fulfill the requirement of end-to-end application-level security.
- ✗
Document the legacy protocol as a technical debt item
Why it's wrong here
Simply documenting debt is insufficient; the requirement must mandate the transition to secure protocols.
- ✓
Mandate the migration to an encrypted transport layer in the SRS
Why this is correct
Defining the mandatory security control (TLS) as a functional requirement ensures it is implemented during development.
About these practice questions
Courseiva writes every CSSLP question from scratch — 198 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This CSSLP practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CSSLP exam.