A security architect wants to ensure that security objectives are aligned with business goals during the SDLC. Which activity is most directly associated with achieving this alignment?

Selecting a cloud provider based on cost

Performing code review during the testing phase

Defining security requirements alongside business requirements

Conducting a penetration test after deployment

A software team is in the design phase of a new e-commerce platform. They have already defined functional and non-functional requirements. Which security activity is most appropriate to perform during the design phase?

Run a dynamic application security test (DAST) against the production environment.

Deploy the application to a staging environment for user acceptance testing.

Review the final source code for security vulnerabilities.

Conduct a threat model to identify potential attack vectors and design mitigations into the architecture.

A company is planning to decommission an old application that has been in production for several years. The application contains sensitive customer data. Which activity is most important during the decommissioning phase?

Keep the application running for a few more months to ensure no data is lost.

Simply delete the application's virtual machines without further action.

Securely erase or destroy all data and verify that backups are also removed.

Archive all data to a long-term storage service for compliance.

A software team is preparing to deploy a new version of a customer relationship management (CRM) system. The deployment process must minimize downtime and allow for quick rollback if a critical issue is discovered. Which deployment strategy best meets these requirements?

Canary deployment, where the new version is released to a small percentage of users and monitored.

Rolling deployment, where the new version is gradually deployed to a subset of servers.

Blue-green deployment, where the new version is deployed to a separate environment and traffic is switched after validation.

Big-bang deployment, where the new version is deployed to all servers simultaneously during a maintenance window.

Certified Cloud Security Professional

Domain 4Objective 2

Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 2)

Part of the Cloud Application Security domain, which accounts for 16% of the CCSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–19 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

16%of the exam

Questions 6–10

6foundation · easy
A security architect wants to ensure that security objectives are aligned with business goals during the SDLC. Which activity is most directly associated with achieving this alignment?
Select an answer first
7application · medium
A software team is in the design phase of a new e-commerce platform. They have already defined functional and non-functional requirements. Which security activity is most appropriate to perform during the design phase?
Select an answer first
8expert · hard
A company is planning to decommission an old application that has been in production for several years. The application contains sensitive customer data. Which activity is most important during the decommissioning phase?
Select an answer first
9application · medium
A software team is preparing to deploy a new version of a customer relationship management (CRM) system. The deployment process must minimize downtime and allow for quick rollback if a critical issue is discovered. Which deployment strategy best meets these requirements?
Select an answer first
10foundation · easy
In which SDLC phase would a security team typically conduct threat modeling to identify potential attack vectors and design mitigations?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CCSP” is a trademark of its owner, used for identification only.