Describe the Secure Software Development Life Cycle (SDLC) Process CCSP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare startup is developing a patient portal that will handle protected health information (PHI). The product owner has defined functional requirements for appointment scheduling and prescription refills, but has not yet considered how the system should handle data encryption, audit logging, or uptime during peak usage. As the security architect, which action best aligns security objectives with business goals during the requirements phase?

   • AAsk the development team to choose security controls based on their experience with similar projects.
   • BDefer security requirements until the design phase, when the architecture is better understood.
   • CAdd non-functional requirements for encryption, logging, and availability, and obtain business sign-off on these security constraints.
   • DImplement encryption and logging during development without documenting them as formal requirements.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security team is conducting a threat model for a new web application. The application will allow users to upload files, which will be stored and shared with other users. The team has identified that the application is vulnerable to malicious file uploads. Which mitigation is most effective to implement during the design phase?

   • AValidate file types and scan uploads for malware before storing them.
   • BStore uploaded files in a separate domain to prevent cross-site scripting.
   • CDisable file uploads entirely to eliminate the risk.
   • DRestrict file uploads to authenticated users only.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which security activity is most commonly associated with the development phase of a secure SDLC?

   • APenetration testing
   • BSecure coding standards
   • CThreat modeling
   • DIncident response planning
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A development team is using a continuous integration/continuous deployment (CI/CD) pipeline to deploy a new application. The security team has identified that the application is vulnerable to SQL injection. The team wants to fix the vulnerability and prevent it from recurring. Which combination of activities is most effective?

   • AAdd a static analysis rule to detect SQL injection and provide developers with training on secure query construction.
   • BDisable the CI/CD pipeline until the vulnerability is fixed.
   • CUse a web application firewall (WAF) to block SQL injection attempts.
   • DManually fix the vulnerability in the code and redeploy without further action.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A startup is developing a mobile app that will collect user location data. The business wants to monetize the data by sharing it with third-party advertisers. The legal team has raised concerns about privacy regulations. Which approach best aligns security and business goals?

   • AAsk the development team to implement privacy controls without documenting them.
   • BIgnore legal concerns because the business model depends on data sharing.
   • CDefine non-functional requirements for data privacy and consent management, and obtain business sign-off.
   • DProceed with data sharing and address privacy concerns after the app is launched.
   Reveal Solution Discussion Select an answer first