Certified Secure Software Lifecycle Professional

Understand security design principles

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–34

Manage security within a software development methodology (e.g., Agile, waterfall)

34 questions · 7 pages

Identify and adopt security standards (e.g., implementing security frameworks, promoting security awareness)

30 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30

Outline strategy and roadmap

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Define and develop security documentation

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Define security metrics (e.g., criticality level, average remediation time, complexity, Key Performance Indicators (KPI), objectives and key results)

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

Decommission applications

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30

Create security reporting mechanisms (e.g., reports, dashboards, feedback loops)

30 questions · 6 pages

Incorporate integrated risk management methods

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

Implement secure operation practices

26 questions · 6 pages

Define software security requirements

26 questions · 6 pages

Identify compliance requirements

24 questions · 5 pages

Identify data classification requirements

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20 21–25

Identify privacy requirements

25 questions · 5 pages

Define data access provisioning

20 questions · 4 pages

Develop misuse and abuse

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Develop security requirement traceability matrix

32 questions · 7 pages

Define third-party vendor security requirements

25 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–25

Perform secure interface design

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Evaluate and select reusable technologies

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Perform threat modeling

37 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–37

Perform architectural risk assessment and design reviews

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

Model (non-functional) security properties and constraints

27 questions · 6 pages

Define secure operational architecture (e.g., deployment topology, operational interfaces, Continuous Integration and Continuous Delivery (CI/CD))

24 questions · 5 pages

Adhere to relevant secure coding practices (e.g., standards, guidelines, regulations)

33 questions · 7 pages

Analyze code for security risks

24 questions · 5 pages

Implement security controls (e.g., watchdogs, file integrity monitoring, anti-malware)

20 questions · 4 pages

Address the identified security risks (e.g., risk strategy)

27 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–21

Evaluate and integrate components

21 questions · 5 pages

Apply security during the build process

26 questions · 6 pages

Develop security testing strategy & plan

24 questions · 5 pages

Develop security test cases

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

Verify and validate documentation (e.g., installation and setup instructions, error messages, user guides, release notes)

29 questions · 6 pages

Identify undocumented functionality

24 questions · 5 pages

Questions 1–5 6–10 11–15 16–18

Analyze security implications of test results (e.g., impact on product management, prioritization, break/build criteria)

18 questions · 4 pages

Classify and track security errors

23 questions · 5 pages

Questions 1–5 6–10 11–15 16–20 21–23

Secure test data

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Perform verification and validation testing (e.g., independent/internal verification and validation, acceptance test)

43 questions · 9 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–40 41–43

Perform operational risk analysis

32 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–32

Secure configuration and version control

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Release software securely

31 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–31

Store and manage security data

26 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–39

Ensure secure installation

39 questions · 8 pages

Obtain security approval to operate (e.g., risk acceptance, sign-off at appropriate level)

18 questions · 4 pages

Questions 1–5 6–10 11–15 16–18

Perform information security continuous monitoring

35 questions · 7 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35

Execute the incident response plan

33 questions · 7 pages

Questions 1–5 6–10 11–15 16–19

Perform patch management (e.g. secure release, testing)

19 questions · 4 pages

Perform vulnerability management (e.g., tracking, triaging, Common Vulnerabilities and Exposures (CVE))

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

Incorporate runtime protection (e.g., Runtime Application Self Protection (RASP), web application firewall (WAF), Address Space Layout Randomization (ASLR), dynamic execution prevention)

29 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–29

Support continuity of operations

36 questions · 8 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–30 31–35 36–36

Integrate service level objectives and service-level agreements (SLA) (e.g., maintenance, performance, availability, qualified personnel)

26 questions · 6 pages

Implement software supply chain risk management (e.g., International Organization for Standardization (ISO), National Institute of Standards and Technology (NIST))

20 questions · 4 pages

Questions 1–5 6–10 11–15 16–20 21–21

Analyze security of third-party software

21 questions · 5 pages

Verify pedigree and provenance

28 questions · 6 pages

Questions 1–5 6–10 11–15 16–20 21–25 26–28

Ensure and verify supplier security requirements in the acquisition process

26 questions · 6 pages

Support contractual requirements (e.g., intellectual property ownership, code escrow, liability, warranty, End-User License Agreement (EULA), service-level agreements (SLA))

26 questions · 6 pages