Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During implementation, a developer uses parameterized queries to prevent SQL injection. This is an example of which risk strategy?

   • ARisk transfer
   • BRisk mitigation
   • CRisk avoidance
   • DRisk acceptance
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which action best exemplifies risk avoidance in software development?

   • APurchasing insurance to cover potential data breach costs
   • BAccepting the risk because the data is not highly sensitive
   • CEncrypting sensitive data at rest and in transit
   • DRemoving a feature that would require storing sensitive data that the organization cannot protect
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is a common mechanism for transferring software-related risks?

   • AChanging the software design to remove the risk
   • BPurchasing cyber liability insurance
   • CAdding input validation
   • DDocumenting the risk in the risk register
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is developing an IoT device management system. The risk assessment identifies a risk of device malfunction causing property damage. The company wants to reduce its financial liability. Which approach best transfers this risk?

   • ADocument the risk and accept it.
   • BImplement rigorous testing and quality assurance processes.
   • CRedesign the device to eliminate the malfunction risk.
   • DPurchase product liability insurance.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   After applying mitigation controls, a software project still has a residual risk of data exposure due to a third-party component with a known vulnerability. The risk owner must document this residual risk. What is the most important information to include in the documentation?

   • AThe risk owner's personal opinion on the severity of the risk.
   • BThe residual risk level and the rationale for why it is acceptable.
   • CThe cost of the mitigation controls that were applied.
   • DThe names of all developers who worked on the project.
   Reveal Solution Discussion Select an answer first