A startup is building a social media platform. The risk assessment identifies that a planned feature, which allows users to upload executable files, poses an extreme risk of malware distribution. The startup has limited resources and cannot implement strong security controls. The product manager wants to launch the platform quickly. Which risk strategy is most appropriate?

Transfer by using a third-party file hosting service.

Avoid by removing the file upload feature from the initial release.

Mitigate by adding a file type whitelist and antivirus scanning.

Accept the risk and document it as residual.

Certified Secure Software Lifecycle Professional

Domain 5Objective 4

Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 3)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

14%of the exam

Questions 11–15

11foundation · easy
During design, a team decides to remove a file-upload feature because it introduces an unacceptable risk of malware. This is an example of:
Select an answer first
12application · medium
A software team is designing a new feature that allows users to upload and share documents. The risk assessment identifies that the feature could be used to distribute malicious content. The team decides to eliminate this risk by not implementing the feature. Which risk strategy is being applied?
Select an answer first
13foundation · easy
During the implementation phase, a team identifies a security risk that can be reduced by adding input validation and output encoding. Which risk strategy does this action represent?
Select an answer first
14application · medium
A startup is building a social media platform. The risk assessment identifies that a planned feature, which allows users to upload executable files, poses an extreme risk of malware distribution. The startup has limited resources and cannot implement strong security controls. The product manager wants to launch the platform quickly. Which risk strategy is most appropriate?
Select an answer first
15foundation · easy
A project manager decides to purchase cyber insurance to cover potential losses from a data breach. Which risk strategy is being applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 3)

Questions 11–15

During design, a team decides to remove a file-upload feature because it introduces an unacceptable risk of malware. This is an example of:

A software team is designing a new feature that allows users to upload and share documents. The risk assessment identifies that the feature could be used to distribute malicious content. The team decides to eliminate this risk by not implementing the feature. Which risk strategy is being applied?

During the implementation phase, a team identifies a security risk that can be reduced by adding input validation and output encoding. Which risk strategy does this action represent?

A project manager decides to purchase cyber insurance to cover potential losses from a data breach. Which risk strategy is being applied?

Keep studying — Secure Software Implementation