A software project has a residual risk of a critical vulnerability in a legacy component. The risk owner wants to formally accept the risk, but the organization's risk tolerance is low. The security team has proposed a mitigation that would reduce the risk to an acceptable level but would delay the release by two weeks. The business is pressuring for an on-time release. Which action is most appropriate?

Accept the residual risk and document it, since the business needs the release on time.

Transfer the risk to the business unit by having them sign an acceptance form.

Avoid the risk by removing the legacy component from the system.

Implement the mitigation and delay the release, ensuring the residual risk is within tolerance.

A software team is designing a new file-sharing feature. The initial design requires users to upload files that are then processed by an external service. The risk assessment identifies that the external service has a history of data breaches. The team wants to eliminate this risk entirely. Which action best achieves risk avoidance?

Purchase a cyber liability policy to cover losses from a potential breach.

Change the design to process files in-house instead of using the external service.

Conduct a penetration test on the external service before launch.

Implement encryption for all files uploaded to the external service.

A development team is implementing a web application that handles user authentication. The risk assessment identified a risk of brute-force attacks on the login endpoint. The team is in the implementation phase. Which control best mitigates this risk?

Implement account lockout after a certain number of failed attempts.

Outsource authentication to a third-party identity provider.

Accept the risk and document it.

Purchase a DDoS protection service.

After implementing a series of security controls, a software project has a residual risk of a denial-of-service (DoS) attack. The risk owner must decide how to handle this residual risk. Which action is most appropriate?

Transfer the residual risk to the IT department.

Ignore the residual risk since controls have been implemented.

Document the residual risk and obtain formal acceptance from management.

Avoid the residual risk by shutting down the application.

Certified Secure Software Lifecycle Professional

Domain 5Objective 4

Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 4)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

14%of the exam

Questions 16–20

16expert · hard
A software project has a residual risk of a critical vulnerability in a legacy component. The risk owner wants to formally accept the risk, but the organization's risk tolerance is low. The security team has proposed a mitigation that would reduce the risk to an acceptable level but would delay the release by two weeks. The business is pressuring for an on-time release. Which action is most appropriate?
Select an answer first
17application · medium
A software team is designing a new file-sharing feature. The initial design requires users to upload files that are then processed by an external service. The risk assessment identifies that the external service has a history of data breaches. The team wants to eliminate this risk entirely. Which action best achieves risk avoidance?
Select an answer first
18application · medium
A development team is implementing a web application that handles user authentication. The risk assessment identified a risk of brute-force attacks on the login endpoint. The team is in the implementation phase. Which control best mitigates this risk?
Select an answer first
19foundation · easy
A company signs a contract with a cloud provider that includes a service-level agreement (SLA) with penalties for downtime. This is an example of:
Select an answer first
20application · medium
After implementing a series of security controls, a software project has a residual risk of a denial-of-service (DoS) attack. The risk owner must decide how to handle this residual risk. Which action is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 4)

Questions 16–20

A development team is implementing a web application that handles user authentication. The risk assessment identified a risk of brute-force attacks on the login endpoint. The team is in the implementation phase. Which control best mitigates this risk?

A company signs a contract with a cloud provider that includes a service-level agreement (SLA) with penalties for downtime. This is an example of:

After implementing a series of security controls, a software project has a residual risk of a denial-of-service (DoS) attack. The risk owner must decide how to handle this residual risk. Which action is most appropriate?

Keep studying — Secure Software Implementation