A company is developing a cloud-based application. The risk assessment identifies a risk of data loss due to a potential cloud provider outage. The company wants to ensure that it can recover financially from such an outage. Which strategy best addresses this risk?

Purchase a business interruption insurance policy.

Implement a multi-region backup strategy.

Accept the risk as part of cloud adoption.

Avoid the risk by moving back to on-premises infrastructure.

What is the primary purpose of defining risk acceptance criteria?

To eliminate all risks from the software

To transfer risks to a third party

To document the risk assessment methodology

To establish a threshold for when residual risks can be formally accepted

A healthcare software project has a residual risk of unauthorized access to patient data due to a legacy API that cannot be fully secured. The risk owner must decide whether to formally accept this risk. Which condition must be met for formal risk acceptance to be appropriate?

The risk is below the organization's defined risk tolerance threshold.

The risk is documented in the project's risk register.

The risk is transferred to a third-party vendor.

The risk has been fully mitigated to zero.

A project manager is reviewing the risk register for a software project. A risk has been mitigated, but a residual risk remains. The project manager must decide whether to formally accept this residual risk. Which criterion is most important for this decision?

The risk is documented in the project's risk register.

The risk has been fully eliminated.

The risk has been transferred to a third party.

The residual risk is below the organization's risk tolerance threshold.

A software team is designing a new feature that requires integration with a third-party payment gateway. The risk assessment identifies that the gateway has a history of security breaches. The team has the option to use a different, more secure gateway, but it would increase transaction fees. The business wants to minimize costs. Which strategy best addresses the risk while considering the business constraint?

Mitigate by implementing additional security controls around the gateway integration.

Transfer the risk by requiring the gateway provider to indemnify the company.

Avoid the risk by using the more secure gateway, accepting the higher fees.

Accept the risk and document it as residual.

Certified Secure Software Lifecycle Professional

Domain 5Objective 4

Address the Identified Security Risks (e.g., Risk Strategy) CSSLP Practice Questions (Page 5)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

6concepts

14%of the exam

Questions 21–25

21application · medium
A company is developing a cloud-based application. The risk assessment identifies a risk of data loss due to a potential cloud provider outage. The company wants to ensure that it can recover financially from such an outage. Which strategy best addresses this risk?
Select an answer first
22foundation · easy
What is the primary purpose of defining risk acceptance criteria?
Select an answer first
23application · medium
A healthcare software project has a residual risk of unauthorized access to patient data due to a legacy API that cannot be fully secured. The risk owner must decide whether to formally accept this risk. Which condition must be met for formal risk acceptance to be appropriate?
Select an answer first
24application · medium
A project manager is reviewing the risk register for a software project. A risk has been mitigated, but a residual risk remains. The project manager must decide whether to formally accept this residual risk. Which criterion is most important for this decision?
Select an answer first
25expert · hard
A software team is designing a new feature that requires integration with a third-party payment gateway. The risk assessment identifies that the gateway has a history of security breaches. The team has the option to use a different, more secure gateway, but it would increase transaction fees. The business wants to minimize costs. Which strategy best addresses the risk while considering the business constraint?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.