Which activity is part of a systematic manual code review process?

Reviewing code changes line by line for security flaws

Automatically scanning the code with a SAST tool

Running the application and observing its behavior

Checking the code for syntax errors with a compiler

A security reviewer is examining code that handles user authentication. The reviewer notices that the code uses a hard-coded cryptographic key. What is the most appropriate action?

Flag it as a security issue and recommend using a secure key management system.

Encrypt the key in the source code.

Ignore it because the code is only used internally.

Replace the key with a random value generated at runtime.

A company uses a SAST tool in its CI pipeline. The tool reports a high number of false positives, causing developers to ignore the results. The security team wants to improve the effectiveness of the SAST process. What should they do?

Replace the SAST tool with a different one that has fewer false positives.

Disable the SAST tool until the false positives are resolved.

Tune the tool's rules and baseline known false positives, then review remaining findings manually.

Configure the tool to suppress all warnings that are not critical.

A security analyst is reviewing a list of vulnerabilities found in a web application. The analyst wants to identify which vulnerabilities are most commonly exploited by attackers. Which resource should the analyst consult?

CWE (Common Weakness Enumeration)

NVD (National Vulnerability Database)

Certified Secure Software Lifecycle Professional

Domain 5Objective 2

Analyze Code for Security Risks CSSLP Practice Questions (Page 4)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

14%of the exam

Questions 16–20

16foundation · easy
Which activity is part of a systematic manual code review process?
Select an answer first
17application · medium
A security reviewer is examining code that handles user authentication. The reviewer notices that the code uses a hard-coded cryptographic key. What is the most appropriate action?
Select an answer first
18application · medium
A company uses a SAST tool in its CI pipeline. The tool reports a high number of false positives, causing developers to ignore the results. The security team wants to improve the effectiveness of the SAST process. What should they do?
Select an answer first
19foundation · easy
A security analyst wants to reference a standardized identifier for a common software weakness found in code. Which resource provides a common enumeration of software weaknesses?
Select an answer first
20application · medium
A security analyst is reviewing a list of vulnerabilities found in a web application. The analyst wants to identify which vulnerabilities are most commonly exploited by attackers. Which resource should the analyst consult?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.