Analyze Security Implications of Test Results (e.g., Impact on Product Management, Prioritization, Break/build Criteria) CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security test of a web application identified a SQL injection vulnerability in a legacy login module that is scheduled for replacement in the next release. The vulnerability is rated 'High' severity, but the module is only used by internal staff with limited access. The product manager wants to defer the fix to the next release. As the security lead, what should you recommend?

   • AEscalate the issue to the executive team, because any SQL injection vulnerability must be fixed immediately regardless of the deployment context.
   • BRecommend fixing the vulnerability in the current release, but if the product manager accepts the risk, document the decision and implement compensating controls such as network restrictions.
   • CRequire the fix before release, because the vulnerability is rated 'High' severity regardless of the module's lifespan or user base.
   • DAccept the risk and defer the fix, since the module is being replaced and the exposure is limited to internal users.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A security test report lists several findings. Which combination of factors is most commonly used to prioritize which findings to address first?

   • ASeverity, exploitability, and business impact
   • BThe number of lines of code in the affected module
   • CThe order in which the findings were discovered
   • DThe personal preference of the security tester
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the purpose of break/build criteria in the context of security testing?

   • ATo describe the steps for deploying the build to production.
   • BTo define the conditions under which a build is considered failed or not ready for release based on security test results.
   • CTo specify the programming languages and frameworks that must be used in the build.
   • DTo list the names of the security testers responsible for the build.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A development team uses a CI/CD pipeline that runs security tests. The break/build criteria are set to fail the build if any 'Critical' or 'High' vulnerability is found. A recent scan found a 'High' vulnerability in a test-only module that is not included in the production build. What should the team do?

   • AOverride the build failure and release, because the vulnerability is not in the production code.
   • BFail the build because the criteria are met, and require the vulnerability to be fixed.
   • CUpdate the break/build criteria to exclude test-only modules from the security scan, then rerun the pipeline.
   • DIgnore the finding and continue the build, since it is only a test module.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During a release planning meeting, the product manager asks how a newly discovered high-severity vulnerability should influence the upcoming release. What is the most appropriate product management action?

   • ADelegate the decision entirely to the development team without any product management input.
   • BIgnore the vulnerability because it was found in testing and not in production.
   • CEvaluate the vulnerability's exploitability and business impact, then decide whether to fix it before release, defer it, or accept the risk with documented justification.
   • DAutomatically cancel the release and start a complete rewrite of the affected module.
   Reveal Solution Discussion Select an answer first