Analyze Security Implications of Test Results (e.g., Impact on Product Management, Prioritization, Break/build Criteria) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Two vulnerabilities are found: one has a high CVSS score but affects a low-value internal tool, and another has a medium CVSS score but affects a customer-facing payment system. According to risk-based prioritization, which should be addressed first?

   • AThe high CVSS vulnerability, because severity is the only factor that matters.
   • BThe medium CVSS vulnerability, because it affects a customer-facing payment system with higher business impact.
   • CBoth should be fixed simultaneously, regardless of resources.
   • DThe vulnerability with the lower CVSS score should be fixed first because it is easier to exploit.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A security test report reveals a critical vulnerability in a feature scheduled for the next release. According to secure software lifecycle principles, what is the primary impact on product management?

   • AProduct management must weigh the risk against business needs and may adjust release plans, allocate resources, or formally accept the risk.
   • BThe security team alone decides the release date, overriding product management's schedule commitments.
   • CThe vulnerability must be fixed immediately, and the release date must be postponed indefinitely until remediation is complete.
   • DThe release proceeds as planned because security findings are only technical issues that do not affect product management.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security test report contains a finding that is rated 'Medium' severity but affects a feature that is critical to a major client's workflow. The client is unaware of the issue. The product manager wants to inform the client, but the development lead argues that the issue is not severe enough to warrant client communication. As the security lead, what should you advise?

   • ASuggest fixing the issue first and then informing the client after the fix is deployed.
   • BRecommend informing the client, because the issue affects a critical workflow and could impact their operations, potentially damaging the relationship.
   • CAgree with the development lead, since the severity is only 'Medium' and the client does not need to know about every finding.
   • DRecommend keeping the finding confidential to avoid alarming the client, since it is only 'Medium' severity.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security test report includes a critical vulnerability in a customer-facing application. The company's legal team is concerned about potential regulatory implications. The product manager wants to know if the release should be delayed. How should the security lead communicate the findings to the legal team?

   • AProvide the full technical details of the vulnerability, including exploit code, so the legal team can assess the risk.
   • BOnly mention the vulnerability if the legal team asks for it, to avoid unnecessary concern.
   • CSummarize the vulnerability's potential impact on customer data and regulatory compliance, and outline the recommended remediation steps.
   • DRecommend delaying the release immediately, without providing details, to avoid legal liability.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   After a penetration test, you need to communicate the results to the executive team. The report includes a critical remote code execution vulnerability in a customer-facing API and several low-risk findings. The executives are not technical and are concerned about the impact on the upcoming product launch. How should you present the findings?

   • APresent the full technical report, including exploit details and code snippets, to ensure transparency.
   • BOnly mention the critical finding and omit the low-risk findings to avoid unnecessary concern.
   • CRecommend delaying the launch indefinitely until all findings, including low-risk ones, are resolved.
   • DSummarize the critical finding in business terms, explain the potential impact on customers and the launch, and outline the remediation plan and timeline.
   Reveal Solution Discussion Select an answer first