Analyze Security Implications of Test Results (e.g., Impact on Product Management, Prioritization, Break/build Criteria) CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security assessment of a healthcare application found the following issues: (1) a medium-severity vulnerability that could expose patient data if exploited, (2) a low-severity issue in an internal admin tool, and (3) a high-severity denial-of-service vulnerability in a public-facing API. The team has limited resources to fix issues before the next release. What should be the priority order for remediation?

   • AFix the high-severity DoS first, then the medium-severity data exposure, and finally the low-severity admin tool issue.
   • BFix all issues in parallel, since they are all security findings and should be resolved before release.
   • CFix the low-severity admin tool issue first, because it is quick and easy to resolve, then move to the higher-severity issues.
   • DFix the medium-severity data exposure first, then the high-severity DoS, and finally the low-severity issue.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a key consideration when communicating security test results to a technical development team?

   • AProvide detailed technical information, including reproduction steps and affected code areas, to facilitate remediation.
   • BAvoid sharing any technical details to prevent information leakage.
   • COnly share the business impact and not the technical details.
   • DCommunicate the results only verbally to avoid creating a written record.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security test of a web application found a cross-site scripting (XSS) vulnerability in a search function that is used by all users. The vulnerability is rated 'Medium' severity, but the application processes sensitive personal data. The development team has limited time before the next release. What should be the priority for fixing this XSS vulnerability?

   • AFix the XSS vulnerability only if there are no other findings in the test report.
   • BPrioritize the fix based on the combination of the 'Medium' severity and the sensitive data processed, placing it above lower-impact findings.
   • CDefer the fix to the next release, because the severity is only 'Medium' and other issues may be more critical.
   • DFix it immediately, because XSS vulnerabilities are always critical and must be addressed before any release.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   When communicating security test results to a non-technical executive, what is the most effective approach?

   • AShare the raw security test report without any interpretation.
   • BSummarize the findings in terms of business risk, potential impact, and recommended actions.
   • CProvide a detailed list of all vulnerabilities with their CVSS scores and technical descriptions.
   • DOnly communicate the number of vulnerabilities found, without any context.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   A project defines that a build is considered failed if any critical or high severity vulnerability is open at the end of the testing phase. This is an example of:

   • AA communication plan
   • BA break/build criterion
   • CA risk acceptance decision
   • DA resource allocation strategy
   Reveal Solution Discussion Select an answer first