Analyze Security Implications of Test Results (e.g., Impact on Product Management, Prioritization, Break/build Criteria) CSSLP Practice Questions (Page 4)

Questions 16–18

1. 16expert · hard

   A software company is developing a product for a government client. The contract requires that all 'High' and 'Critical' vulnerabilities be fixed before delivery. Security testing found a 'High' vulnerability in a non-critical module that is not part of the client's core requirements. The development team wants to defer the fix to the next release to meet the deadline. What should the security lead do?

   • ARelease the product and document the vulnerability as a known issue, since the client may not notice.
   • BRecommend negotiating with the client to accept the risk, since the module is non-critical.
   • CInsist on fixing the vulnerability before delivery, because the contract requires it, regardless of the module's criticality.
   • DAgree to defer the fix, since the module is non-critical and the client's core requirements are unaffected.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team uses a CI/CD pipeline that runs static analysis and dynamic tests. The break/build criteria currently fail the build only on 'Critical' findings. A recent scan found a 'High' severity authentication bypass that is easily exploitable and affects all users. The team wants to release the build because the criteria were met. What should you do?

   • AApprove the release because the build met the defined break/build criteria.
   • BUpdate the break/build criteria to fail the build on any 'High' or 'Critical' finding, then rerun the pipeline.
   • CBlock the release and require the authentication bypass to be fixed, because the actual risk exceeds the threshold implied by the criteria.
   • DRelease the build but document the finding as a known risk in the release notes.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A company is developing a mobile banking app. Security testing found a critical vulnerability in the authentication module that could allow account takeover. The fix is complex and will require significant refactoring. The product manager proposes releasing the app with the vulnerability and issuing a patch in two weeks, citing competitive pressure to launch. The app has not yet been made publicly available. What should the security lead recommend?

   • ARelease the app as planned, because the vulnerability is not yet publicly known and the patch will be issued soon.
   • BRelease the app but disable the authentication module until the patch is ready.
   • CDelay the release until the authentication vulnerability is fixed, because the risk of account takeover is unacceptable for a banking app.
   • DRelease the app and monitor for any exploitation attempts, then patch if an attack is detected.
   Reveal Solution Discussion Select an answer first