A build team is migrating a large legacy C codebase to a modern compiler. They have enabled /W4 and are seeing hundreds of warnings, many of which are not security-related. The team has limited time before the release. What is the most effective strategy to address security-relevant warnings without being overwhelmed?

Use a static analysis tool to automatically fix all warnings.

Disable warnings that are not security-related to reduce noise.

Enable /WX to treat all warnings as errors and fix them all before release.

Prioritize warnings that involve unchecked buffer operations, integer overflows, and uninitialized variables, and fix those first.

A vendor distributes a firmware update for an IoT device. The device must verify that the update came from the vendor and was not modified in transit. What should the build process include to enable this verification?

Encrypt the firmware image with a symmetric key shared with the device.

Sign the firmware image with the vendor's private key and embed the corresponding public key in the device.

Compress the firmware image and add a cyclic redundancy check (CRC).

Obfuscate the firmware binary to hide its internal structure.

A software vendor signs their mobile app with a code-signing certificate. They want to ensure that if the signing key is compromised, the impact is limited. They also want to maintain the ability to issue updates. Which approach is most effective?

Encrypt the app binary with the signing key.

Use a single long-lived key and hope it is not compromised.

Use a certificate hierarchy with a root key stored offline and a separate code-signing key that can be revoked and rotated.

Obfuscate the signing key in the build script.

A software vendor signs their Windows executables with a code-signing certificate. Recently, an attacker obtained the private key and signed a malicious binary that was successfully distributed. The vendor wants to minimize the impact of future key compromises while maintaining the ability to sign builds. What should they implement?

Use a timestamp server to add timestamps to signatures.

Use a hardware security module (HSM) to store the private key and implement a certificate revocation process.

Obfuscate the signing code in the build pipeline.

Switch to a stronger hash algorithm for the signature.

Certified Secure Software Lifecycle Professional

Domain 5Objective 6

Apply Security During the Build Process CSSLP Practice Questions (Page 2)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

5concepts

14%of the exam

Questions 6–10

6expert · hard
A build team is migrating a large legacy C codebase to a modern compiler. They have enabled /W4 and are seeing hundreds of warnings, many of which are not security-related. The team has limited time before the release. What is the most effective strategy to address security-relevant warnings without being overwhelmed?
Select an answer first
7application · medium
A vendor distributes a firmware update for an IoT device. The device must verify that the update came from the vendor and was not modified in transit. What should the build process include to enable this verification?
Select an answer first
8expert · hard
A software vendor signs their mobile app with a code-signing certificate. They want to ensure that if the signing key is compromised, the impact is limited. They also want to maintain the ability to issue updates. Which approach is most effective?
Select an answer first
9expert · hard
A software vendor signs their Windows executables with a code-signing certificate. Recently, an attacker obtained the private key and signed a malicious binary that was successfully distributed. The vendor wants to minimize the impact of future key compromises while maintaining the ability to sign builds. What should they implement?
Select an answer first
10foundation · easy
Which compiler option enables Address Space Layout Randomization (ASLR) support in a compiled executable?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Apply Security During the Build Process CSSLP Practice Questions (Page 2)

Questions 6–10

A vendor distributes a firmware update for an IoT device. The device must verify that the update came from the vendor and was not modified in transit. What should the build process include to enable this verification?

A software vendor signs their mobile app with a code-signing certificate. They want to ensure that if the signing key is compromised, the impact is limited. They also want to maintain the ability to issue updates. Which approach is most effective?

Which compiler option enables Address Space Layout Randomization (ASLR) support in a compiled executable?

Keep studying — Secure Software Implementation