A security tester discovers a critical authentication bypass in a web application. After verifying the issue, they create a ticket in the bug tracking system. According to a well-defined security bug lifecycle, what is the immediate next step the tester should take after creating the ticket?

Set the ticket status to 'New' and notify the security lead or project manager for triage and prioritization.

Mark the ticket as 'Duplicate' if a similar issue was reported in the past, regardless of the current context.

Assign the ticket to the development team lead and set the status to 'In Progress'.

Close the ticket immediately and create a new one in the vulnerability management system, as bug trackers are not for security issues.

What is the primary purpose of risk scoring in the context of security bug tracking?

To provide a legal defense against liability

To automatically patch vulnerabilities

To assign a numerical value that helps prioritize which vulnerabilities to remediate first

To replace the need for manual security testing

A penetration tester reports a potential business logic flaw that allows a user to apply a discount code multiple times. The developer argues it is 'working as designed' and refuses to fix it. The tester insists it is a security vulnerability. According to a robust bug tracking and classification process, what is the most effective way to resolve this conflict and ensure the issue is properly tracked?

The issue should be escalated to a product owner or security lead for a formal risk assessment and a final decision on classification and priority.

The tester should re-classify the issue as a 'defect' instead of a 'vulnerability' to appease the developer.

The tester should close the ticket and move on, as the developer has final authority over the code.

The developer should be overruled, and the issue should be marked as a critical vulnerability with a high priority.

Certified Secure Software Lifecycle Professional

Domain 6Objective 6

Classify and Track Security Errors CSSLP Practice Questions (Page 1)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

14%of the exam

Questions 1–5

1foundation · easy
Which of the following is an example of a dedicated security bug tracking tool commonly used to manage and track vulnerabilities?
Select an answer first
2application · medium
A security tester discovers a critical authentication bypass in a web application. After verifying the issue, they create a ticket in the bug tracking system. According to a well-defined security bug lifecycle, what is the immediate next step the tester should take after creating the ticket?
Select an answer first
3foundation · easy
What is the primary purpose of risk scoring in the context of security bug tracking?
Select an answer first
4expert · hard
A penetration tester reports a potential business logic flaw that allows a user to apply a discount code multiple times. The developer argues it is 'working as designed' and refuses to fix it. The tester insists it is a security vulnerability. According to a robust bug tracking and classification process, what is the most effective way to resolve this conflict and ensure the issue is properly tracked?
Select an answer first
5foundation · easy
A vulnerability has a CVSS base score of 9.8. According to the CVSS qualitative severity rating scale, how is this vulnerability classified?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Classify and Track Security Errors CSSLP Practice Questions (Page 1)

Questions 1–5

Which of the following is an example of a dedicated security bug tracking tool commonly used to manage and track vulnerabilities?

A security tester discovers a critical authentication bypass in a web application. After verifying the issue, they create a ticket in the bug tracking system. According to a well-defined security bug lifecycle, what is the immediate next step the tester should take after creating the ticket?

What is the primary purpose of risk scoring in the context of security bug tracking?

A vulnerability has a CVSS base score of 9.8. According to the CVSS qualitative severity rating scale, how is this vulnerability classified?

Keep studying — Secure Software Testing