A security manager is implementing a risk-scoring model for a software product. The product is a mobile app that stores user data in the cloud. The manager is debating whether to include 'data sensitivity' as a factor in the 'Impact' score. Why is it important to include this factor?

It is required by the CVSS specification.

It simplifies the scoring model by reducing the number of factors to consider.

It ensures that vulnerabilities affecting sensitive data (e.g., PII) are prioritized over those affecting non-sensitive data.

It makes the scoring process more complex, which is a best practice for mature organizations.

A security analyst is calculating the CVSS v3.1 score for a vulnerability. The vulnerability is in a library that is used by a critical internal application and a public-facing marketing website. The analyst calculates a base score of 7.5. The internal application is on a segmented network, while the marketing website is directly internet-facing. How should the analyst use this information to prioritize the remediation?

Prioritize the internal application because it is 'critical' to business operations.

Calculate an environmental score for each application, which will likely result in a higher score for the marketing website.

Ignore the base score and only use the environmental score for prioritization.

Use the base score of 7.5 for both applications and prioritize them equally.

In the Common Vulnerability Scoring System (CVSS), what does the base score primarily reflect?

The specific configuration of the target system

The business impact of the vulnerability on a specific organization

The inherent characteristics of the vulnerability that are constant over time and across environments

The current availability of a patch for the vulnerability

In a typical security bug tracking process, which step immediately follows the initial discovery and logging of a security bug?

Triaging and prioritizing the bug

Certified Secure Software Lifecycle Professional

Domain 6Objective 6

Classify and Track Security Errors CSSLP Practice Questions (Page 2)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

6concepts

14%of the exam

Questions 6–10

6expert · hard
A security manager is implementing a risk-scoring model for a software product. The product is a mobile app that stores user data in the cloud. The manager is debating whether to include 'data sensitivity' as a factor in the 'Impact' score. Why is it important to include this factor?
Select an answer first
7expert · hard
A security analyst is calculating the CVSS v3.1 score for a vulnerability. The vulnerability is in a library that is used by a critical internal application and a public-facing marketing website. The analyst calculates a base score of 7.5. The internal application is on a segmented network, while the marketing website is directly internet-facing. How should the analyst use this information to prioritize the remediation?
Select an answer first
8foundation · easy
In the Common Vulnerability Scoring System (CVSS), what does the base score primarily reflect?
Select an answer first
9foundation · easy
Which of the following is a common feature of security bug tracking tools that helps teams prioritize which vulnerabilities to fix first?
Select an answer first
10foundation · easy
In a typical security bug tracking process, which step immediately follows the initial discovery and logging of a security bug?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Classify and Track Security Errors CSSLP Practice Questions (Page 2)

Questions 6–10

A security manager is implementing a risk-scoring model for a software product. The product is a mobile app that stores user data in the cloud. The manager is debating whether to include 'data sensitivity' as a factor in the 'Impact' score. Why is it important to include this factor?

In the Common Vulnerability Scoring System (CVSS), what does the base score primarily reflect?

Which of the following is a common feature of security bug tracking tools that helps teams prioritize which vulnerabilities to fix first?

In a typical security bug tracking process, which step immediately follows the initial discovery and logging of a security bug?

Keep studying — Secure Software Testing