Classify and Track Security Errors CSSLP Practice Questions (Page 5)

Questions 21–23

1. 21application · medium

   A security team has two vulnerabilities to fix. Vulnerability A has a CVSS v3.1 base score of 9.8, but it is in a non-critical internal tool with no internet access. Vulnerability B has a CVSS v3.1 base score of 6.5, but it is in a customer-facing application that handles payment data. The team can only fix one this week. What is the most appropriate action based on risk-based triage?

   • AFix both vulnerabilities simultaneously by splitting the development team's effort.
   • BFix Vulnerability A first because its CVSS score is higher.
   • CIgnore both vulnerabilities and wait for a scheduled maintenance window next month.
   • DFix Vulnerability B first because it is in a customer-facing application with high business impact.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is using a risk-based approach to prioritize a backlog of 50 security defects. They have a limited number of developers and need to fix the most critical issues first. Which of the following actions is the most effective first step in this triage process?

   • AFix the defects that are easiest to fix first to reduce the size of the backlog.
   • BAssign all defects to developers and let them decide which ones are most important.
   • CSort the defects by their CVSS base score and fix the highest-scoring ones first.
   • DCalculate a risk score for each defect by combining the likelihood of exploitation with the potential business impact, then sort by that score.
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A security team is evaluating a bug tracking tool to meet their compliance requirements. They need to demonstrate to an auditor that every security defect found in a penetration test was either fixed, mitigated, or formally accepted as a risk. Which feature is most critical for the tool to have to support this requirement?

   • AA dashboard that shows the number of open and closed security defects.
   • BA feature to automatically generate a CVE identifier for each security defect.
   • CAn integrated code editor for developers to fix issues directly from the ticket.
   • DA full audit trail that records the status of every ticket, including the final resolution state and who approved it.
   Reveal Solution Discussion Select an answer first