Which activity best exemplifies a security feedback loop in practice?

Conducting an annual security awareness training session.

Reviewing penetration test findings, implementing fixes, and then re-testing to verify the fixes.

Publishing a monthly vulnerability report to all stakeholders.

Creating a dashboard that displays the number of open vulnerabilities.

What is a key principle for designing an effective security dashboard?

Include as many metrics as possible to provide complete information.

Use complex charts and graphs to demonstrate technical sophistication.

Focus on a small set of key metrics that align with the audience's decision-making needs.

Display raw data logs for transparency.

What is a critical component of an effective feedback loop for continuous security improvement?

A one-time comprehensive security assessment.

An automated system that fixes all vulnerabilities without human review.

A static set of security metrics that never change.

A mechanism to act on the insights from reports and then measure the impact of those actions.

Which tool category is commonly used to automate the generation and distribution of security reports?

Integrated development environments (IDEs).

Security information and event management (SIEM) systems.

A security team has implemented a new reporting mechanism that tracks the number of security defects found in code reviews. After several months, they notice that the number of defects is not decreasing. They want to use this data to improve their secure coding practices. What is the most effective way to establish a feedback loop?

Stop tracking defects because the metric is not showing improvement.

Analyze the defect data to identify common root causes, then update coding standards and provide targeted training to address those causes.

Increase the frequency of code reviews to catch more defects, even if the same types of defects continue to occur.

Share the defect data with developers and ask them to be more careful in the future.

Certified Secure Software Lifecycle Professional

Domain 2Objective 7

Create Security Reporting Mechanisms (e.g., Reports, Dashboards, Feedback Loops) CSSLP Practice Questions (Page 3)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

8concepts

11%of the exam

Questions 11–15

11foundation · easy
Which activity best exemplifies a security feedback loop in practice?
Select an answer first
12foundation · easy
What is a key principle for designing an effective security dashboard?
Select an answer first
13foundation · easy
What is a critical component of an effective feedback loop for continuous security improvement?
Select an answer first
14foundation · easy
Which tool category is commonly used to automate the generation and distribution of security reports?
Select an answer first
15application · medium
A security team has implemented a new reporting mechanism that tracks the number of security defects found in code reviews. After several months, they notice that the number of defects is not decreasing. They want to use this data to improve their secure coding practices. What is the most effective way to establish a feedback loop?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.