Create Security Reporting Mechanisms (e.g., Reports, Dashboards, Feedback Loops) CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A software company wants to automate the distribution of its weekly security report to different stakeholders. The report is generated from multiple sources, including SAST, DAST, and dependency scanning tools. Which approach is most effective for automating this process?

   • ASet up a shared folder where each tool automatically saves its report, and stakeholders can browse the folder.
   • BUse a CI/CD pipeline to aggregate results from all security tools, generate a report, and send it via email or a messaging platform on a schedule.
   • CManually compile the data from each tool into a spreadsheet and email it to the stakeholders every week.
   • DProvide each stakeholder with direct access to each security tool's dashboard so they can check the results themselves.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is preparing for a security audit and also wants to improve its internal security posture. The auditors require detailed evidence of security activities, while the development teams need actionable feedback to fix vulnerabilities. The company has limited resources for reporting. What is the most efficient way to satisfy both needs?

   • ACreate two separate reporting streams: one detailed compliance report for auditors and one actionable dashboard for developers, generated from the same underlying data.
   • BFocus only on the compliance report for auditors, and let developers find vulnerabilities through their own testing.
   • CCreate a single report that includes both detailed evidence and actionable feedback, and send it to both auditors and developers.
   • DFocus only on the developer dashboard, and provide auditors with raw logs if they request them.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A large enterprise is implementing a new security reporting mechanism for its software development teams. The CISO wants a high-level view of overall security posture across all projects, while development leads need actionable details about vulnerabilities in their specific code. The compliance team requires evidence of security activities for audits. Which approach best satisfies these diverse needs?

   • ACreate a single comprehensive report that includes all vulnerability details, executive summaries, and compliance evidence, distributed to all stakeholders on a monthly basis.
   • BSend daily email alerts to all stakeholders containing every newly discovered vulnerability, regardless of severity or relevance.
   • CDevelop role-based reports: an executive dashboard with high-level metrics, detailed vulnerability reports for development leads, and compliance-focused reports for auditors, each on appropriate schedules.
   • DProvide all stakeholders access to the raw vulnerability database so they can query the data themselves whenever needed.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is preparing for an external security audit. The auditors need to verify that security activities were performed during the software development lifecycle. Which type of report would best satisfy the auditors' needs?

   • AA detailed report with timestamps, tool outputs, and evidence of security reviews and testing for each phase of the lifecycle.
   • BA trend report showing the number of vulnerabilities found and fixed over the past year.
   • CA summary report for executives highlighting the overall security posture and key achievements.
   • DA real-time dashboard showing the current security status of all applications.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A security team is setting up reporting for a critical application that processes financial transactions. They want to ensure that any critical vulnerability is addressed immediately, while still providing regular updates to management. Which reporting strategy is most appropriate?

   • ASend an automated alert to the development team and security team as soon as a critical vulnerability is detected, and include a summary in the weekly management report.
   • BWait until the weekly management report to inform the development team about critical vulnerabilities.
   • CSend an alert to the development team only, and do not include security information in management reports.
   • DSend a daily report to management with all vulnerabilities, including critical ones, and rely on the development team to check the report.
   Reveal Solution Discussion Select an answer first