Define and Develop Security Documentation CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why is the 'retire' stage important in the security documentation lifecycle?

   • ATo archive all documents indefinitely for legal purposes
   • BTo remove outdated documents from circulation and prevent the use of obsolete security guidance
   • CTo transfer ownership of the document to a new department
   • DTo delete all records of security decisions to reduce liability
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A large enterprise is developing a new payment application that will process credit card data. The project manager wants to keep the security documentation minimal to speed up development. The compliance officer insists that documentation is essential. The project manager argues that the team is experienced and does not need extensive documentation. Which argument best justifies the compliance officer's position in this specific context?

   • AThe documentation will make the development team look more professional to upper management
   • BThe documentation will replace the need for any security testing during development
   • CThe documentation is required to demonstrate compliance with PCI DSS and to provide evidence for auditors and assessors
   • DThe documentation is needed to justify the project's budget to the finance department
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security manager is reviewing the documentation set for a legacy application that is being migrated to a new platform. The manager finds that the existing documentation includes a high-level policy, a detailed standard, and a step-by-step procedure. However, the procedure is outdated and references commands that no longer exist on the new platform. The standard and policy are still accurate. What is the most appropriate action to maintain the documentation set's integrity?

   • AUpdate the policy to include the specific commands that are missing from the procedure
   • BLeave the procedure unchanged and add a note that it is for reference only
   • CDelete the procedure entirely and rely only on the policy and standard
   • DUpdate the procedure to reflect the new platform's commands, and update the version and change history
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A new secure coding standard has been approved and published in the organization's central document repository. The security team wants to ensure that all developers are aware of the new standard and know that it is now in effect. Which action is most important to complement the repository publication?

   • ADelete the old secure coding standard from the repository
   • BSend a direct notification to all developers with a link to the new standard and a summary of the key changes
   • CPrint the standard and post it on the office bulletin board
   • DWait for developers to find the new standard on their own
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the correct order of the security documentation lifecycle stages?

   • ADistribute, create, approve, review, maintain, retire
   • BApprove, create, distribute, review, retire, maintain
   • CReview, create, retire, distribute, approve, maintain
   • DCreate, review, approve, distribute, maintain, retire
   Reveal Solution Discussion Select an answer first