Define and Develop Security Documentation CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is updating the organization's incident response plan. The plan will be used by the IT help desk, the security operations center (SOC), and executive management. The team is deciding who should be involved in the review and approval process. Which approach best balances the need for technical accuracy and management authorization?

   • AHave only executive management review and approve the plan without input from the SOC or help desk
   • BHave the SOC and help desk review for technical accuracy, and have executive management approve the final version
   • CHave the help desk approve the plan and then distribute it to the SOC and management
   • DHave only the SOC review and approve the plan without involving management
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does security documentation contribute to risk management in a software project?

   • ABy documenting identified threats, vulnerabilities, and the rationale for chosen mitigations
   • BBy eliminating the need for security reviews
   • CBy automatically patching vulnerabilities in the codebase
   • DBy providing a legal defense against all security incidents
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst has drafted a new incident response procedure. The draft is currently stored on the analyst's local drive. According to the security documentation lifecycle, what is the immediate next step the analyst should take to move this document toward official status?

   • ARetire the old incident response procedure and mark this draft as the new official version
   • BArchive the draft in the document repository and notify stakeholders it is available
   • CSubmit the draft to the designated reviewers for formal review and approval
   • DDistribute the draft to all employees so they can begin using the new procedure immediately
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of security documentation in the software lifecycle?

   • ATo satisfy regulatory requirements only, without affecting development practices
   • BTo provide a record of security decisions and practices that supports compliance, communication, and risk management
   • CTo serve as a marketing tool to promote the software's security features to customers
   • DTo replace the need for security testing by providing theoretical guidance
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which section of a security policy typically defines the boundaries and applicability of the policy?

   • ARoles and responsibilities
   • BScope
   • CRevision history
   • DControls
   Reveal Solution Discussion Select an answer first