Which practice is essential for maintaining document integrity during version updates?

Storing documents in a shared folder with no access controls

Allowing any user to edit the document without review

Deleting previous versions to avoid confusion

Recording a change log that describes what changed and why

Who is the primary audience for a security incident response plan?

Incident responders and IT operations staff

A company's security policy was last reviewed three years ago. Since then, the company has migrated to a cloud-based infrastructure and adopted a new DevOps model. An auditor has flagged that the policy is outdated and does not reflect the current environment. What is the most appropriate action to address this finding?

Retire the policy and operate without a formal security policy

Update only the date on the policy to show it was recently reviewed

Initiate a formal review and update of the policy to reflect the current cloud and DevOps environment

Leave the policy unchanged and argue that the core principles still apply

Who should typically approve a security policy before it is distributed?

Senior management or the designated policy owner

What is the primary purpose of version control for security documentation?

To track changes and maintain a history of revisions

To automatically approve documents

To make documents accessible to everyone in the organization

Certified Secure Software Lifecycle Professional

Domain 2Objective 4

Define and Develop Security Documentation CSSLP Practice Questions (Page 6)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

10concepts

11%of the exam

Questions 26–30

26foundation · easy
Which practice is essential for maintaining document integrity during version updates?
Select an answer first
27foundation · easy
Who is the primary audience for a security incident response plan?
Select an answer first
28application · medium
A company's security policy was last reviewed three years ago. Since then, the company has migrated to a cloud-based infrastructure and adopted a new DevOps model. An auditor has flagged that the policy is outdated and does not reflect the current environment. What is the most appropriate action to address this finding?
Select an answer first
29foundation · easy
Who should typically approve a security policy before it is distributed?
Select an answer first
30foundation · easy
What is the primary purpose of version control for security documentation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.