Define Secure Operational Architecture (e.g., Deployment Topology, Operational Interfaces, Continuous Integration and Continuous Delivery (CI/CD)) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A software company is under pressure to release new features faster. The security architect proposes integrating security scanning into the CI/CD pipeline, but the development team is concerned that scanning will slow down the pipeline. The company has a compliance requirement to scan all code for known vulnerabilities before production release. Which approach balances speed and compliance?

   • ARun a full SAST and DAST scan on every commit, and fail the build if any issue is found.
   • BUse a third-party scanning service that only scans the final release artifact, and manually review the results before deployment.
   • CRun all scans only on release branches, and skip scans on feature branches to save time.
   • DRun a fast SAST scan on every commit, and run a full DAST scan nightly on the staging environment.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which logging practice is most important for detecting a security incident in an operational environment?

   • ADisabling verbose logging to reduce system overhead
   • BDeleting logs after 24 hours to save storage space
   • CCentralized collection and correlation of logs from all critical systems
   • DStoring logs only on the local system where they are generated
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has just experienced a security breach that compromised a database server. The security architect must ensure that the incident response team can investigate the breach and recover the system. Which operational architecture design would best support forensic readiness and recovery?

   • ADisable logging on the database server to reduce the attack surface, and rely on memory forensics to investigate the breach.
   • BAllow the incident response team to access the compromised server directly to collect evidence, and then rebuild the server from scratch.
   • CEnsure that logs are centrally stored and immutable, and maintain a documented recovery plan that includes restoring from a known-good backup.
   • DStore backups on the same server as the database to ensure they are available during recovery.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of securing an operational API that exposes system health data?

   • ATo allow any user to modify system configurations
   • BTo prevent unauthorized disclosure of sensitive operational information
   • CTo increase the response time of the API for all users
   • DTo eliminate the need for monitoring the API
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which security control is most appropriate for protecting an operational management port (e.g., SSH or RDP) exposed for administrative access?

   • AUse a shared default password for all administrators to simplify access
   • BRestrict access to authorized IP addresses and enforce strong authentication
   • CAllow access from any IP address to ensure availability for administrators
   • DDisable encryption to reduce latency on the management channel
   Reveal Solution Discussion Select an answer first