Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What should be done to the traceability matrix when a security requirement is changed?

   • ALeave the matrix unchanged until the end of the project
   • BUpdate the matrix to reflect the change and review all linked artifacts for impact
   • COnly update the test cases, since they are the most important
   • DDelete the requirement from the matrix and add a new one
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A development team is using a version control system for code and a test management tool for test cases. They want to automate the traceability between security requirements and test cases. What is the most effective approach?

   • AUse a requirements management tool that integrates with the test management tool.
   • BCreate a custom script to parse test case names and match them to requirements.
   • CManually update a spreadsheet after each test run.
   • DUse code comments to indicate which requirement a test case verifies.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security requirement is removed from the project scope after a risk assessment. The traceability matrix must be updated. What is the correct action?

   • AOnly remove the test case links, but keep the design and code links.
   • BKeep the requirement in the matrix but mark it as 'not in scope'.
   • CLeave the matrix unchanged because the requirement was already implemented.
   • DRemove the requirement and all its links from the matrix.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When creating traceability links, which of the following is a best practice?

   • ALink requirements only to test cases, since testing is the most important phase
   • BLink each security requirement to at least one design element, code module, and test case
   • CCreate links only after the software is deployed
   • DLink only the requirements that are considered high priority
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An organization is preparing for a security audit. The auditor requires evidence that all security requirements are implemented and tested. The organization has a traceability matrix, but it is incomplete. What is the best course of action?

   • AProvide the source code and test results without the matrix.
   • BComplete the traceability matrix by adding missing links before the audit.
   • CExplain to the auditor that the matrix is a work in progress.
   • DDelay the audit until the matrix is complete.
   Reveal Solution Discussion Select an answer first