Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security tester is verifying that a security requirement is correctly implemented. The tester starts from the test case and traces back to the requirement it verifies. What type of traceability is the tester performing?

   • ABidirectional traceability
   • BVertical traceability
   • CBackward traceability
   • DForward traceability
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which set of artifacts is typically linked in a security requirement traceability matrix?

   • ARisk assessments, threat models, and incident reports
   • BRequirements, design elements, code modules, and test cases
   • CUser manuals, release notes, and installation guides
   • DProject plans, schedules, and meeting minutes
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a benefit of automating traceability matrix maintenance?

   • AIt automatically fixes security vulnerabilities
   • BIt eliminates the need for security testing
   • CIt guarantees that all requirements are secure
   • DIt reduces manual effort and improves accuracy of links
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is a sign of a coverage gap in the traceability matrix?

   • AA code module is linked to a test case
   • BA security requirement has no corresponding test case
   • CA test case is linked to multiple requirements
   • DA design element is linked to a requirement
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the primary purpose of a security requirement traceability matrix (RTM) in the software development lifecycle?

   • ATo list all security vulnerabilities found during penetration testing
   • BTo provide a mapping between security requirements and corresponding design, code, and test artifacts
   • CTo define the security architecture of the application
   • DTo replace the need for security testing by documenting requirements
   Reveal Solution Discussion Select an answer first