Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A risk analyst is using the traceability matrix to assess whether a newly identified threat is adequately mitigated. The threat is 'SQL injection via user input fields'. The analyst wants to find which security requirements address this threat and whether they are implemented and tested. What should the analyst do?

   • AReview the threat model and map the threat to relevant security requirements in the matrix.
   • BSearch the codebase for input validation functions.
   • CCheck the test results for all test cases.
   • DAsk the development team if they fixed SQL injection.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What does a coverage analysis of the traceability matrix primarily identify?

   • AThe cost of implementing each security requirement
   • BSecurity requirements that are not linked to any design, code, or test artifact
   • CThe performance of the development team
   • DThe number of security vulnerabilities in the code
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What role does the traceability matrix play in demonstrating compliance with security standards?

   • AIt proves that the software has no vulnerabilities
   • BIt replaces the need for security testing
   • CIt shows that each security requirement is linked to the artifacts that implement and verify it
   • DIt is only used for internal purposes and not for audits
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is using a requirements management tool that supports traceability, but they are not using it effectively. The team is manually updating a spreadsheet and often misses links. They want to improve the process with minimal disruption. What is the best approach?

   • ASwitch to a different tool that is more complex.
   • BHire a dedicated traceability manager.
   • CContinue using the spreadsheet but add more columns for links.
   • DTrain the team on the tool's traceability features and enforce their use.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   How does the traceability matrix support compliance audits?

   • ABy automatically generating compliance certificates
   • BBy providing evidence that security requirements are implemented and verified
   • CBy replacing the need for external audits
   • DBy hiding security weaknesses from auditors
   Reveal Solution Discussion Select an answer first