Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which process is essential for maintaining the accuracy of a traceability matrix over time?

   • ACreating a new matrix for each release and discarding the old one
   • BOnly updating the matrix when a security incident occurs
   • CHaving the development team update the matrix informally as they code
   • DRegularly reviewing and updating the matrix as part of change management
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security architect is creating a traceability matrix for a new application. The architect wants to ensure that each security requirement is linked to the appropriate artifacts. Which set of artifacts should be linked to each security requirement?

   • AProject plans, budgets, and schedules.
   • BRisk assessments, threat models, and incident reports.
   • CUser stories, acceptance criteria, and release notes.
   • DDesign elements, code modules, and test cases.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A risk analyst is using the traceability matrix to assess the impact of a newly discovered vulnerability. The vulnerability affects a specific code module. The analyst wants to know which security requirements are affected and whether those requirements are tested. What should the analyst do?

   • AReview the vulnerability report and guess which requirements are affected.
   • BTrace backward from the code module to the security requirements it implements.
   • CCheck the test results for the code module.
   • DTrace forward from the security requirements to the code module.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A risk manager wants to use the traceability matrix to support a risk assessment. The matrix maps security requirements to threats and mitigations. What is the primary benefit of using the matrix for this purpose?

   • AIt automatically calculates the risk score for each threat.
   • BIt eliminates the need for a separate threat model.
   • CIt provides a visual representation of the network architecture.
   • DIt shows which threats are mitigated by which requirements and whether those mitigations are implemented and tested.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During a sprint review, a security requirement is changed: the encryption algorithm is updated from AES-128 to AES-256. The project manager asks the security lead to update the traceability matrix. What is the most important action the security lead should take?

   • AUpdate the requirement text in the matrix and inform the development team.
   • BOnly update the test cases to match the new algorithm.
   • CDelete the old requirement and create a new one for AES-256.
   • DReview all linked design, code, and test artifacts and update them to reflect the new algorithm.
   Reveal Solution Discussion Select an answer first