Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is an artifact that should be linked in a security requirement traceability matrix?

   • ATest cases
   • BEmployee performance reviews
   • CMarketing materials
   • DProject budget reports
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common tool used to automate the creation and maintenance of a traceability matrix?

   • AWord processors
   • BSpreadsheets
   • CEmail clients
   • DRequirements management tools
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization is preparing for an external audit against a security standard that requires evidence that all security requirements are implemented and tested. The audit team asks for documentation showing the linkage from each security requirement to its implementation and verification. What should the organization provide?

   • AA list of all security requirements and their status.
   • BThe traceability matrix with links to design, code, and test artifacts.
   • CThe threat model and risk assessment report.
   • DThe source code repository with commit history.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security team is using a traceability matrix to verify that all security requirements are implemented. They have a matrix that shows links from requirements to design elements and code modules, but they notice that some test cases are not linked to any requirement. What is the most likely implication of this finding?

   • AThe test cases are for non-security functionality and can be ignored.
   • BThere may be test cases that do not map to any security requirement, indicating potential scope creep or missing requirements.
   • CThe test cases are not needed and should be removed.
   • DThe test cases are automatically linked to requirements through code.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst is creating a traceability matrix for a legacy system that has no existing documentation. The analyst needs to identify which code modules implement a specific security requirement. What is the best approach?

   • AReview the system's user manual.
   • BAsk the original developers to recall which modules they wrote.
   • CUse static analysis tools to scan the codebase for patterns related to the requirement.
   • DSkip the traceability matrix for legacy systems.
   Reveal Solution Discussion Select an answer first