Develop Security Requirement Traceability Matrix CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which statement best describes the role of a security requirement traceability matrix?

   • AIt is a static document that is created once and never updated
   • BIt is a tool used only during the requirements phase to capture stakeholder needs
   • CIt is a living document that links security requirements to design, code, and test artifacts to ensure coverage
   • DIt is a list of security controls that must be implemented in the final product
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   How does the traceability matrix support risk management?

   • ABy replacing the need for a threat model
   • BBy automatically fixing vulnerabilities in the code
   • CBy mapping security requirements to threats and mitigations
   • DBy calculating the financial impact of a security breach
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security requirement is changed to use a different authentication protocol. The traceability matrix has links to design, code, and test artifacts. The change is significant and affects multiple modules. What is the best way to update the matrix to reflect this change?

   • AOnly update the test cases that verify the authentication protocol.
   • BCreate a new requirement and link it to the new artifacts, leaving the old links in place.
   • CUpdate the requirement text and all linked artifacts in the matrix.
   • DRemove the requirement from the matrix and add it back after the change is complete.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which type of traceability is used to verify that a specific test case is linked to a security requirement?

   • AForward traceability
   • BBackward traceability
   • CVertical traceability
   • DHorizontal traceability
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A software development team is using a requirements management tool that supports linking requirements to test cases. However, the team manually updates the traceability matrix in a spreadsheet after each release. They are looking for a way to reduce manual effort and errors. What should they do?

   • AContinue using the spreadsheet but assign a dedicated person to update it.
   • BStop maintaining the matrix and rely on code reviews.
   • CUse the tool's built-in traceability reports to generate the matrix automatically.
   • DCreate a new spreadsheet with more columns.
   Reveal Solution Discussion Select an answer first