A team is testing a new microservices-based application that will handle sensitive customer data. They have a staging environment that uses a subset of production data, but the data is anonymized. The team wants to validate security behavior under realistic conditions, including the interaction between services. Which approach best simulates production while respecting data privacy?

Use the anonymized data in the staging environment and run integration tests that exercise the interactions between services.

Use synthetic data that is completely different from production data to avoid any privacy concerns.

Copy the full production data to staging without anonymization to ensure exact realism.

Run the tests only in production during off-peak hours to get the most realistic results.

A developer writes tests that verify the behavior of a single function in isolation, and also measures the percentage of code lines executed by those tests. Which two testing concepts are being applied?

Failure testing and stress testing

Fuzzing and penetration testing

Integration testing and regression testing

Certified Secure Software Lifecycle Professional

Domain 6Objective 2

Develop Security Test Cases CSSLP Practice Questions (Page 7)

Part of the Secure Software Testing domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 1–2 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

12concepts

14%of the exam

Questions 31–33

31foundation · easy
A team is testing how the authentication module interacts with the user database module to ensure that credentials are properly validated across the interface. This testing activity is best described as:
Select an answer first
32expert · hard
A team is testing a new microservices-based application that will handle sensitive customer data. They have a staging environment that uses a subset of production data, but the data is anonymized. The team wants to validate security behavior under realistic conditions, including the interaction between services. Which approach best simulates production while respecting data privacy?
Select an answer first
33foundation · easy
A developer writes tests that verify the behavior of a single function in isolation, and also measures the percentage of code lines executed by those tests. Which two testing concepts are being applied?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Develop Security Test Cases CSSLP Practice Questions (Page 7)

Questions 31–33

A team is testing how the authentication module interacts with the user database module to ensure that credentials are properly validated across the interface. This testing activity is best described as:

A developer writes tests that verify the behavior of a single function in isolation, and also measures the percentage of code lines executed by those tests. Which two testing concepts are being applied?

Keep studying — Secure Software Testing