A company uses Infrastructure as Code (IaC) to deploy virtual machines. The security team wants to ensure that all deployed VMs have the same hardened configuration and that no secrets are exposed in the templates. Which practice best achieves this?

Use a configuration management tool to apply a hardened baseline and reference secrets from a vault in the IaC templates.

Use a generic configuration that works for all environments without applying security baselines.

Manually configure each VM after deployment to ensure the settings are correct.

Embed the admin password directly in the IaC template for simplicity.

Why is the principle of least privilege important for system security?

It reduces the risk of unauthorized access and limits the potential damage from a compromised account

It eliminates the need for monitoring user activity

It simplifies the process of granting permissions to new employees

It ensures that all users can access the resources they need without delay

A software company uses third-party libraries in its products. The legal team requires that all libraries comply with open-source licenses. The development team wants to automate compliance checks. Which approach is most effective?

Rely on the development team to self-certify that all licenses are compliant.

Manually review the licenses of all libraries before release.

Only use libraries with permissive licenses and ignore copyleft licenses.

Use a software composition analysis (SCA) tool to scan dependencies and generate a license compliance report.

Why is it important to manage software licensing during deployment?

To comply with legal and organizational requirements and avoid penalties

To speed up the installation process

To reduce the need for security patches

To ensure the software is installed on the most powerful hardware

How should secrets be managed in Infrastructure as Code (IaC) templates?

They should be stored in the template in plain text for easy access

They should be shared via email to team members

They should be referenced from a secure secrets management service

They should be hard-coded in the template to ensure they are always available

Certified Secure Software Lifecycle Professional

Domain 7Objective 5

Ensure Secure Installation CSSLP Practice Questions (Page 1)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

13concepts

11%of the exam

Questions 1–5

1application · medium
A company uses Infrastructure as Code (IaC) to deploy virtual machines. The security team wants to ensure that all deployed VMs have the same hardened configuration and that no secrets are exposed in the templates. Which practice best achieves this?
Select an answer first
2foundation · easy
Why is the principle of least privilege important for system security?
Select an answer first
3expert · hard
A software company uses third-party libraries in its products. The legal team requires that all libraries comply with open-source licenses. The development team wants to automate compliance checks. Which approach is most effective?
Select an answer first
4foundation · easy
Why is it important to manage software licensing during deployment?
Select an answer first
5foundation · easy
How should secrets be managed in Infrastructure as Code (IaC) templates?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.