What is the purpose of applying a security baseline to a system?

To increase the system's processing speed

To establish a standard set of secure configuration settings

To allow all users to have the same permissions

To ensure the system has the latest hardware

What is a key aspect of maintaining compliance during software maintenance?

Deleting license records after installation

Using unlicensed software to reduce costs

Ignoring license agreements to save time

Tracking license usage and ensuring it stays within the purchased limits

What is the purpose of privilege escalation controls in the context of least privilege enforcement?

To provide temporary elevated access only when necessary and with proper authorization

To prevent any user from ever gaining elevated privileges

To allow users to permanently gain higher privileges without approval

To automatically grant all users the highest privilege level

What is a key security consideration when implementing Infrastructure as Code (IaC)?

Embedding security controls and validating the code before deployment

Using IaC only for development environments, not production

Storing secrets directly in the IaC templates for convenience

Avoiding version control for IaC templates

A development team uses a public Git repository to store Infrastructure as Code templates. The templates include a connection string to a production database. Which action best addresses the security risk?

Encrypt the connection string and store the encryption key in the same repository.

Use a placeholder in the template and manually enter the connection string during deployment.

Remove the connection string from the template and reference it from a secrets vault at deployment time.

Keep the connection string in the template but restrict access to the repository.

Certified Secure Software Lifecycle Professional

Domain 7Objective 5

Ensure Secure Installation CSSLP Practice Questions (Page 7)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

13concepts

11%of the exam

Questions 31–35

31foundation · easy
What is the purpose of applying a security baseline to a system?
Select an answer first
32foundation · easy
What is a key aspect of maintaining compliance during software maintenance?
Select an answer first
33foundation · easy
What is the purpose of privilege escalation controls in the context of least privilege enforcement?
Select an answer first
34foundation · easy
What is a key security consideration when implementing Infrastructure as Code (IaC)?
Select an answer first
35application · medium
A development team uses a public Git repository to store Infrastructure as Code templates. The templates include a connection string to a production database. Which action best addresses the security risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.