A financial services firm is adopting the NIST Cybersecurity Framework to improve its software security posture. The security team wants to integrate the framework into their existing SDLC. Which action best aligns with the framework's 'Identify' function?

Conduct a risk assessment to catalog critical assets and data flows

Develop an incident response plan and test it

Deploy an intrusion detection system on the production network

Implement multi-factor authentication for all developer accounts

A software company wants to reduce the number of security incidents caused by employees falling for phishing emails. The security team has budget for one new initiative. Which approach is most likely to improve security awareness and reduce incidents?

Add security awareness topics to the company's annual all-hands meeting

Conduct a one-time, mandatory security training session for all employees

Implement a monthly simulated phishing campaign with immediate feedback and targeted training

Post security awareness posters in common areas and break rooms

Which of the following is a key consideration when selecting a security framework for an organization?

The framework's number of pages or length

The framework's name recognition in the media

The framework's exclusivity to a single vendor

The framework's fit with the organization's risk posture and business context

Certified Secure Software Lifecycle Professional

Domain 2Objective 2

Identify and Adopt Security Standards (e.g., Implementing Security Frameworks, Promoting Security Awareness) CSSLP Practice Questions (Page 3)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

5concepts

11%of the exam

Questions 11–15

11application · easy
A startup building a web application wants to adopt a security standard that provides practical, actionable guidance for common web vulnerabilities. Which standard should they choose?
Select an answer first
12application · medium
A financial services firm is adopting the NIST Cybersecurity Framework to improve its software security posture. The security team wants to integrate the framework into their existing SDLC. Which action best aligns with the framework's 'Identify' function?
Select an answer first
13application · medium
A software company wants to reduce the number of security incidents caused by employees falling for phishing emails. The security team has budget for one new initiative. Which approach is most likely to improve security awareness and reduce incidents?
Select an answer first
14application · medium
A healthcare software company must comply with HIPAA and wants to integrate security into its agile development lifecycle. The team is small, uses Scrum, and needs a framework that provides prescriptive security activities without heavy documentation overhead. Which framework should the security lead recommend?
Select an answer first
15foundation · easy
Which of the following is a key consideration when selecting a security framework for an organization?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Identify and Adopt Security Standards (e.g., Implementing Security Frameworks, Promoting Security Awareness) CSSLP Practice Questions (Page 3)

Questions 11–15

A startup building a web application wants to adopt a security standard that provides practical, actionable guidance for common web vulnerabilities. Which standard should they choose?

A financial services firm is adopting the NIST Cybersecurity Framework to improve its software security posture. The security team wants to integrate the framework into their existing SDLC. Which action best aligns with the framework's 'Identify' function?

A software company wants to reduce the number of security incidents caused by employees falling for phishing emails. The security team has budget for one new initiative. Which approach is most likely to improve security awareness and reduce incidents?

Which of the following is a key consideration when selecting a security framework for an organization?

Keep studying — Secure Software Lifecycle Management