Identify and Adopt Security Standards (e.g., Implementing Security Frameworks, Promoting Security Awareness) CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a common component of an effective security awareness program?

   • AA firewall configuration change
   • BA one-time email sent to all employees
   • CA policy document stored in a shared drive
   • DRegular training sessions and simulated phishing exercises
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company is adopting the BSIMM framework to improve its software security. The security team has limited resources and wants to prioritize initiatives that will have the most impact. Which action should they take first?

   • AConduct a BSIMM assessment to identify current strengths and weaknesses
   • BImplement all BSIMM practices simultaneously
   • CFocus only on the practices that are easiest to implement
   • DHire external consultants to implement BSIMM without internal involvement
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to increase employee participation in its security awareness program. Which incentive is most likely to encourage participation?

   • APublicly recognize employees who complete training
   • BOffer a small reward, such as a gift card, for completing training modules
   • CSend reminders to employees who have not completed training
   • DMake training mandatory and track completion
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which mechanism is commonly used to support the continuous improvement of security practices?

   • AKeeping security policies unchanged for years
   • BDisabling security controls to improve performance
   • CIgnoring security incidents to avoid disruption
   • DPeriodic security reviews and audits
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the primary purpose of integrating a security framework into the software development lifecycle (SDLC)?

   • ATo guarantee that software will have zero vulnerabilities
   • BTo replace the need for any security testing
   • CTo ensure security is considered and addressed at each phase of development
   • DTo speed up the development process by skipping security reviews
   Reveal Solution Discussion Select an answer first