A company is developing a new application and has an internal policy that all code must be scanned for vulnerabilities using a specific tool. However, the tool is not compatible with the programming language the team plans to use. What is the most appropriate course of action?

Use the tool anyway and accept the risk of incomplete scanning

Request an exception to the policy and use a compatible alternative tool

Skip the vulnerability scan because the policy is not a legal requirement

Change the programming language to match the tool

A company is developing a new application and the security team is gathering requirements. The company has a policy that all code must be reviewed by a security specialist before release. Which of the following is the most appropriate way to capture this in the software requirements?

As a non-functional requirement for the development process

As a legal requirement mandated by a regulatory authority

As a performance requirement for the application

As a functional requirement for the application's user interface

A software application will be deployed in the healthcare sector in the United States. Which regulatory authority has jurisdiction over the privacy and security of protected health information (PHI) handled by this software?

The Food and Drug Administration (FDA)

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR)

The National Institute of Standards and Technology (NIST)

The Federal Communications Commission (FCC)

A software development firm is creating a mobile app that will use open-source libraries. Which legal requirement must the firm consider to avoid intellectual property violations?

The Payment Card Industry Data Security Standard (PCI DSS)

The Federal Information Processing Standards (FIPS)

The software licenses of the open-source libraries

The International Traffic in Arms Regulations (ITAR)

A software system will store and transmit electronic protected health information (ePHI) for a hospital. Which industry-specific compliance standard must the software requirements incorporate?

The General Data Protection Regulation (GDPR)

The Federal Information Processing Standards (FIPS)

The Payment Card Industry Data Security Standard (PCI DSS)

The Health Insurance Portability and Accountability Act (HIPAA)

Certified Secure Software Lifecycle Professional

Domain 3Objective 2

Identify Compliance Requirements CSSLP Practice Questions (Page 1)

Part of the Secure Software Requirements domain, which accounts for 13% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

13%of the exam

Questions 1–5

1expert · hard
A company is developing a new application and has an internal policy that all code must be scanned for vulnerabilities using a specific tool. However, the tool is not compatible with the programming language the team plans to use. What is the most appropriate course of action?
Select an answer first
2application · medium
A company is developing a new application and the security team is gathering requirements. The company has a policy that all code must be reviewed by a security specialist before release. Which of the following is the most appropriate way to capture this in the software requirements?
Select an answer first
3foundation · easy
A software application will be deployed in the healthcare sector in the United States. Which regulatory authority has jurisdiction over the privacy and security of protected health information (PHI) handled by this software?
Select an answer first
4foundation · easy
A software development firm is creating a mobile app that will use open-source libraries. Which legal requirement must the firm consider to avoid intellectual property violations?
Select an answer first
5foundation · easy
A software system will store and transmit electronic protected health information (ePHI) for a hospital. Which industry-specific compliance standard must the software requirements incorporate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.