A company is developing a mobile payment app that will store credit card numbers and also collect health-related data for a wellness program. The app will be available in the EU and the United States. The security team is defining the compliance requirements. Which of the following is the most critical legal requirement to address?

Comply only with HIPAA because health data is involved

Comply only with the US state privacy laws

Comply with the Canadian privacy law because the company is based in Canada

Comply with PCI DSS for cardholder data and GDPR for EU users' personal data

A company is developing a new application and has a policy that all code must be reviewed by a security specialist. However, the project timeline is very tight, and the security team is overburdened. The project manager suggests skipping the review to meet the deadline. What is the most appropriate response?

Ask the project manager to approve a one-time exception

Request an extension to the timeline to complete the review

Perform a reduced review of only the critical modules

Skip the review and document the risk

A software company is developing a mobile health app that will be used by hospitals in the European Union to store patient records. The company is headquartered in the United States. Which regulatory authority should the security team identify as having primary jurisdiction over the data handling requirements?

The European Data Protection Board (EDPB)

The U.S. Department of Health and Human Services (HHS) Office for Civil Rights

The national data protection authority (DPA) of the EU member state where the hospitals are located

The U.S. Federal Trade Commission (FTC)

A software company is developing a cloud-based application that will be used by both healthcare providers in the EU and financial institutions in the United States. The company is based in Canada. The security team must identify the regulatory authorities and standards that apply. Which of the following is the most comprehensive approach?

Comply with HIPAA and PCI DSS, since they are the most widely recognized standards

Comply with the laws of the first country where the application is deployed

Identify and comply with the applicable laws and standards in each jurisdiction, including GDPR, HIPAA, and relevant financial regulations

Comply with the Canadian privacy laws only, since the company is based there

A software development team is starting a new project. The company has a policy that all code must be stored in an internal repository and all developers must use a specific IDE. What is the primary reason these company-wide policies must be incorporated into the software requirements?

To reduce the cost of software development

To ensure the software is developed using the latest technology

To maintain consistency, security, and auditability across the development process

To comply with legal regulations that mandate specific development tools

Certified Secure Software Lifecycle Professional

Domain 3Objective 2

Identify Compliance Requirements CSSLP Practice Questions (Page 4)

Part of the Secure Software Requirements domain, which accounts for 13% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 1–2 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

4concepts

13%of the exam

Questions 16–20

16expert · hard
A company is developing a mobile payment app that will store credit card numbers and also collect health-related data for a wellness program. The app will be available in the EU and the United States. The security team is defining the compliance requirements. Which of the following is the most critical legal requirement to address?
Select an answer first
17expert · hard
A company is developing a new application and has a policy that all code must be reviewed by a security specialist. However, the project timeline is very tight, and the security team is overburdened. The project manager suggests skipping the review to meet the deadline. What is the most appropriate response?
Select an answer first
18application · medium
A software company is developing a mobile health app that will be used by hospitals in the European Union to store patient records. The company is headquartered in the United States. Which regulatory authority should the security team identify as having primary jurisdiction over the data handling requirements?
Select an answer first
19expert · hard
A software company is developing a cloud-based application that will be used by both healthcare providers in the EU and financial institutions in the United States. The company is based in Canada. The security team must identify the regulatory authorities and standards that apply. Which of the following is the most comprehensive approach?
Select an answer first
20application · medium
A software development team is starting a new project. The company has a policy that all code must be stored in an internal repository and all developers must use a specific IDE. What is the primary reason these company-wide policies must be incorporated into the software requirements?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Identify Compliance Requirements CSSLP Practice Questions (Page 4)

Questions 16–20

A software development team is starting a new project. The company has a policy that all code must be stored in an internal repository and all developers must use a specific IDE. What is the primary reason these company-wide policies must be incorporated into the software requirements?

Keep studying — Secure Software Requirements