Implement Secure Operation Practices CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After a security incident is resolved, the incident response team conducts a lessons-learned meeting. The team identifies that the incident was not detected quickly because monitoring alerts were not configured for a specific attack vector. What should the team do to improve future detection?

   • AReplace the incident response team with a new team.
   • BUpdate the incident response plan to include the new attack vector.
   • CImplement additional monitoring and alerting rules for the attack vector.
   • DConduct a full security assessment of the application.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During a security incident, the incident response team discovers that the monitoring system failed to alert on the initial intrusion because the alert threshold was set too high. The team is now in the containment phase. What should the team do to address the monitoring gap without compromising the incident response?

   • ALower the threshold and assign a team member to monitor alerts.
   • BStop the incident response and fix the monitoring system first.
   • CDocument the monitoring gap and address it in the lessons-learned phase.
   • DImmediately lower the alert threshold and continue with containment.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A software change is proposed to add a new feature to a customer-facing web application. The change has been coded and tested in a staging environment. According to a formal change management process, what is the next step before deploying to production?

   • ADocument the change after deployment to save time.
   • BSubmit the change to the change advisory board for approval.
   • CRun a final security scan on the production environment.
   • DDeploy the change to production immediately to meet the release deadline.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is primarily used for validation to ensure software is fit for its intended use?

   • ACode review
   • BStatic analysis
   • CUnit testing
   • DUser acceptance testing (UAT)
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security patch for a critical vulnerability in a payment processing application is released. The change advisory board (CAB) has approved an emergency change to deploy the patch during the next maintenance window. The deployment team is ready to proceed. What must happen before the change is considered complete?

   • ARe-run the full regression test suite and obtain a new authorization to operate (ATO).
   • BRoll back the change if any user reports a minor issue within 24 hours.
   • CUpdate the configuration management database (CMDB) and obtain post-implementation sign-off from the CAB.
   • DNotify all customers of the patch deployment before the maintenance window.
   Reveal Solution Discussion Select an answer first