Implement Secure Operation Practices CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A critical application is being updated to fix a security vulnerability. The change has been tested and is ready for deployment. The change advisory board (CAB) has approved the change, but the deployment window is limited. The deployment team discovers that the change requires a database schema update that was not included in the original change request. What should the deployment team do?

   • AProceed with the deployment and include the schema update without approval.
   • BDeploy the application without the schema update and hope it works.
   • CDeploy the application and the schema update, then document it after.
   • DStop the deployment and submit a new change request for the schema update.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a formal change management process for a secure software system, which step typically occurs immediately after a change request is submitted?

   • ARollback planning
   • BImplementation of the change
   • CEvaluation and impact assessment
   • DPost-implementation review
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A system has been authorized to operate for one year. Six months into the authorization period, a significant vulnerability is discovered in a third-party component used by the system. The system owner wants to maintain the authorization. What should the system owner do?

   • AWait until the next annual assessment to address the vulnerability.
   • BImmediately re-authorize the system without further assessment.
   • CReport the vulnerability to the authorizing official and request a risk-based decision.
   • DDiscontinue the system until the next assessment.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A system has been authorized to operate for two years. During a routine security review, a new vulnerability is discovered that could allow unauthorized access to sensitive data. The system owner wants to maintain the authorization. The authorizing official is concerned about the risk. What should the system owner do first?

   • AConduct a risk analysis and report the findings to the authorizing official.
   • BRequest a new authorization to operate immediately.
   • CWait for the next annual assessment to address the vulnerability.
   • DImmediately apply a patch to fix the vulnerability.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government contractor is preparing to deploy a new system that processes sensitive data. The system has undergone a security assessment and the results have been documented. The authorizing official is reviewing the assessment report and the risk analysis. What is the next step in the Assessment and Authorization (A&A) process?

   • AIssue an authorization decision based on the risk analysis.
   • BBegin continuous monitoring of the system.
   • CRe-assess the system after every change.
   • DImplement all recommended security controls from the assessment.
   Reveal Solution Discussion Select an answer first