A development team is working on a critical update to a financial application. They have written unit tests and performed code reviews. The project manager wants to ensure that the application will actually solve the business problem it was designed for. Which activity should the team perform?

Perform user acceptance testing with business stakeholders.

Conduct a design review with the architecture team.

Run a static code analysis tool.

Execute a load test to ensure the application can handle peak traffic.

A software development team is preparing to release a new version of an application. The team has completed unit tests and code reviews. The product owner asks the team to confirm that the application meets the business requirements and is usable by the target users. Which activity best addresses this request?

Perform a code review focused on coding standards and best practices.

Conduct user acceptance testing (UAT) with a sample of end users.

Execute a performance test to measure response times under load.

Run static analysis tools to identify potential security vulnerabilities.

A system is undergoing the Assessment and Authorization (A&A) process. The security assessment has been completed, and the results show a moderate risk that the authorizing official is willing to accept. What should the authorizing official do?

Issue an authorization to operate with the identified risk accepted.

Defer the decision until the risk is fully mitigated.

Deny authorization because any risk is unacceptable.

Request a new security assessment to eliminate all risk.

What is the primary purpose of documenting changes in a secure software change management process?

To provide a historical record for audits and accountability

To automatically approve similar changes in the future

To speed up the implementation of future changes

To eliminate the need for testing after changes

Certified Secure Software Lifecycle Professional

Domain 2Objective 9

Implement Secure Operation Practices CSSLP Practice Questions (Page 5)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

11%of the exam

Questions 21–25

21application · medium
A development team is working on a critical update to a financial application. They have written unit tests and performed code reviews. The project manager wants to ensure that the application will actually solve the business problem it was designed for. Which activity should the team perform?
Select an answer first
22application · medium
A software development team is preparing to release a new version of an application. The team has completed unit tests and code reviews. The product owner asks the team to confirm that the application meets the business requirements and is usable by the target users. Which activity best addresses this request?
Select an answer first
23application · medium
A system is undergoing the Assessment and Authorization (A&A) process. The security assessment has been completed, and the results show a moderate risk that the authorizing official is willing to accept. What should the authorizing official do?
Select an answer first
24foundation · easy
What is the primary purpose of documenting changes in a secure software change management process?
Select an answer first
25application · medium
An organization is developing an incident response plan for a new cloud-based application. The plan must define roles and responsibilities for handling incidents. Which role is typically responsible for coordinating the response efforts and communicating with stakeholders?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Implement Secure Operation Practices CSSLP Practice Questions (Page 5)

Questions 21–25

A development team is working on a critical update to a financial application. They have written unit tests and performed code reviews. The project manager wants to ensure that the application will actually solve the business problem it was designed for. Which activity should the team perform?

A system is undergoing the Assessment and Authorization (A&A) process. The security assessment has been completed, and the results show a moderate risk that the authorizing official is willing to accept. What should the authorizing official do?

What is the primary purpose of documenting changes in a secure software change management process?

An organization is developing an incident response plan for a new cloud-based application. The plan must define roles and responsibilities for handling incidents. Which role is typically responsible for coordinating the response efforts and communicating with stakeholders?

Keep studying — Secure Software Lifecycle Management