Incorporate Integrated Risk Management Methods CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A software organization wants to benchmark its secure development practices against industry peers. The security team is considering using BSIMM. What is the primary purpose of BSIMM in this context?

   • ATo replace the need for other security standards like ISO 27001.
   • BTo define a set of mandatory security requirements for all software projects.
   • CTo certify that the organization's software is secure.
   • DTo provide a maturity model for measuring the organization's software security initiatives.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security architect is conducting a risk assessment for a critical financial application. The application has a known vulnerability that could be exploited to transfer funds. The estimated annual loss expectancy (ALE) is $1 million. The cost to implement a control that reduces the vulnerability's likelihood by 80% is $200,000. What is the most cost-effective decision?

   • ATransfer the risk by purchasing insurance instead.
   • BImplement the control only if the vulnerability is exploited.
   • CImplement the control because the reduction in ALE exceeds the cost.
   • DDo not implement the control because the cost is too high.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A software project has a critical vulnerability that could lead to a data breach. The estimated cost of a breach is $5 million, while the cost to fix the vulnerability is $50,000. The business owner decides to fix the vulnerability. Which risk management strategy is being applied?

   • ARisk avoidance
   • BRisk acceptance
   • CRisk mitigation
   • DRisk transfer
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   An organization wants to assess the maturity of its software security assurance program and identify specific activities to improve its security practices. Which framework is specifically designed to help organizations build and measure a software assurance program?

   • AISO/IEC 27001
   • BPCI DSS
   • COWASP Top 10
   • DSAMM
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst is conducting a risk assessment for a new mobile banking app. The app will store sensitive financial data. The analyst needs to prioritize risks based on potential impact. Which combination of factors is most important for prioritizing risks?

   • AComplexity of the code and the number of developers on the team.
   • BNumber of vulnerabilities and the cost of fixing them.
   • CLikelihood of exploitation and magnitude of business impact.
   • DTime since the last security audit and the number of security tools used.
   Reveal Solution Discussion Select an answer first