A project manager in a waterfall project wants to ensure that security is reviewed at key milestones. What should they implement?

Security gates at the end of each phase, with sign-off from the security team.

Daily security stand-up meetings.

A single security review at the end of the project.

An automated security scanner that runs only during the testing phase.

In the waterfall model, at which phase is a formal security requirements review typically conducted?

During the requirements phase, before design begins

During the maintenance phase, after deployment

During the design phase, as part of architectural review

During the testing phase, after code is complete

What is the purpose of traceability in secure software development?

To record all security incidents

To link security requirements to design, code, and tests

To measure developer productivity

To track the location of all developers

A company is developing a system that must meet strict regulatory requirements. They are using a hybrid approach: waterfall for the core system and Agile for peripheral modules. How should security gates be implemented to ensure compliance across both?

Use the same phase-gate reviews for both the core and the modules.

Use sprint-based checkpoints for both the core and the modules.

Use phase-gate reviews for the waterfall core and sprint-based security checkpoints for the Agile modules.

Eliminate security gates for the Agile modules because they are not critical.

What is the primary purpose of a security backlog in Agile?

To store all security testing tools and credentials

To track security vulnerabilities found in production

To document the security architecture of the system

To prioritize and manage security-related tasks and stories

Certified Secure Software Lifecycle Professional

Domain 2Objective 1

Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 1)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

11%of the exam

Questions 1–5

1application · medium
A project manager in a waterfall project wants to ensure that security is reviewed at key milestones. What should they implement?
Select an answer first
2foundation · easy
In the waterfall model, at which phase is a formal security requirements review typically conducted?
Select an answer first
3foundation · easy
What is the purpose of traceability in secure software development?
Select an answer first
4expert · hard
A company is developing a system that must meet strict regulatory requirements. They are using a hybrid approach: waterfall for the core system and Agile for peripheral modules. How should security gates be implemented to ensure compliance across both?
Select an answer first
5foundation · easy
What is the primary purpose of a security backlog in Agile?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.