Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is comparing how security testing is handled in waterfall versus Agile. Which statement accurately reflects a key difference?

   • AWaterfall performs security testing continuously, while Agile performs it only at the end.
   • BBoth methodologies rely on automated security testing only.
   • CWaterfall typically performs security testing in a dedicated phase, while Agile integrates testing into each iteration.
   • DBoth methodologies perform security testing in a dedicated phase at the end.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of a security gate in a software development lifecycle?

   • ATo ensure that security criteria are met before proceeding to the next phase
   • BTo replace the need for security testing
   • CTo block all changes to the codebase
   • DTo provide a log of all security incidents
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In a typical Agile team, who is primarily responsible for ensuring that security is considered in each user story?

   • AThe product owner alone
   • BThe security professional alone
   • CThe entire team, with support from security professionals
   • DThe external auditors
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How does the timing of security testing differ between waterfall and Agile?

   • ABoth test security only at the beginning
   • BWaterfall tests security early; Agile tests late
   • CWaterfall tests security in a dedicated phase; Agile tests continuously
   • DBoth test security only at the end
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A government contractor is developing a system using a strict waterfall methodology. The project is currently in the design phase. According to the methodology, what security activity should be performed at this stage?

   • APerform penetration testing on the partially implemented system.
   • BConduct a threat model and produce a security design review document.
   • CConduct a post-implementation security review.
   • DDefine security requirements and acceptance criteria.
   Reveal Solution Discussion Select an answer first