A waterfall project is in the requirements phase. What security artifact should be produced to support traceability?

A security requirements specification that is linked to business requirements.

A threat model for the system architecture.

A security incident response plan.

A company is developing a product that must comply with GDPR. They use a Scrum methodology with two-week sprints. The legal team requires a Data Protection Impact Assessment (DPIA) before any processing of personal data. How should the team handle this requirement?

Defer the DPIA until after the feature is released.

Ask the legal team to approve the feature without a DPIA because it is an Agile project.

Include the DPIA as a task in the sprint where the personal data processing feature is developed.

Perform the DPIA once at the start of the project for all features.

In the waterfall model, where are compliance requirements typically documented?

In the requirements specification document

In an Agile project, how are security checkpoints typically implemented?

As a phase-gate review after each phase

As part of the definition of done for each sprint

As a single gate before release

In the waterfall model, who typically conducts the formal security review at the end of the design phase?

The security professional or security team

The developers who wrote the code

Certified Secure Software Lifecycle Professional

Domain 2Objective 1

Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 3)

Part of the Secure Software Lifecycle Management domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

8concepts

11%of the exam

Questions 11–15

11application · medium
A waterfall project is in the requirements phase. What security artifact should be produced to support traceability?
Select an answer first
12expert · hard
A company is developing a product that must comply with GDPR. They use a Scrum methodology with two-week sprints. The legal team requires a Data Protection Impact Assessment (DPIA) before any processing of personal data. How should the team handle this requirement?
Select an answer first
13foundation · easy
In the waterfall model, where are compliance requirements typically documented?
Select an answer first
14foundation · easy
In an Agile project, how are security checkpoints typically implemented?
Select an answer first
15foundation · easy
In the waterfall model, who typically conducts the formal security review at the end of the design phase?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.