Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A healthcare organization must comply with HIPAA. They are using an Agile methodology. How should they ensure that HIPAA requirements are addressed?

   • AInclude HIPAA requirements as acceptance criteria in relevant user stories.
   • BCreate a separate compliance document and review it at the end of the project.
   • CRely on the security professional to ensure compliance without involving the development team.
   • DUse a waterfall approach for all HIPAA-related projects.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which statement best describes how security testing is handled in the waterfall model?

   • ASecurity testing is a distinct activity in the testing phase, after implementation
   • BSecurity testing is performed continuously throughout each phase
   • CSecurity testing is performed only during the requirements phase
   • DSecurity testing is performed by developers during coding
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which statement best describes how security requirements are handled in waterfall versus Agile?

   • AWaterfall defines all security requirements upfront; Agile refines them iteratively
   • BBoth refine security requirements only during maintenance
   • CAgile defines all security requirements upfront; waterfall refines them iteratively
   • DBoth define all security requirements upfront
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is 'security debt' in the context of software development?

   • AThe amount of time spent on security testing
   • BThe number of security professionals on the team
   • CThe cost of purchasing security tools
   • DThe accumulation of known security issues that are deferred
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In Agile development, how is a security requirement typically captured for a sprint?

   • AAs a security user story in the product backlog
   • BAs a compliance audit finding
   • CAs a phase-gate checklist item
   • DAs a separate security requirements document
   Reveal Solution Discussion Select an answer first