Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   In a Scrum team, a developer discovers a security flaw in a third-party library during a sprint. According to Agile principles, what should the developer do?

   • AWait until the next sprint planning meeting to mention it.
   • BFix the flaw immediately without telling anyone, to avoid disrupting the sprint.
   • CInform the security professional and product owner, and add a task to the sprint backlog to address it.
   • DIgnore the flaw because it is in a third-party library and not the team's responsibility.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   In a waterfall project, who is typically responsible for approving the security design before development begins?

   • AThe lead developer.
   • BThe security architect or security team lead.
   • CThe project manager.
   • DThe quality assurance team.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An Agile team has a large amount of security debt, including several critical vulnerabilities. The team is under pressure to deliver new features. The security professional proposes a 'security sprint' to address the debt. What is a potential drawback of this approach?

   • AIt may disrupt the team's velocity and delay feature delivery, but it provides a focused effort to reduce debt.
   • BIt will increase security debt because the team will be distracted from security.
   • CIt is not possible to do a security sprint in Agile because sprints are for features only.
   • DIt will not reduce security debt because the team will not have time to test the fixes.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In an Agile project, how are regulatory compliance requirements typically addressed?

   • AThey are documented in a separate compliance document only
   • BThey are translated into user stories and included in the backlog
   • CThey are handled only by external auditors
   • DThey are ignored until the final release
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An Agile team is planning the next sprint. The product owner wants to prioritize new features, but the security professional has identified critical security debt that must be addressed. What is the best way to handle this conflict?

   • AForce the security debt into the sprint without discussion.
   • BWork with the product owner to prioritize the security debt based on risk and business impact.
   • CDefer the security debt to the next release, regardless of risk.
   • DAsk the developers to fix the debt in their spare time.
   Reveal Solution Discussion Select an answer first