Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   An organization is moving from a waterfall to an Agile methodology. The compliance team is concerned about losing traceability of security decisions. What should the organization implement to maintain traceability in Agile?

   • AMaintain a security backlog with user stories that link to security requirements and acceptance criteria.
   • BUse a wiki to record decisions, but do not link them to specific code changes.
   • CRequire all security decisions to be documented in a single, comprehensive design document.
   • DRely on the security professional to remember all decisions and communicate them verbally.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security auditor is reviewing an Agile project and asks for evidence that security requirements were traced to code. The team has a product backlog with security user stories, but no formal traceability matrix. What should the team provide to satisfy the auditor?

   • AA mapping of security user stories to code commits and test results from the version control and test management tools.
   • BA new traceability matrix created after the audit request.
   • CA verbal explanation from the security professional that the requirements were implemented.
   • DA retrospective presentation summarizing the security work done.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A startup is adopting an Agile methodology to rapidly deliver a new mobile app. The team wants to ensure security is not an afterthought. Which approach best aligns with Agile principles?

   • APerform a single security review at the end of the project before release.
   • BCreate a comprehensive security requirements document before development begins.
   • CEmbed a security professional in the team and include security tasks in each sprint.
   • DOutsource all security testing to an external vendor after each release.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An Agile team has accumulated security debt over several sprints, including outdated dependencies and unpatched vulnerabilities. What is the most effective way to manage this debt?

   • AIgnore security debt until the end of the project when there is more time.
   • BDedicate an entire sprint to fixing all security debt at once.
   • CAllocate a percentage of each sprint's capacity to reducing security debt.
   • DCreate a separate project to track and fix security debt outside the regular sprints.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A large enterprise is transitioning from waterfall to Agile. The security team is concerned that security gates, which were previously phase-gate reviews, will be lost. What is the best way to adapt security gates to the Agile framework?

   • AEliminate security gates entirely and rely on automated security testing.
   • BCreate a separate security process that runs in parallel with the Agile development process.
   • CKeep the same phase-gate reviews but compress them into a single review at the end of each release.
   • DDefine security gates as part of the Definition of Done for each user story and sprint.
   Reveal Solution Discussion Select an answer first