Manage Security Within a Software Development Methodology (e.g., Agile, Waterfall) CSSLP Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   In Agile, how is security debt typically managed?

   • AIt is resolved only during maintenance
   • BIt is handled by external auditors
   • CIt is tracked in the backlog and prioritized for future sprints
   • DIt is ignored until the end of the project
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   In Agile, how is documentation of security decisions typically handled?

   • AIn a single comprehensive security document at the start
   • BThrough formal phase-gate review documents
   • CThrough code comments only
   • DThrough lightweight artifacts like user stories and acceptance criteria
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A development team using Scrum has just completed a sprint that delivered a new authentication feature. The security professional identified a medium-severity vulnerability in the session management code but the product owner wants to release the feature to meet a market deadline. What is the most appropriate action for the security professional?

   • ABlock the release until the vulnerability is fixed, regardless of the product owner's decision.
   • BQuietly fix the vulnerability in the next sprint without adding it to the backlog to avoid delaying the release.
   • CAdd a security user story to the next sprint to fix the vulnerability, and document the risk in the product backlog.
   • DImmediately escalate the issue to the CEO to force a delay in the release.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A financial services company is required to comply with PCI DSS. They are using a hybrid development approach with some waterfall projects and some Agile projects. How should they ensure compliance across both methodologies?

   • AUse the same security gate at the same point in the lifecycle for both methodologies.
   • BImplement security gates at the end of each phase in waterfall and at the end of each sprint in Agile.
   • COnly apply compliance checks to the waterfall projects because they are more formal.
   • DDefer all compliance activities until the final release of each project.
   Reveal Solution Discussion Select an answer first