Outline Strategy and Roadmap CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard · select all that apply

   A control gate at the end of the requirements phase has failed because the security requirements are incomplete. The project manager wants to proceed to design. Which actions are appropriate? (Select all that apply.)

   • AProceed to design and complete the security requirements during the design phase.
   • BCreate a remediation plan to complete the security requirements and schedule a re-evaluation at a follow-up gate.
   • CEscalate the issue to the steering committee for a decision on whether to proceed.
   • DHalt the project and require the security requirements to be completed before proceeding.
   Check answers Discussion Select an answer first
2. 2application · medium

   A project is at a control gate review for the architecture phase. The security team has identified a critical flaw in the proposed architecture. The project manager wants to proceed to development to meet a deadline. Who has the authority to make the final decision on whether the project proceeds?

   • AThe security team, as they identified the flaw.
   • BA designated review board or steering committee with representation from security, project management, and business stakeholders.
   • CThe development team lead, as they understand the technical implications.
   • DThe project manager, as they are responsible for the project schedule.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A control gate review is scheduled for the end of the testing phase. The security team has identified a critical vulnerability that requires a significant architectural change to fix. The project manager is concerned about the cost and schedule impact. The business sponsor wants to release the product on time. Who should make the final decision on whether to proceed, and what should be considered?

   • AThe business sponsor should decide, as they own the product and its release.
   • BA steering committee with security, project management, and business representation should decide, weighing the risk against the business impact.
   • CThe project manager should decide, as they are responsible for the schedule and budget.
   • DThe security team should decide, as they are the experts on the vulnerability.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A project has a control gate at the end of the design phase. The break criteria require that all high-severity threats identified in the threat model have a mitigation plan. The design team has identified a high-severity threat for which the only known mitigation is to use a third-party service that is not yet approved by the security team. The project manager wants to proceed to coding to avoid delay. What is the most appropriate action?

   • AProceed with coding using an alternative mitigation that is not yet fully designed.
   • BAllow the project to proceed with a risk acceptance signed by the project manager.
   • CProceed to coding and defer the approval of the third-party service to the next checkpoint.
   • DHalt the project and require the security team to approve the third-party service before proceeding.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of break/build criteria in a security checkpoint?

   • ATo document the security requirements for the project
   • BTo assign security roles to team members
   • CTo determine whether the project continues, is halted, or is redirected based on specific conditions
   • DTo define the overall security strategy for the organization
   Reveal Solution Discussion Select an answer first