Outline Strategy and Roadmap CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of a security roadmap in secure software development?

   • ATo document the organization's hiring plan for security staff
   • BTo provide a detailed design of the application architecture
   • CTo list all security vulnerabilities found in the code
   • DTo sequence security milestones and checkpoints across the project timeline
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following best illustrates the integration of a security milestone into the SDLC?

   • AAsking developers to think about security informally during coding
   • BConducting a security audit only after the product is released
   • CCreating a security policy document that is never updated
   • DScheduling a threat modeling review at the end of the design phase
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary function of a security checkpoint in the development process?

   • ATo review the security status of the project against established criteria at a specific stage
   • BTo replace the need for security testing by relying on developer self-assessment
   • CTo define the overall security strategy for the organization
   • DTo automatically deploy security patches to production systems
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A project is at a control gate. The build criteria require that all security requirements have been implemented and verified. The development team has implemented all requirements, but the verification of two requirements is pending because the test environment is unavailable. The project manager wants to proceed to the next phase. What is the most appropriate action?

   • AProceed to the next phase and verify the two requirements later.
   • BProceed with a risk acceptance signed by the project manager.
   • CHalt the project until the test environment is available and the two requirements are verified.
   • DRedirect the project to a different phase to address the verification issue.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which stakeholder is typically responsible for ensuring that security gate reviews are scheduled and conducted?

   • AThe external auditors
   • BThe end users
   • CThe developers
   • DThe project manager
   Reveal Solution Discussion Select an answer first