Outline Strategy and Roadmap CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   After a failed control gate has been remediated, what should happen next?

   • AThe project should automatically proceed to the next phase without further review
   • BThe security team should be replaced
   • CThe gate should be re-evaluated to confirm that the criteria are now met
   • DThe gate criteria should be relaxed to make it easier to pass
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team is about to start coding a new customer-facing web application. The security team wants to ensure that no code is written until the design has been reviewed and approved. Which control gate should be established at the end of the design phase to enforce this requirement?

   • AA security milestone that marks the completion of the design review
   • BA stakeholder meeting to discuss the design review findings
   • CA break criterion that halts development if the design review has not been completed
   • DA checkpoint where the team reports on the status of the design review
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the defining characteristic of a control gate in the SDLC?

   • AIt is a formal decision point that allows or blocks progression to the next phase based on security readiness
   • BIt is a tool that automatically fixes security vulnerabilities in code
   • CIt is a document that lists all security requirements for the project
   • DIt is an informal discussion among developers about potential security issues
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security architect is creating a security roadmap for a new software product. The roadmap must sequence security milestones and checkpoints across the project timeline. Which element is essential to include in the roadmap to ensure it is actionable?

   • AThe names of the security team members responsible for each activity.
   • BThe list of security tools to be used during development.
   • CThe budget allocated for each security activity.
   • DThe specific dates and phases for each milestone and checkpoint.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During a control gate review, a project fails to meet the security criteria for the design phase because the threat model is incomplete. The project manager wants to proceed to development to avoid schedule delays. What is the most appropriate response to this gate failure?

   • AProceed with development and schedule the threat model completion for the next checkpoint.
   • BHalt the project and require the threat model to be completed and reviewed before development can begin.
   • CEscalate the issue to the security team and ask them to complete the threat model themselves.
   • DAllow the project to proceed with a documented risk acceptance signed by the project sponsor.
   Reveal Solution Discussion Select an answer first