Outline Strategy and Roadmap CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A software development organization is adopting a secure SDLC framework. They want to integrate security checkpoints into their existing agile development process. Which approach best aligns security checkpoints with the agile lifecycle?

   • AConduct a single security checkpoint at the end of the project before release.
   • BConduct security checkpoints only during the requirements and design phases.
   • CConduct security checkpoints only when a security incident occurs.
   • DConduct a security checkpoint at the end of each sprint to review security deliverables and status.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary responsibility of the security team in a security gate review?

   • ATo manage the project budget and schedule
   • BTo write all the code for the project
   • CTo evaluate security readiness against the established criteria
   • DTo make the final decision on whether to release the product
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Why is it important for checkpoint criteria to be measurable and actionable?

   • ATo eliminate the need for stakeholder involvement in reviews
   • BTo make the checkpoint review process faster by skipping detailed analysis
   • CTo ensure objective evaluation of security status at each checkpoint
   • DTo allow the security team to make subjective judgments
   Reveal Solution Discussion Select an answer first
5. 24expert · hard · select all that apply

   A security checkpoint is scheduled for the end of the coding phase. The checkpoint criteria require that all critical and high-severity vulnerabilities are resolved. The team has fixed all critical vulnerabilities, but two high-severity vulnerabilities are still open. The project manager wants to proceed to testing. Which actions are appropriate? (Select all that apply.)

   • ACreate a remediation plan for the high-severity vulnerabilities and schedule a follow-up checkpoint.
   • BEscalate the issue to the steering committee for a decision.
   • CProceed to testing and track the high-severity vulnerabilities as known issues.
   • DHalt the project until the high-severity vulnerabilities are resolved.
   Check answers Discussion Select an answer first
6. 25foundation · easy

   What is the first step in responding to a failed control gate?

   • AImmediately release the product to production to avoid delays
   • BIgnore the failure and continue to the next phase
   • CDevelop a remediation plan to address the identified security gaps
   • DTerminate the project permanently
   Reveal Solution Discussion Select an answer first