Outline Strategy and Roadmap CSSLP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of a measurable checkpoint criterion?

   • ASecurity issues should be addressed as soon as possible
   • BAt least 90% of high-severity vulnerabilities identified during testing must be remediated
   • CThe application should be reasonably secure
   • DThe team should improve its security posture
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A security manager is defining the checkpoint criteria for the code review phase of a project. Which criterion is the most measurable and actionable for evaluating whether the code is ready to proceed to integration testing?

   • ANo security issues were found during the code review.
   • BThe code review team believes the code is secure enough to proceed.
   • CThe code has been reviewed by at least two developers.
   • DAll critical and high-severity vulnerabilities identified during the code review have been remediated and verified.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security architect is developing a security roadmap for a large, multi-phase project. The project has a tight deadline, and the architect must balance the need for thorough security reviews with the schedule. Which approach best sequences milestones and checkpoints to manage this trade-off?

   • APlace security milestones at the end of each phase, with checkpoints that have clear criteria and a defined process for handling failures.
   • BPlace security milestones only at the end of the project to avoid interfering with the development schedule.
   • CPlace all security milestones early in the project to ensure security is addressed before development begins.
   • DPlace security milestones only when the project manager deems them necessary.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security checkpoint is scheduled for the end of the coding phase. The break criteria state that the project will be halted if there are any unresolved critical vulnerabilities in the code. During the checkpoint, the team finds two critical vulnerabilities that have been fixed but not yet verified. What should happen according to the break criteria?

   • AThe project is halted until the fixes are verified and the vulnerabilities are confirmed resolved.
   • BThe project is redirected to a different phase to address the vulnerabilities.
   • CThe project proceeds with a risk acceptance signed by the project manager.
   • DThe project proceeds because the vulnerabilities have been fixed.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   At a security checkpoint, the review team must evaluate whether the security requirements have been met. The project manager wants to use a subjective assessment from the lead developer. Which approach would make the checkpoint evaluation more objective?

   • AAsk the lead developer to provide a written summary of the security status.
   • BHave the security team conduct an informal discussion with the developers.
   • CUse a checklist of predefined security requirements with pass/fail criteria.
   • DRely on the project manager's judgment based on their experience.
   Reveal Solution Discussion Select an answer first