Release Software Securely CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team wants to ensure that security scanning is performed consistently on every build. The team is concerned that developers might skip scans if they are run manually. Which approach ensures consistency?

   • AIntegrate the security scans as mandatory steps in the CI/CD pipeline that cannot be bypassed.
   • BCreate a checklist that developers must complete before each release.
   • CRun security scans only when a developer requests them.
   • DSchedule security scans to run once a month on the main branch.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which method is commonly used to verify the authenticity and integrity of a build artifact?

   • ACode signing with a digital signature
   • BComparing file sizes with the original build
   • CChecking the file creation timestamp
   • DUsing a checksum like CRC32
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A team wants to add security scanning to its CI/CD pipeline. The application is a REST API that requires authentication and has complex business logic. The team wants to identify vulnerabilities that only appear when the application is running. Which tool should be added to the pipeline?

   • AA dynamic application security testing (DAST) tool that runs against a deployed test environment.
   • BA container image scanner that checks the base image for known vulnerabilities.
   • CA software composition analysis (SCA) tool that scans the dependency manifest for known vulnerabilities.
   • DA static application security testing (SAST) tool that runs on the source code during the build stage.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can a cryptographic hash be used to verify that a build artifact has not been tampered with during deployment?

   • ABy checking the hash against a list of known malware signatures
   • BBy encrypting the artifact with the hash to prevent unauthorized access
   • CBy comparing the hash of the deployed artifact with the hash recorded at build time
   • DBy using the hash to compress the artifact for faster deployment
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key benefit of integrating security tools directly into the CI/CD pipeline as automated steps?

   • ASecurity issues are detected early and consistently, reducing the cost and effort of remediation
   • BIt allows security teams to manually review every code change before it is committed
   • CIt eliminates the need for any security testing after deployment
   • DIt guarantees that no vulnerabilities will ever reach production
   Reveal Solution Discussion Select an answer first