Release Software Securely CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   How does DevSecOps foster shared responsibility for security?

   • ABy ensuring developers, operations, and security teams collaborate and are accountable for security throughout the lifecycle
   • BBy assigning security tasks exclusively to a dedicated security team
   • CBy using automated security tools that eliminate the need for human collaboration
   • DBy requiring security reviews only after deployment to production
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does code signing establish the provenance of a software artifact?

   • ABy embedding a timestamp that records when the code was compiled
   • BBy using a digital signature that can be verified with the signer's public key, linking the artifact to the signer
   • CBy storing the artifact in a secure repository with access controls
   • DBy including the developer's name in the metadata of the artifact
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team wants to integrate multiple security tools into the CI/CD pipeline. The team is concerned about the maintenance overhead of managing each tool separately. Which approach reduces this overhead?

   • AUse a single tool that claims to perform all security checks.
   • BRun each security tool as a separate, standalone job in the pipeline.
   • COutsource all security testing to a third-party vendor.
   • DUse a centralized security orchestration platform that integrates with the pipeline and manages the tools.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company is adopting DevSecOps, but the security team is concerned about losing control over security decisions. The development team wants to merge code quickly. Which approach best addresses both concerns?

   • AHave the security team write all security-related code themselves.
   • BAllow developers to merge code without any security checks and rely on post-release audits.
   • CLet the security team approve every pull request manually.
   • DDefine security policies and automated gates that both teams agree on, and allow developers to self-serve within those boundaries.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A team is designing a CI/CD pipeline for a critical financial application. The pipeline must include security checks, but the team is concerned about pipeline speed and developer productivity. They want to run security scans without blocking every build. Which approach best balances security and speed?

   • ARun all security scans only on the release branch before deployment.
   • BRun security scans only when a developer manually triggers them.
   • CRun all security scans on every commit and fail the build on any finding.
   • DRun fast security scans (SAST, SCA) on every commit and run slower, more comprehensive scans (DAST, pen test) on a nightly or release basis.
   Reveal Solution Discussion Select an answer first