Why is it important to automate security tools within a CI/CD pipeline?

To ensure security checks are performed consistently and repeatably on every build

To replace the need for manual security reviews entirely

To ensure that security tools are only run when a developer remembers to trigger them

To speed up the pipeline by skipping security checks when time is short

A software company wants to prevent attackers from distributing a malicious version of its application. Which control should the company implement?

Use a strong password to protect the application installer.

Use a custom file extension for the application installer.

Publish the application's source code to prove its authenticity.

Sign the application with a code-signing certificate and encourage users to verify the signature.

A team is building a CI/CD pipeline for a web application that uses many third-party libraries. The team wants to detect known vulnerabilities in those libraries, but also wants to avoid false positives that could block releases. Which approach is most effective?

Fail the build on any SCA finding, regardless of severity or false positive potential.

Use a DAST tool instead of SCA to identify vulnerabilities in the libraries.

Run the SCA tool only once a month and manually review the results.

Integrate an SCA tool that allows the team to suppress false positives and provides a mechanism to track and review suppressions.

Which security tool is specifically designed to identify known vulnerabilities in third-party libraries and dependencies?

A static application security testing (SAST) tool

An interactive application security testing (IAST) tool

A dynamic application security testing (DAST) tool

What is the purpose of verifying the integrity of a build artifact using a cryptographic hash?

To encrypt the artifact so that only authorized users can access it

To verify the identity of the developer who wrote the code

To compress the artifact to reduce storage space

To ensure the artifact has not been altered or corrupted since it was built

Certified Secure Software Lifecycle Professional

Domain 7Objective 3

Release Software Securely CSSLP Practice Questions (Page 4)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

11%of the exam

Questions 16–20

16foundation · easy
Why is it important to automate security tools within a CI/CD pipeline?
Select an answer first
17application · medium
A software company wants to prevent attackers from distributing a malicious version of its application. Which control should the company implement?
Select an answer first
18expert · hard
A team is building a CI/CD pipeline for a web application that uses many third-party libraries. The team wants to detect known vulnerabilities in those libraries, but also wants to avoid false positives that could block releases. Which approach is most effective?
Select an answer first
19foundation · easy
Which security tool is specifically designed to identify known vulnerabilities in third-party libraries and dependencies?
Select an answer first
20foundation · easy
What is the purpose of verifying the integrity of a build artifact using a cryptographic hash?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.