Release Software Securely CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company is transitioning from a traditional release process to a DevSecOps model. The security team currently performs a manual penetration test just before each production release. Which change best reflects DevSecOps principles?

   • AReplace the manual penetration test with an automated DAST scan that runs only in production after each release.
   • BShift security testing earlier in the pipeline by automating SAST, DAST, and dependency scanning, while keeping a final manual pen test as a checkpoint.
   • CAsk developers to run a SAST tool locally and report results in a spreadsheet before each release.
   • DKeep the manual penetration test as the only security control to avoid introducing new tools that could slow down releases.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A team is building a CI/CD pipeline for a Java application. They want to detect vulnerabilities in the open-source libraries they use. Which tool should be integrated into the pipeline?

   • AA web application firewall (WAF) that filters incoming traffic.
   • BA static code analyzer that checks for SQL injection in the source code.
   • CA runtime application self-protection (RASP) tool that monitors the application in production.
   • DA dependency scanner that checks the library versions against the National Vulnerability Database (NVD).
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a secure CI/CD pipeline, what is the primary purpose of an approval gate?

   • ATo enforce a manual or automated checkpoint that must be satisfied before the pipeline proceeds to the next stage
   • BTo replace the need for security testing by relying on peer review
   • CTo log all pipeline activities for audit purposes only
   • DTo automatically deploy code to production without human intervention
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of code signing?

   • ATo encrypt the software so that only authorized users can run it
   • BTo establish the origin of the software and ensure it has not been tampered with
   • CTo prevent users from copying the software
   • DTo compress the software to reduce download size
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security team wants to ensure that every code change is scanned for security issues before it is merged. The team uses a Git-based version control system. Which approach best automates this control?

   • ARun a DAST scan against the production environment after every release and roll back if issues are found.
   • BRun a SAST scan manually on the main branch once a week and report the results to the team.
   • CConfigure a webhook that triggers a SAST scan on each pull request and blocks the merge if the scan fails.
   • DRequire developers to run a SAST scan on their local machines and paste the results into the pull request description.
   Reveal Solution Discussion Select an answer first