Secure Configuration and Version Control CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A development team is using version control for their application code. They need to ensure that the version control system itself is secure and that the integrity of the code is maintained. Which set of practices is most effective?

   • AAllow all developers to have write access to the repository and trust them to follow best practices.
   • BEnforce multi-factor authentication for repository access, require signed commits, and regularly audit the repository for unauthorized changes.
   • CUse a public repository to benefit from community review of the code.
   • DUse a private repository and rely on the hosting provider's security measures.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a critical application on a legacy operating system that is no longer supported by the vendor. A critical security patch has been released for a third-party library used by the application. The patch is known to cause compatibility issues with the legacy OS. The security team must apply the patch without disrupting operations. What is the most appropriate first step?

   • AImmediately upgrade the operating system to a supported version before applying the patch.
   • BApply the patch directly to production servers during off-peak hours to minimize user impact.
   • CTest the patch in a staging environment that mirrors the production setup, including the legacy OS and application.
   • DSkip the patch because the OS is unsupported and the patch may cause more harm than good.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which activity is a key part of maintaining a baseline configuration process?

   • ARegularly reviewing and updating the baseline as needed
   • BDisabling all unnecessary services
   • CConducting penetration tests
   • DInstalling the latest hardware
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A development team is using Git for version control. They want to ensure that the main branch always contains only tested and approved code. Which branching strategy best supports this requirement?

   • AUse a single branch for all development and tag releases after testing.
   • BCreate a separate branch for each developer and merge all branches into main at the end of the day.
   • CUse feature branches for development and require pull requests with code review before merging into the main branch.
   • DAllow developers to commit directly to the main branch and rely on automated tests to catch issues.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services firm is deploying a new line of Linux web servers. The security team has defined a secure baseline configuration that includes specific kernel parameters, file permissions, and installed packages. The operations team needs to ensure that any server provisioned from this baseline remains consistent and that any drift from the baseline is detected and corrected. Which approach best meets this requirement?

   • ADocument the baseline in a wiki and require administrators to review it before making changes.
   • BManually configure each server using a documented checklist and perform spot checks quarterly.
   • CUse a configuration management tool (e.g., Ansible, Chef, Puppet) to enforce the baseline on all servers and run periodic compliance checks.
   • DCreate a golden image and deploy it, but do not monitor for changes after deployment.
   Reveal Solution Discussion Select an answer first