An organization is moving to a DevOps model and wants to automate the deployment of applications. They need to ensure that security configurations are applied consistently and that any changes are reviewed before they are deployed. Which approach should they use?

Use a configuration management tool to apply settings after deployment, without a review process.

Use a script to deploy the application and configure security settings automatically.

Manually configure each environment and document the changes.

Implement infrastructure as code (IaC) with security baselines embedded, and use a pull request review process for changes.

A microservices application needs to authenticate to a database. The security team wants to avoid hardcoding credentials in the application code and ensure that each service only has access to the specific database it needs. What is the best approach?

Use a single service account for all microservices to simplify management.

Embed the credentials in each service's Docker image.

Store the database credentials in a shared environment variable that all services can access.

Use a secrets management service to provide credentials dynamically, with per-service access policies.

A company uses a public key infrastructure (PKI) to issue certificates to employees. They want to ensure that certificates are only issued to authorized employees and that the process is auditable. What should they implement?

Integrate the PKI with the identity management system and require multi-factor authentication for certificate enrollment.

Use a shared certificate for all employees to simplify management.

Issue certificates based on a manager's verbal approval.

Allow any employee to request a certificate without additional verification.

A team is developing a mobile app that needs to authenticate users. They want to avoid storing passwords in the app and instead use a secure authentication mechanism. Which approach should they use?

Use an OAuth 2.0 / OpenID Connect flow with a trusted identity provider.

Store the user's password in the app's local storage for offline access.

Use a simple API key to authenticate all users.

Implement a custom authentication protocol from scratch.

An application needs to store sensitive data in a database. The security team wants to encrypt the data at rest and ensure that the encryption keys are managed securely. They also want to minimize the impact of a key compromise. What should they do?

Use the database's built-in encryption without managing the keys externally.

Use envelope encryption with a master key stored in a key management service and data encryption keys that can be rotated independently.

Use a single encryption key for all data and store it in the application configuration.

Encrypt the data with a key derived from a password that is known to the development team.

Certified Secure Software Lifecycle Professional

Domain 7Objective 4

Store and Manage Security Data CSSLP Practice Questions (Page 1)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

11%of the exam

Questions 1–5

1expert · medium
An organization is moving to a DevOps model and wants to automate the deployment of applications. They need to ensure that security configurations are applied consistently and that any changes are reviewed before they are deployed. Which approach should they use?
Select an answer first
2application · medium
A microservices application needs to authenticate to a database. The security team wants to avoid hardcoding credentials in the application code and ensure that each service only has access to the specific database it needs. What is the best approach?
Select an answer first
3expert · medium
A company uses a public key infrastructure (PKI) to issue certificates to employees. They want to ensure that certificates are only issued to authorized employees and that the process is auditable. What should they implement?
Select an answer first
4application · medium
A team is developing a mobile app that needs to authenticate users. They want to avoid storing passwords in the app and instead use a secure authentication mechanism. Which approach should they use?
Select an answer first
5expert · medium
An application needs to store sensitive data in a database. The security team wants to encrypt the data at rest and ensure that the encryption keys are managed securely. They also want to minimize the impact of a key compromise. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.