A security incident has occurred, and the organization needs to revoke a compromised certificate immediately. However, they also need to ensure that clients do not accept the revoked certificate. What should they do?

Generate a new certificate and deploy it, but do not revoke the old one.

Add the certificate to the certificate revocation list (CRL) and ensure clients check the CRL.

Delete the certificate from the server and assume clients will no longer trust it.

Wait for the certificate to expire naturally.

An organization deploys a new web server and wants to ensure it is configured securely from the start. They have a security baseline document, but they need to enforce it consistently across multiple servers and detect any unauthorized changes. Which practice should they implement?

Use a configuration management tool to apply the baseline and monitor for drift.

Enable firewall rules and rely on the network to protect the server.

Manually configure each server according to the baseline and review logs monthly.

Create a golden image and use it for all new servers, but do not update it.

A developer needs to access production database credentials to troubleshoot an issue. The security policy requires that access be temporary, auditable, and limited to the minimum necessary. What should the security team implement?

Provide the developer with a one-time token from the secrets management system that expires after a short period.

Add the developer to the production database admin group permanently.

Share the credentials via a secure chat message.

Give the developer the production credentials and ask them to change them after troubleshooting.

In the lifecycle of a cryptographic certificate, what is the purpose of revocation?

To generate a new key pair for the certificate

To distribute the certificate to additional systems

To invalidate a certificate before its expiration due to compromise or change in status

To extend the validity period of a certificate before it expires

A company's web application uses a certificate that is about to expire. The operations team wants to automate the renewal process without manual intervention, but they also need to ensure that the new certificate is properly validated before it is deployed. Which solution should they implement?

Manually renew the certificate and update the server configuration during a maintenance window.

Set the certificate to renew automatically and deploy immediately without any checks.

Use a certificate management tool that automatically renews and deploys certificates, with a pre-deployment validation step.

Generate a self-signed certificate to replace the expiring one.

Certified Secure Software Lifecycle Professional

Domain 7Objective 4

Store and Manage Security Data CSSLP Practice Questions (Page 4)

Part of the Secure Software Deployment, Operations, Maintenance domain, which accounts for 11% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–13 in this domain), expect 1–1 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

11%of the exam

Questions 16–20

16application · medium
A security incident has occurred, and the organization needs to revoke a compromised certificate immediately. However, they also need to ensure that clients do not accept the revoked certificate. What should they do?
Select an answer first
17application · medium
An organization deploys a new web server and wants to ensure it is configured securely from the start. They have a security baseline document, but they need to enforce it consistently across multiple servers and detect any unauthorized changes. Which practice should they implement?
Select an answer first
18application · medium
A developer needs to access production database credentials to troubleshoot an issue. The security policy requires that access be temporary, auditable, and limited to the minimum necessary. What should the security team implement?
Select an answer first
19foundation · easy
In the lifecycle of a cryptographic certificate, what is the purpose of revocation?
Select an answer first
20application · medium
A company's web application uses a certificate that is about to expire. The operations team wants to automate the renewal process without manual intervention, but they also need to ensure that the new certificate is properly validated before it is deployed. Which solution should they implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.