A software vendor distributes updates over the internet. Users have reported that some downloads are corrupted. The vendor wants to ensure that users can detect any corruption and also verify that the update came from the vendor. The vendor also wants to minimize the impact of a compromised download server. Which approach best addresses these concerns?

Digitally sign the updates and publish the public key in multiple trusted locations

Encrypt the updates with a symmetric key and share the key via email

Host the updates on a high-availability CDN

Use a checksum such as MD5 published on the same server

A system administrator needs to ensure that a user who has left the company no longer has access to any corporate resources. Which process is most directly responsible for this?

Encrypting all data the user had access to

Changing the user's password to a temporary one

Revoking the user's access rights and disabling their account

Reviewing audit logs for the user's past actions

A multinational company processes credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which practice is directly required by this standard?

Encrypt cardholder data transmitted over open networks

Conduct annual penetration tests only if a breach occurs

Implement biometric authentication for all employees

Use blockchain for all transaction records

Certified Secure Software Lifecycle Professional

Domain 1Objective 1

Understand Core Concepts CSSLP Practice Questions (Page 1)

Part of the Secure Software Concepts domain, which accounts for 12% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

12%of the exam

Questions 1–5

1expert · hard
A software vendor distributes updates over the internet. Users have reported that some downloads are corrupted. The vendor wants to ensure that users can detect any corruption and also verify that the update came from the vendor. The vendor also wants to minimize the impact of a compromised download server. Which approach best addresses these concerns?
Select an answer first
2foundation · easy
Which security goal is primarily achieved by encrypting data so that only authorized parties can read it?
Select an answer first
3application · medium
A system administrator needs to ensure that a user who has left the company no longer has access to any corporate resources. Which process is most directly responsible for this?
Select an answer first
4foundation · easy
Which type of requirement is typically imposed by laws such as GDPR or HIPAA?
Select an answer first
5application · medium
A multinational company processes credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which practice is directly required by this standard?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Understand Core Concepts CSSLP Practice Questions (Page 1)

Questions 1–5

Which security goal is primarily achieved by encrypting data so that only authorized parties can read it?

A system administrator needs to ensure that a user who has left the company no longer has access to any corporate resources. Which process is most directly responsible for this?

Which type of requirement is typically imposed by laws such as GDPR or HIPAA?

A multinational company processes credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). Which practice is directly required by this standard?

Keep studying — Secure Software Concepts