A legal team needs to prove that a contract was signed by a specific executive and that the contract content has not been altered since signing. Which technology should be used to provide both nonrepudiation and integrity?

A digital signature using the executive's private key

A timestamp from a trusted third party

Symmetric encryption of the contract

A cryptographic hash of the contract stored in a public database

A security auditor wants to verify that every administrative action in a system can be traced to a specific administrator. What is the most important requirement for the audit logs?

Logs must include the unique user ID of the administrator

Logs must be stored in a centralized location

Logs must be retained for at least one year

A healthcare organization is subject to HIPAA and must protect patient data. They are considering using a public cloud provider for storage. The compliance officer is concerned about data residency and auditability. Which approach best addresses these concerns?

Use a private cloud with dedicated physical servers

Avoid the public cloud entirely and keep all data on-premises

Encrypt all data and store the encryption keys on-premises

Use a cloud region within the required country and enable detailed audit logging

Certified Secure Software Lifecycle Professional

Domain 1Objective 1

Understand Core Concepts CSSLP Practice Questions (Page 3)

Part of the Secure Software Concepts domain, which accounts for 12% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

12%of the exam

Questions 11–15

11foundation · easy
Which of the following is an example of an industry standard that organizations may voluntarily adopt to demonstrate security maturity?
Select an answer first
12application · medium
A legal team needs to prove that a contract was signed by a specific executive and that the contract content has not been altered since signing. Which technology should be used to provide both nonrepudiation and integrity?
Select an answer first
13application · medium
A security auditor wants to verify that every administrative action in a system can be traced to a specific administrator. What is the most important requirement for the audit logs?
Select an answer first
14foundation · easy
Which process verifies the identity of a user attempting to access a system?
Select an answer first
15expert · hard
A healthcare organization is subject to HIPAA and must protect patient data. They are considering using a public cloud provider for storage. The compliance officer is concerned about data residency and auditability. Which approach best addresses these concerns?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Understand Core Concepts CSSLP Practice Questions (Page 3)

Questions 11–15

Which of the following is an example of an industry standard that organizations may voluntarily adopt to demonstrate security maturity?

A legal team needs to prove that a contract was signed by a specific executive and that the contract content has not been altered since signing. Which technology should be used to provide both nonrepudiation and integrity?

A security auditor wants to verify that every administrative action in a system can be traced to a specific administrator. What is the most important requirement for the audit logs?

Which process verifies the identity of a user attempting to access a system?

A healthcare organization is subject to HIPAA and must protect patient data. They are considering using a public cloud provider for storage. The compliance officer is concerned about data residency and auditability. Which approach best addresses these concerns?

Keep studying — Secure Software Concepts