A software vendor distributes a critical security patch as a downloadable file. Users need to verify that the file was not tampered with and that it genuinely came from the vendor. Which mechanism should the vendor use to provide both integrity and nonrepudiation?

Encrypt the file with the vendor's public key

Compress the file into a ZIP archive with a password

Sign the file with the vendor's private key and publish the public key

Publish a SHA-256 hash of the file on the vendor's website

A government agency must publish official documents online. Citizens need to verify that a document was issued by the agency and has not been altered. The agency also wants to ensure that the document's content is publicly readable. Which solution best meets all requirements?

Digitally sign the document with the agency's private key and publish the public key

Publish a hash of the document on a public blockchain

Use a symmetric key to encrypt the document and share the key with all citizens

Encrypt the document with the agency's public key

Certified Secure Software Lifecycle Professional

Domain 1Objective 1

Understand Core Concepts CSSLP Practice Questions (Page 5)

Part of the Secure Software Concepts domain, which accounts for 12% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~8–14 in this domain), expect 4–7 from this objective — we provide 27 practice questions to prepare you well beyond it. (estimate)

27questions here

6free pages

8concepts

12%of the exam

Questions 21–25

21application · medium
A software vendor distributes a critical security patch as a downloadable file. Users need to verify that the file was not tampered with and that it genuinely came from the vendor. Which mechanism should the vendor use to provide both integrity and nonrepudiation?
Select an answer first
22expert · hard
A government agency must publish official documents online. Citizens need to verify that a document was issued by the agency and has not been altered. The agency also wants to ensure that the document's content is publicly readable. Which solution best meets all requirements?
Select an answer first
23foundation · easy
After a user is authenticated, which security process determines what resources they can access and what actions they can perform?
Select an answer first
24foundation · easy
Which security goal is directly supported by implementing redundant power supplies and failover clusters?
Select an answer first
25foundation · easy
Which security mechanism provides both data integrity and proof of the sender's identity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.

Understand Core Concepts CSSLP Practice Questions (Page 5)

Questions 21–25

A software vendor distributes a critical security patch as a downloadable file. Users need to verify that the file was not tampered with and that it genuinely came from the vendor. Which mechanism should the vendor use to provide both integrity and nonrepudiation?

A government agency must publish official documents online. Citizens need to verify that a document was issued by the agency and has not been altered. The agency also wants to ensure that the document's content is publicly readable. Which solution best meets all requirements?

After a user is authenticated, which security process determines what resources they can access and what actions they can perform?

Which security goal is directly supported by implementing redundant power supplies and failover clusters?

Which security mechanism provides both data integrity and proof of the sender's identity?

Keep studying — Secure Software Concepts