CSSLP Exam Questions

Which of the following terms ensures that no intentional or unintentional unauthorized modification is made to data?

Which of the following provides an easy way to programmers for writing lower-risk applications and retrofitting security into an existing application?

Which of the following testing methods tests the system efficiency by systematically selecting the suitable and minimum set of tests that are required to effectively cover the affe...

Which of the following specifies access privileges to a collection of resources by using the URL mapping?

You are the project manager of QSL project for your organization. You are working with your project team and several key stakeholders to create a diagram that shows how various ele...

Which of the following security models characterizes the rights of each subject with respect to every object in the computer system?

Penetration testing (also called pen testing) is the practice of testing a computer system, network, or Web application to find vulnerabilities that an attacker could exploit. Whic...

Which of the following types of activities can be audited for security? Each correct answer represents a complete solution. Choose three.

Which of the following federal agencies has the objective to develop and promote measurement, standards, and technology to enhance productivity, facilitate trade, and improve the q...

Which of the following SDLC phases consists of the given security controls: Misuse Case Modeling Security Design and Architecture Review Threat and Risk Modeling Security Requireme...

Which of the following are the initial steps required to perform a risk analysis process? Each correct answer represents a part of the solution. Choose three.

Which of the following technologies is used by hardware manufacturers, publishers, copyright holders and individuals to impose limitations on the usage of digital content and devic...

Which of the following processes provides a standard set of activities, general tasks, and a management structure to certify and accredit systems, which maintain the information as...

Which of the following security issues does the Bell-La Padula model focus on?

Which of the following phases of the DITSCAP C&A process is used to define the C&A level of effort, to identify the main C&A roles and responsibilities, and to create an agreement...

Which of the following types of obfuscation transformation increases the difficulty for a de- obfuscation tool so that it cannot extract the true application from the obfuscated ve...

Which of the following techniques is used when a system performs the penetration testing with the objective of accessing unauthorized information residing inside a computer?

Which of the following types of attacks is targeting a Web server with multiple compromised computers that are simultaneously sending hundreds of FIN packets with spoofed IP source...

Which of the following programming languages are compiled into machine code and directly executed by the CPU of a computer system? Each correct answer represents a complete solutio...

Which of the following is a standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system?

Which of the following elements of BCP process includes the areas of plan implementation, plan testing, and ongoing plan maintenance, and also involves defining and documenting the...

Which of the following refers to a process that is used for implementing information security?

The Web resource collection is a security constraint element summarized in the Java Servlet Specification v2.4. Which of the following elements does it include? Each correct answer...

Which of the following activities are performed by the 'Do' cycle component of PDCA (plan-do- check-act)? Each correct answer represents a complete solution. Choose all that apply.

Numerous information security standards promote good security practices and define frameworks or systems to structure the analysis and design for managing information security cont...

The Data and Analysis Center for Software (DACS) specifies three general principles for software assurance which work as a framework in order to categorize various secure design pr...

In which of the following phases of the DITSCAP process does Security Test and Evaluation (ST&E) occur?

Which of the following access control models uses a predefined set of access privileges for an object of a system?

Martha works as a Project Leader for BlueWell Inc. She and her team have developed accounting software. The software was performing well. Recently, the software has been modified....

Which of the following sections come under the ISO/IEC 27002 standard?

Which of the following statements about the authentication concept of information security management is true?

Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team...

You work as a security manager for BlueWell Inc. You are going through the NIST SP 800-37 C&A methodology, which is based on four well defined phases. In which of the following pha...

In which of the following DIACAP phases is residual risk analyzed?

Which of the following security controls will you use for the deployment phase of the SDLC to build secure software? Each correct answer represents a complete solution. Choose all...

Which of the following provides an easy way to programmers for writing lower-risk applications and retrofitting security into an existing application?

Which of the following is a malicious exploit of a website, whereby unauthorized commands are transmitted from a user trusted by the website?

An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability. Which of the followi...

You are the project manager for your organization. You are preparing for the quantitative risk analysis. Mark, a project team member, wants to know why you need to do quantitative...

You work as a security engineer for BlueWell Inc. According to you, which of the following DITSCAP/NIACAP model phases occurs at the initiation of the project, or at the initial C&...

Software Development Life Cycle (SDLC) is a logical process used by programmers to develop software. Which of the following SDLC phases meets the audit objectives defined below: Sy...

The build environment of secure coding consists of some tools that actively support secure specification, design, and implementation. Which of the following features do these tools...

Which of the following requires all general support systems and major applications to be fully certified and accredited before these systems and applications are put into productio...

What are the security advantages of virtualization, as described in the NIST Information Security and Privacy Advisory Board (ISPAB) paper "Perspectives on Cloud Computing and Stan...

Which of the following persons in an organization is responsible for rejecting or accepting the residual risk for a system?

DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December...

Which of the following are the goals of risk management? Each correct answer represents a complete solution. Choose three.

NIST SP 800-53A defines three types of interview depending on the level of assessment conducted. Which of the following NIST SP 800-53A interviews consists of informal and ad hoc i...

Which of the following are the principle duties performed by the BIOS during POST (power-on- self- test)? Each correct answer represents a part of the solution. Choose all that app...

In which of the following architecture styles does a device receive input from connectors and generate transformed outputs?