CSSLP Exam Questions

Certification and Accreditation (C&A or CnA) is a process for implementing information security. Which of the following is the correct order of C&A phases in a DITSCAP assessment?

Which of the following is NOT a responsibility of a data owner?

ISO 27003 is an information security standard published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Which o...

John works as a security manager for SoftTech Inc. He is working with his team on the disaster recovery management plan. One of his team members has a doubt related to the most cos...

Which of the following statements describe the main purposes of a Regulatory policy? Each correct answer represents a complete solution. Choose all that apply.

Audit trail or audit log is a chronological sequence of audit records, each of which contains evidence directly pertaining to and resulting from the execution of a business process...

Which of the following is generally used in packages in order to determine the package or product tampering?

In which of the following testing methods is the test engineer equipped with the knowledge of system and designs test cases or test data based on system knowledge?

Which of the following configuration management system processes keeps track of the changes so that the latest acceptable configuration specifications are readily available?

Which of the following approaches can be used to build a security program? Each correct answer represents a complete solution. Choose all that apply.

Which of the following plans is a comprehensive statement of consistent actions to be taken before, during, and after a disruptive event that causes a significant loss of informati...

Which of the following can be used to accomplish authentication? Each correct answer represents a complete solution. Choose all that apply.

In which type of access control do user ID and password system come under?

Which of the following is an attack with IP fragments that cannot be reassembled?

Which of the following are examples of passive attacks? Each correct answer represents a complete solution. Choose all that apply.

According to the NIST SAMATE, dynamic analysis tools operate by generating runtime vulnerability scenario using some functions. Which of the following are functions that are used b...

Which of the following is a formula, practice, process, design, instrument, pattern, or compilation of information which is not generally known, but by which a business can obtain...

A service provider guarantees for end-to-end network traffic performance to a customer. Which of the following types of agreement is this?

Which of the following components of configuration management involves periodic checks to determine the consistency and completeness of accounting information and to verify that al...

The NIST ITL Cloud Research Team defines some primary and secondary technologies as the fundamental elements of cloud computing in its "Effectively and Securely Using the Cloud Com...

Which of the following disaster recovery tests includes the operations that shut down at the primary site, and are shifted to the recovery site according to the disaster recovery p...

In which of the following deployment models of cloud is the cloud infrastructure administered by the organizations or a third party? Each correct answer represents a complete solut...

Which of the following statements about a host-based intrusion prevention system (HIPS) are true? Each correct answer represents a complete solution. Choose two.

Who amongst the following makes the final accreditation decision?

You are the project manager of the GHY project for your organization. You are about to start the qualitative risk analysis process for the project and you need to determine the rol...

You work as a project manager for BlueWell Inc. You are preparing to plan risk responses for your project with your team. How many risk response types are available for a negative...

You work as an analyst for Tech Perfect Inc. You want to prevent information flow that may cause a conflict of interest in your organization representing competing clients. Which o...

Which of the following are the phases of the Certification and Accreditation (C&A) process? Each correct answer represents a complete solution. Choose two.

Which of the following elements of the BCP process emphasizes on creating the scope and the additional elements required to define the parameters of the plan?

Which of the following DoD directives defines DITSCAP as the standard C&A process for the Department of Defense?

Which of the following are the responsibilities of a custodian with regard to data in an information classification program? Each correct answer represents a complete solution. Cho...

Which of the following terms refers to the protection of data against unauthorized access?

Copyright holders, content providers, and manufacturers use digital rights management (DRM) in order to limit usage of digital media and devices. Which of the following security ch...

Which of the following describes the acceptable amount of data loss measured in time?

When preparing misuse and abuse cases for a software product what activities are generally performed to anticipate how it might be exploited?

A development team at Meridian Systems is defining their security testing strategy and plan, and they need guidance on best practices and timing. Which statement is accurate?

Which categories of problems are suitable for static code analysis to detect in a software repository?

A mid sized software company is creating a group to handle production incidents and they want the team to be most effective. What team composition usually produces the best outcome...

A digital health startup named NovaLine is designing a new platform and wants to manage security risks through every phase of the software development lifecycle. Which practice sho...

Which of the following is not considered a form of distributed processing?

A regional insurance provider requires a written "need to acquire" declaration before approving any software purchase. What specific elements does that declaration list? (Choose 3)

An information security analyst at Aurora Systems is reviewing a confidentiality model where users cannot read information above their clearance and they cannot write information t...

Which of the following items would not normally be classified as a security test case?

What technique should a web application use to confirm that values sent by clients conform to the expected data types and formats?

When drafting a service level agreement what key element should be included so the provider and the customer can objectively determine whether commitments were met and take action...

Which scenario best illustrates auditing as a method of accountability within a technology company?

A regional fintech company needs security controls that staff will actually use. Which security design principle emphasizes making protections easy to use and acceptable to people?

A regional insurer is evaluating methods for assessing threats across its cloud environment. What is qualitative risk assessment primarily used for?

Why are system requirements regarded as primary project artifacts when beginning software work?

A payment technology company called Northbridge Systems deploys updates to its customer portal and the security team must run tests. What is the primary goal of regression testing...