CSSLP Exam Questions

What is the primary purpose of performing security reviews during the software development lifecycle?

Which of the following can be used for non-repudiation purposes?

The fundamental benefit of a sandboxed environments is about:

Secure configuration management (CM) is most useful for what?

Which data protection approach changes or conceals sensitive values to keep them confidential when they are used in development and testing?

For a cloud application deployed by Meridian Financial who is typically regarded as the owner of the application data?

Which compliance framework is specifically intended for companies that handle credit and debit card transactions to ensure the security of cardholder systems and data?

What is the primary objective of secure software supply chain practices for a development team that wants to avoid using compromised components?

Which security design principle favors simple implementations and minimal components and therefore supports using single sign on systems and credential managers?

Why do large organizations put in place companywide secure coding guidelines for developers?

Which term can be best defined by the following description? A security testing method that is also known as structure-based testing. It involves the direct analysis of the source...

Which of the following are used in the development of abuse cases?

Which of the following is the most important task when performing a design security review?

The software maintenance and support work starts once the delivery of the software product is done. Which of the following is not considered a category of application maintenance a...

LogiCore is configuring a federated identity setup where a web application accepts assertions from an external identity provider. What fundamental element must that relationship re...

Which software security requirement focuses on assigning sensitivity levels and evaluating potential consequences for stored information?

Which legal doctrine normally establishes ownership rights for creative digital works such as software and other intangible online assets?

Which form of security testing is most appropriate to measure an application's scalability reliability and performance under operational load?

Which software development approach prioritizes accepting evolving requirements and gathering frequent stakeholder feedback throughout the project lifecycle?

Which processor security feature provides hardware based encryption of system memory to protect sensitive information from physical memory extraction?

Which of the following statements is NOT true?

Which type of controls is intended to limit the extent of any damage caused by an incident?

Which of the following CANNOT be impacted directly by security monitoring?

A payments startup measures defects per thousand lines of code across its repositories to monitor code quality. Which category of software assessment does that metric represent?

Which statement accurately describes system non-functional requirements and their role in software behavior?

When a company enforces formal authorization for a proposed modification what formal and detailed document must be created to specify the exact tasks and deliverables required to c...

Which techniques are commonly used to perform code analysis during software development and testing? (Choose 2)

What aspect of a system does a data flow diagram most clearly represent?

Within software development what type of testing is commonly meant by the phrase code review?