CSSLP Practice Questions: Secure Software Architecture and Design Domain

Correct Answer: D

Explanation: Integrating security requirements into the initial design specifications ensures that security is considered from the start and throughout the development lifecycle. This aligns with the DevSecOps philosophy of 'shifting left' on security. Automating security testing (A) is important but follows after initial requirements are set. Security awareness training (B) and a champions program (C) are supportive but not the first step in embedding security into the CI/CD pipeline.

Correct Answer: B

Explanation: Implementing a Software Bill of Materials (SBOM) is the best action as it provides visibility into the components used, helping to track and manage vulnerabilities effectively. Regular updates (A) are important but not always feasible or sufficient alone. Restricting based on community size (C) does not guarantee security. Annual audits (D) are too infrequent to manage risks dynamically.

Correct Answer: A

Explanation: After completing the initial risk assessment, the next step is to prioritize identified risks based on their potential impact and likelihood. This prioritization helps in focusing resources on the most critical risks. Option B is part of the testing phase, Option C is an implementation step that follows risk prioritization, and Option D is part of the testing phase, not the immediate next step after risk assessment.

Correct Answer: B

Explanation: Performing a risk assessment allows the company to identify and prioritize critical vulnerabilities within the legacy systems, facilitating informed decision-making on how to address them. Replacing legacy systems (A) may not be feasible due to budget and operational constraints. Implementing a firewall (C) is a control measure that should follow the identification of specific risks. Security awareness training (D) is important but does not directly address architectural vulnerabilities.

Correct Answer: C

Explanation: Escaping user input when displaying it in the browser is a key design principle to mitigate the risk of cross-site scripting (XSS) attacks. This prevents malicious scripts from being executed in the user's browser. Option A is related to authorization, option B is insufficient as client-side validation can be bypassed, and option D is unrelated to XSS as it pertains to password storage.