CSSLP Practice Questions: Secure Software Concepts Domain

Correct Answer: C

Explanation: The first step in integrating security into a CI/CD pipeline is to establish security requirements and policies. This provides a foundation for consistent security practices and ensures that all subsequent actions, such as implementing tools or conducting training, align with organizational security goals. Option A, implementing static code analysis, is a technical control that should follow the establishment of policies. Option B, security training, is important but not the first step in pipeline integration. Option D, deploying RASP, is a protective measure that comes later in the process.

Correct Answer: A

Explanation: Implementing automated security testing tools in the CI/CD pipeline ensures that security checks are consistently applied to every build and deployment, integrating security into the DevSecOps workflow. Option B, while beneficial, does not directly integrate security into the pipeline. Option C is not prioritized as it does not embed security into the pipeline itself. Option D, while useful, can be resource-intensive and may not scale as effectively as automated tools.

Correct Answer: A

Explanation: Integrating automated security testing into the CI/CD pipeline ensures continuous security assessment and rapid feedback, which is crucial in a DevSecOps environment. This approach helps identify vulnerabilities early in both legacy and new systems, ensuring a consistent security posture.

Correct Answer: B

Explanation: Mapping regulatory requirements to software security controls ensures that the application is designed to meet compliance obligations from the outset. This proactive approach helps in identifying necessary controls and integrating them early in the development process.

Correct Answer: B

Explanation: After identifying potential security risks, the next step in the secure SDLC methodology is to prioritize these risks based on their impact and likelihood. This allows the team to focus on addressing the most critical risks first. Option A skips the prioritization step. Option C is incorrect as it does not address the risks. Option D delays necessary risk management actions.