CSSLP Practice Questions: Secure Software Lifecycle Management Domain

Correct Answer: A

Explanation: Implementing input validation controls (A) is a direct and strategic action to mitigate the risk of injection attacks by ensuring that all user inputs are properly validated. Conducting a penetration test (B) is useful for identifying vulnerabilities but does not directly address the current issue. Training developers (C) is important for long-term security culture but does not immediately fix the vulnerability. Deploying a WAF (D) can help mitigate attacks but is not as effective as fixing the root cause by implementing input validation.

Correct Answer: B

Explanation: Implementing continuous monitoring and auditing of security controls is the best approach to maintain compliance during the maintenance phase. This ensures that any deviations from security standards and regulations are promptly identified and addressed. Regular penetration tests and annual security reviews can supplement this process but are not as comprehensive or timely. Relying solely on user feedback is insufficient for maintaining compliance.

Correct Answer: B

Explanation: Including security acceptance criteria in user stories during the sprint planning phase ensures that security is considered and integrated into each feature from the start. This proactive approach aligns with agile practices by embedding security into the development process. Retrospectives and audits are important but occur after implementation, and scheduling a penetration test at the end does not incorporate security early in the development cycle.

Correct Answer: B

Explanation: Integrating security scanning tools into the CI/CD pipeline (B) ensures that security vulnerabilities are detected and addressed continuously as part of the development process. Annual penetration testing (A) and quarterly audits (D) do not provide continuous monitoring. Manual code reviews (C) can be part of the process but may not be feasible for every release in a CI/CD environment.

Correct Answer: A

Explanation: Implementing a software bill of materials (SBOM) is the first step in ensuring the integrity and provenance of third-party components. An SBOM provides a comprehensive inventory of components, which is essential for tracking usage and assessing risks. Conducting vulnerability scans (B) and performing risk assessments (D) are important subsequent steps but require knowledge of the components in use. Establishing a policy (C) is also important but follows the identification of components through an SBOM.