CSSLP Free Exam Questions & Answers PDF Updated on Feb-2023 [Q18-Q32]

4.7/5 - (3 votes)

CSSLP Free Exam Questions and Answers PDF Updated on Feb-2023

Latest CSSLP Exam Dumps Recently Updated 349 Questions

Secure Software Lifecycle Management (11%):

Promote software development’s security culture.
Integrate IRM (Integrated Risk Management);
Explain and develop security documentation;
Establish the standards and frameworks for security;
Explain roadmap and strategy;

Secure Software Testing (14%):

Secure test data;
Track and classify security errors;
Carry out verification & validation testing.
Validate documentations;
Establish security test cases;

QUESTION 18
Which of the following attacks causes software to fail and prevents the intended users from accessing software?

Enabling attack

Reconnaissance attack

Sabotage attack

Disclosure attack

QUESTION 19
Which of the following describes a residual risk as the risk remaining after a risk mitigation has occurred?

DIACAP

SSAA

DAA

ISSO

DIACAP describes a residual risk as the risk remaining after a risk mitigation has occurred. The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States Department of Defense (DoD) for managing risk. DIACAP replaced the former process, known as DITSCAP (Department of Defense Information Technology Security Certification and Accreditation Process), in 2006. DoD Instruction (DoDI) 8510.01 establishes a standard DoD-wide process with a set of activities, general tasks, and a management structure to certify and accredit an Automated Information System (AIS) that will maintain the Information Assurance (IA) posture of the Defense Information Infrastructure (DII) throughout the system’s life cycle.DIACAP applies to the acquisition, operation, and sustainment of any DoD system that collects, stores, transmits, or processes unclassified or classified information since December 1997. It identifies four phases: 1.System Definition 2.Verification 3.Validation 4.Re-Accreditation Answer D is incorrect. An Information System Security Officer (ISSO) plays the role of a supporter. The responsibilities of an Information System Security Officer (ISSO) are as follows: Manages the security of the information system that is slated for Certification & Accreditation (C&A). Insures the information systems configuration with the agency’s information security policy. Supports the information system owner/information owner for the completion of security-related responsibilities. Takes part in the formal configuration management process. Prepares Certification & Accreditation (C&A) packages. Answer C is incorrect. The Designated Approving Authority (DAA), in the United States Department of Defense, is the official with the authority to formally assume responsibility for operating a system at an acceptable level of risk. The DAA is responsible for implementing system security. The DAA can grant the accreditation and can determine that the system’s risks are not at an acceptable level and the system is not ready to be operational. Answer B is incorrect. System Security Authorization Agreement (SSAA) is an information security document used in the United States Department of Defense (DoD) to describe and accredit networks and systems. The SSAA is part of the Department of Defense Information Technology Security Certification and Accreditation Process, or DITSCAP (superseded by DIACAP). The DoD instruction (issues in December 1997, that describes DITSCAP and provides an outline for the SSAA document is DODI 5200.40. The DITSCAP application manual (DoD 8510.1-M), published in July 2000, provides additional details.

QUESTION 20
In which of the following testing methodologies do assessors use all available documentation and work under no constraints, and attempt to circumvent the security features of an information system?

Full operational test

Penetration test

Paper test

Walk-through test

Explanation/Reference:
Explanation: A penetration testing is a method of evaluating the security of a computer system or network by simulating an attack from a malicious source. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution. The intent of a penetration test is to determine feasibility of an attack and the amount of business impact of a successful exploit, if discovered. It is a component of a full security audit. Answer: C is incorrect. A paper test is the least complex test in the disaster recovery and business continuity testing approaches. In this test, the BCP/DRP plan documents are distributed to the appropriate managers and BCP/DRP team members for review, markup, and comment. This approach helps the auditor to ensure that the plan is complete and that all team members are familiar with their responsibilities within the plan. Answer: D is incorrect. A walk-through test is an extension of the paper testing in the business continuity and disaster recovery process. In this testing methodology, appropriate managers and BCP/DRP team members discuss and walk through procedures of the plan. They also discuss the training needs, and clarification of critical plan elements. Answer: A is incorrect. A full operational test includes all team members and participants in the disaster recovery and business continuity process. This full operation test involves the mobilization of personnel. It restores operations in the same manner as an outage or disaster would. The full operational test extends the preparedness test by including actual notification, mobilization of resources, processing of data, and utilization of backup media for restoration.

QUESTION 21
The organization level is the Tier 1 and it addresses risks from an organizational perspective. What are the various Tier 1 activities? Each correct answer represents a complete solution. Choose all that apply.

The organization plans to use the degree and type of oversight, to ensure that the risk management strategy is being effectively carried out.

The level of risk tolerance.

The techniques and methodologies an organization plans to employ, to evaluate information system- related security risks.

The RMF primarily operates at Tier 1.

QUESTION 22
Which of the following approaches can be used to build a security program? Each correct answer represents a complete solution. Choose all that apply.

Right-Up Approach

Left-Up Approach

Top-Down Approach

Bottom-Up Approach

QUESTION 23
Which of the following types of attacks is targeting a Web server with multiple compromised computers that are simultaneously sending hundreds of FIN packets with spoofed IP source IP addresses?

DDoS attack

Evasion attack

Insertion attack

Dictionary attack

QUESTION 24
Which of the following types of redundancy prevents attacks in which an attacker can get physical control of a machine, insert unauthorized software, and alter data?

Data redundancy

Hardware redundancy

Process redundancy

Application redundancy

QUESTION 25
What are the security advantages of virtualization, as described in the NIST Information Security and Privacy Advisory Board (ISPAB) paper “Perspectives on Cloud Computing and Standards”? Each correct answer represents a complete solution. Choose three.

It increases capabilities for fault tolerant computing.

It adds a layer of security for defense-in-depth.

It decreases exposure of weak software.

It decreases configuration effort.

QUESTION 26
The DoD 8500 policy series represents the Department’s information assurance strategy. Which of the following objectives are defined by the DoD 8500 series? Each correct answer represents a complete solution. Choose all that apply.

Defending systems

Providing IA Certification and Accreditation

Providing command and control and situational awareness

Protecting information

QUESTION 27
How can you calculate the Annualized Loss Expectancy (ALE) that may occur due to a threat?

Single Loss Expectancy (SLE) X Annualized Rate of Occurrence (ARO)

Single Loss Expectancy (SLE)/ Exposure Factor (EF)

Asset Value X Exposure Factor (EF)

Exposure Factor (EF)/Single Loss Expectancy (SLE)

QUESTION 28
Which of the following test methods has the objective to test the IT system from the viewpoint of a threat-source and to identify potential failures in the IT system protection schemes?

Security Test and Evaluation (ST&E)

Penetration testing

Automated vulnerability scanning tool

On-site interviews

QUESTION 29
Which of the following are included in Technical Controls? Each correct answer represents a complete solution. Choose all that apply.

Identification and authentication methods

Configuration of the infrastructure

Password and resource management

Implementing and maintaining access control mechanisms

Security devices

Conducting security-awareness training

QUESTION 30
Frank is the project manager of the NHH Project. He is working with the project team to create a plan to document the procedures to manage risks throughout the project. This document will define how risks will be identified and quantified. It will also define how contingency plans will be implemented by the project team. What document is Frank and the NHH Project team creating in this scenario?

Risk management plan

Project plan

Project management plan

Resource management plan

QUESTION 31
Which of the following phases of DITSCAP includes the activities that are necessary for the continuing operation of an accredited IT system in its computing environment and for addressing the changing threats that a system faces throughout its life cycle?

Phase 2, Verification

Phase 3, Validation

Phase 1, Definition

Phase 4, Post Accreditation Phase

QUESTION 32
Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Single Loss Expectancy (SLE)

Annualized Rate of Occurrence (ARO)

Safeguard

Exposure Factor (EF)

Who should take the exam

if you have the following prerequisite and required skills then you should take this exam for getting Certified Secure Software Lifecycle Professional (CSSLP) certificate.

Minimum of 4 years of cumulative paid full-time Software Development Lifecycle (SDLC) professional work experience in 1 or more of the 8 domains of the (ISC)2 CSSLP CBK
3 years of cumulative paid full-time SDLC professional work experience in 1 or more of the 8 domains of the CSSLP CBK
4-year degree leading to a Baccalaureate, or regional equivalent in Computer Science, Information Technology (IT) or related fields.

ISC CSSLP Real 2023 Braindumps Mock Exam Dumps: https://www.real4prep.com/CSSLP-exam.html