New 2024 CSSLP Dumps for ISC Certification Certified Exam Questions & Answer [Q159-Q173]

5/5 - (1 vote)

New 2024 CSSLP Dumps for ISC Certification Certified Exam Questions and Answer

Realistic Verified CSSLP exam dumps Q&As – CSSLP Free Update

How to book CSSLP Exam

Conclusion

Getting the Certified Secure Software Lifecycle Professional certification can be achieved by passing one exam. The candidates can get the passing score by following the blueprint of the test and understanding the skills they have to develop. Also, using verified training materials is an effective strategy that can lead to success. Therefore, the candidates can use the books available on Amazon or enroll in instructor-led online or classroom sessions, where they can understand the exam topics much better and as a result, nail the official validation in one go.

How to study CSSLP Exam

ISC offered the following study material to help you prepare for the certification tests.

This course is recommended, but not required, before taking a CSSLP certification exam. When preparing for the CSSLP certification exam, keep in mind that real world experience is required to stand a reasonable chance of passing CSSLP exam.

QUESTION 159
Which of the following steps of the LeGrand Vulnerability-Oriented Risk Management method determines the necessary compliance offered by risk management practices and assessment of risk levels?

Assessment, monitoring, and assurance

Vulnerability management

Risk assessment

Adherence to security standards and policies for development and deployment

QUESTION 160
According to U.S. Department of Defense (DoD) Instruction 8500.2, there are eight Information Assurance (IA) areas, and the controls are referred to as IA controls. Which of the following are among the eight areas of IA defined by DoD? Each correct answer represents a complete solution. Choose all that apply.

VI Vulnerability and Incident Management

Information systems acquisition, development, and maintenance

DC Security Design & Configuration

EC Enclave and Computing Environment

QUESTION 161
To help review or design security controls, they can be classified by several criteria. One of these criteria is based on time. According to this criteria, which of the following controls are intended to prevent an incident from occurring?

Corrective controls

Adaptive controls

Detective controls

Preventive controls

QUESTION 162
In which of the following architecture styles does a device receive input from connectors and generate transformed outputs?

N-tiered

Heterogeneous

Pipes and filters

Layered

QUESTION 163
Which of the following approaches can be used to build a security program? Each correct answer represents a complete solution. Choose all that apply.

Right-Up Approach

Left-Up Approach

Top-Down Approach

Bottom-Up Approach

QUESTION 164
Which of the following is a patch management utility that scans one or more computers on a network and alerts a user if any important Microsoft security patches are missing and also provides links that enable those missing patches to be downloaded and installed?

MABS

ASNB

MBSA

IDMS

QUESTION 165
What are the various activities performed in the planning phase of the Software Assurance Acquisition process? Each correct answer represents a complete solution. Choose all that apply.

Develop software requirements.

Implement change control procedures.

Develop evaluation criteria and evaluation plan.

Create acquisition strategy.

QUESTION 166
In which type of access control do user ID and password system come under?

Physical

Technical

Power

Administrative

QUESTION 167
Which of the following NIST Special Publication documents provides a guideline on network security testing?

NIST SP 800-42

NIST SP 800-53A

NIST SP 800-60

NIST SP 800-53

NIST SP 800-37

NIST SP 800-59

QUESTION 168
Which of the following statements about the availability concept of Information security management is true?

It ensures that modifications are not made to data by unauthorized personnel or processes.

It determines actions and behaviors of a single individual within a system.

It ensures reliable and timely access to resources.

It ensures that unauthorized modifications are not made to data by authorized personnel or processes.

QUESTION 169
Which of the following is NOT a responsibility of a data owner?

Approving access requests

Ensuring that the necessary security controls are in place

Delegating responsibility of the day-to-day maintenance of the data protection mechanisms to the data custodian

Maintaining and protecting data

QUESTION 170
Martha works as a Project Leader for BlueWell Inc. She and her team have developed accounting software. The software was performing well. Recently, the software has been modified. The users of this software are now complaining about the software not working properly. Which of the following actions will she take to test the software?

Perform integration testing

Perform regression testing

Perform unit testing

Perform acceptance testing

QUESTION 171
John works as a systems engineer for BlueWell Inc. He has modified the software, and wants to retest the application to ensure that bugs have been fixed or not. Which of the following tests should John use to accomplish the task?

Reliability test

Functional test

Performance test

Regression test

QUESTION 172
You are the project manager for your organization. You are preparing for the quantitative risk analysis. Mark, a project team member, wants to know why you need to do quantitative risk analysis when you just completed qualitative risk analysis. Which one of the following statements best defines what quantitative risk analysis is?

Quantitative risk analysis is the process of prioritizing risks for further analysis or action by assessing and combining their probability of occurrence and impact.

Quantitative risk analysis is the review of the risk events with the high probability and the highest impact on the project objectives.

Quantitative risk analysis is the planning and quantification of risk responses based on probability and impact of each risk event.

Quantitative risk analysis is the process of numerically analyzing the effect of identified risks on overall project objectives.

QUESTION 173
DRAG DROP
RCA (root cause analysis) is an iterative and reactive method that identifies the root cause of various incidents, and the actions required to prevent these incidents from reoccurring. RCA is classified in various categories. Choose appropriate categories and drop them in front of their respective functions.