At ValidExamDumps, we consistently monitor updates to the ISC2 CSSLP exam questions by ISC2. Whenever our team identifies changes in the exam questions, objectives, focus areas or requirements, We immediately update our exam questions for both PDF and online practice exams. This commitment ensures our customers always have access to the most current and accurate questions. By preparing with these up to date and 100% exam domain coverage questions, our customers can successfully pass the ISC2 Certified Secure Software Lifecycle Professional exam on their first attempt without needing additional materials or study guides.
Other certification materials providers often include outdated or removed questions by ISC2 in their CSSLP exam. These outdated questions lead to customers failing their ISC2 Certified Secure Software Lifecycle Professional exam. In contrast, we ensure our questions bank includes only precise and up-to-date questions. Our main priority is your success in the ISC2 CSSLP exam, not profiting from selling obsolete exam questions in PDF or Online Practice Test.
In which of the following DIACAP phases is residual risk analyzed?
The Department of Defense Information Assurance Certification and Accreditation Process (DIACAP) is a process defined by the United States
Department of Defense (DoD) for managing risk.
The Certification Determination and Accreditation phase is the third phase in the DIACAP process. Its subordinate tasks are as follows:
Analyze residual risk.
Issue certification determination.
Make accreditation decision.
Answer A is incorrect. Phase 1 is known as Initiate and Plan IA C&A.
Answer C is incorrect. Phase 2 is used to implement and validate assigned IA controls.
Answer E is incorrect. Phase 3 is used to make certification determination and accreditation decisions.
Answer B is incorrect. Phase 5 is known as decommission system and is used to conduct activities related to the disposition of the
system data and objects.
Security controls are safeguards or countermeasures to avoid, counteract, or minimize security risks. Which of the following are types of security controls?
Each correct answer represents a complete solution. Choose all that apply.
Security controls are safeguards or countermeasures to avoid, counteract, or minimize security risks. The following are the types of security
controls for information systems, that can be employed by an organization:
1.System-specific controls: These types of security controls provide security capability for a particular information system only.
2.Common controls: These types of security controls provide security capability for multiple information systems.
3.Hybrid controls: These types of security controls have features of both system-specific and common controls.
Answer C is incorrect. It is an invalid control.
Maria has been recently appointed as a Network Administrator in Gentech Inc. She has been tasked to perform network security testing to find out the vulnerabilities and shortcomings of the present network infrastructure. Which of the following testing approaches will she apply to accomplish this task?
Maria is new for this organization and she does not have any idea regarding the present infrastructure. Therefore, black box testing is best
suited for her.
Blackbox testing is a technique in which the testing team has no knowledge about the infrastructure of the organization. The testers must
first determine the location and extent of the systems before commencing their analysis. This testing technique is costly and time consuming.
Answer B is incorrect. White box testing, also known as Clear box or Glass box testing, takes into account the internal mechanism of a
system or application. The connotations of 'Clear box' and 'Glass box' indicate that a tester has full visibility of the internal workings of the
system. It uses knowledge of the internal structure of an application. It is applicable at the unit, integration, and system levels of the software
testing process. It consists of the following testing methods:
Control flow-based testing
Create a graph from source code.
Describe the flow of control through the control flow graph.
Design test cases to cover certain elements of the graph.
Data flow-based testing
Test connections between variable definitions.
Check variation of the control flow graph.
Set DEF (n) contains variables that are defined at node n.
Set USE (n) are variables that are read.
Answer A is incorrect. Graybox testing is a combination of whitebox testing and blackbox testing. In graybox testing, the test engineer
is equipped with the knowledge of system and designs test cases or test data based on system knowledge. The security tester typically
performs graybox testing to find vulnerabilities in software and network system.
Answer D is incorrect. Unit testing is a type of testing in which each independent unit of an application is tested separately. During unit
testing, a developer takes the smallest unit of an application, isolates it from the rest of the application code, and tests it to determine
whether it works as expected. Unit testing is performed before integrating these independent units into modules. The most common approach
to unit testing requires drivers and stubs to be written. Drivers and stubs are programs. A driver simulates a calling unit, and a stub simulates
a called unit.
Which of the following is NOT a responsibility of a data owner?
It is not a responsibility of a data owner. The data custodian (information custodian) is responsible for maintaining and protecting the data.
Answer B, A, and C are incorrect. All of these are responsibilities of a data owner.
The roles and responsibilities of a data owner are as follows:
The data owner (information owner) is usually a member of management, in charge of a specific business unit, and is ultimately
responsible for the protection and use of a specific subset of information.
The data owner decides upon the classification of the data that he is responsible for and alters that classification if the business needs
arise.
This person is also responsible for ensuring that the necessary security controls are in place, ensuring that proper access rights are
being used, defining security requirements per classification and backup requirements, approving any disclosure activities, and defining
user access criteria.
The data owner approves access requests or may choose to delegate this function to business unit managers. And it is the data owner
who will deal with security violations pertaining to the data he is responsible for protecting.
The data owner, who obviously has enough on his plate, delegates responsibility of the day-to-day maintenance of the data protection
mechanisms to the data custodian.
Which of the following provides an easy way to programmers for writing lower-risk applications and retrofitting security into an existing application?
ESAPI (Enterprise Security API) is a group of classes that encapsulate the key security operations, needed by most of the applications. It is a
free, open source, Web application security control library. ESAPI provides an easy way to programmers for writing lower-risk applications and
retrofitting security into an existing application. It offers a solid foundation for new development.
Answer A is incorrect. Watermarking is the process of embedding information into software in a way that is difficult to remove.
Answer C is incorrect. Encryption wrapper dynamically encrypts and decrypts all the software code at runtime.
Answer D is incorrect. Code obfuscation is designed to protect code from decompilation.
