CSSLP Secure Software Prep practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q21At which stage of the software development lifecycle should security requirements be defined and formalized to mitigate supply chain risks?
✓ Correct answer: B. Requirements Gathering
Answer: Requirements Gathering Security requirements must be defined and formalized during the Requirements Gathering stage of the software development lifecycle. Ensuring that security is built into the design from the beginning is crucial in mitigating supply chain risks. This process involves identifying potential security issues and addressing them through specific requirements that guide the entire development process. The main steps of incorporating security into the software development lifecycle are: Stage Description Requirements Gathering Define and formalize security requirements to mitigate supply chain risks; address potential security issues. Design Integrate security requirements into the software design; establish secure development practices. Implementation Follow secure coding practices; perform code reviews and security testing. Testing Conduct security testing and vulnerability assessments; ensure security requirements are met. Deployment Implement security measures in the deployment process; ensure secure configuration and environment. Maintenance Monitor and update the software to address new security threats; maintain the security posture.
Q22Which software maintenance model relies on publicly available resources and forums for support in the management of vulnerabilities and patches?
✓ Correct answer: A. Open-source
Answer: Open-source Maintenance of third-party code may be performed under one of two models: Open-source: Software under this model typically relies on community participation for maintenance, including support through forums and public websites. Proprietary: The vendor or developer of the third-party code, or an appointed organization, is responsible for addressing questions and resolving issues. Collaborative and unmanaged are not code maintenance models.
Q23Which of the following practices is most effective in ensuring the integrity and authenticity of software updates from third-party vendors?
✓ Correct answer: D. Cryptographically Hashed, Digitally Signed Components
Cryptographically Hashed, Digitally Signed Components: Ensuring that software updates are cryptographically hashed and digitally signed is crucial in verifying the authenticity and integrity of the updates received from third-party vendors. This practice helps safeguard against supply chain attacks where an attacker might insert malicious code. Secure Transfer: While transferring software via secure channels like TLS can protect the data during transfer, it does not guarantee the authenticity or integrity of the software itself. System Sharing/Interconnections: Securing interconnections is critical for protecting against attacks at network interfaces but does not inherently ensure the authenticity of software updates. Code Repository Security: Protecting code repositories against unauthorized changes is important but does not verify the authenticity of third-party software updates.
Q24Which of the following controls are used to maintain integrity and traceability of code and are established through code repositories in a secure software supply chain?
✓ Correct answer: C. Code integrity controls
Answer: Code integrity controls Code integrity controls ensure the integrity of the code by maintaining a traceable history of changes and contributions. These controls are implemented via code repositories and help verify the authenticity and security of the software supply chain. Vendor management controls are policies and processes to manage suppliers and contracts. Vendor traceability controls ensure that each component of the software can be traced back to its origin. Vendor authentication controls verify the identities of suppliers and contributors to the software.
Q25During the Secure Software Development Lifecycle (SDLC), what is the primary purpose of conducting a security audit on third-party software components?
✓ Correct answer: A. Assess
Answer: Assess Conducting a security audit on third-party software components within the SDLC helps to assess potential security risks and vulnerabilities that these components might introduce to the overall software system. This audit is a crucial step in identifying and managing supply chain risks. Step Description Identify All third-party components that could potentially introduce risks are identified. Assess Each component is evaluated for security vulnerabilities and risks. Respond Strategies for mitigating identified risks, such as patching vulnerabilities or replacing risky components, are developed. Monitor Continuous monitoring ensures that the risks associated with third-party components are managed effectively over time.
Q26Which of the following licensing models allows for modifications of a purchased software’s source code by the end user?
✓ Correct answer: B. Open Source
Answer: Open Source Proprietary Software: This software is licensed under strict terms that don’t allow modification by the end user. Commercial off the Shelf (COTS): COTS software is mass-produced and available for sale to the general public but does not allow for end user modifications. Freeware: Freeware is software available at no cost but generally does not allow modification to its source code. Open Source: Open Source software is distributed with a license that allows the end user to view, alter, and distribute the source code.
Q27Which of the following approaches reduces the likelihood of a security breach in the software supply chain?
✓ Correct answer: A. Implement comprehensive code review practices
Implementing comprehensive code review practices can help identify and mitigate potential security vulnerabilities early in the development process, thereby reducing the risk of a security breach in the software supply chain. In contrast, using open-source libraries without verification, ignoring vendor security audits, or outsourcing critical components without proper risk assessment increases the likelihood of security breaches.
Q28Which of the following terms is commonly associated with ensuring that software development processes align with organizational standards and policies?
✓ Correct answer: B. Conformance
Answer: Conformance Conformance refers to adherence to internal organizational standards and policies. Compliance, on the other hand, deals with adherence to external rules and laws.
Q29Who is responsible for managing changes in software requirements during the development lifecycle?
✓ Correct answer: B. Requirements management team
Answer: Requirements management team The requirements management team is responsible for overseeing and managing changes to software requirements to ensure the project stays on track and meets stakeholders' expectations. Configuration managers focus on managing the configuration of software, hardware, and documenting changes. Quality assurance teams ensure the final product meets quality standards, whereas project managers oversee the overall progress and provide leadership.
Q30In software development, which of the following is NOT a common phase in the Secure Software Development Lifecycle (SDLC)?
✓ Correct answer: C. Marketing Strategies
Answer: Marketing Strategies The Secure Software Development Lifecycle (SDLC) typically includes the following phases: 1. Requirement Analysis 2. Design 3. Implementation Other common phases include testing, deployment, and maintenance, but marketing strategies are not typically part of the SDLC.
Use the free CSSLP Secure Software Prep sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory