1
Q
- What is the primary goal of secure software deployment?
A
To ensure that software is installed and configured in a controlled, secure, and verified manner.
2
Q
- What is the main difference between deployment and release?
A
Deployment is the act of installing the software; release is making it available to end-users or production.
3
Q
- What is configuration management in the context of deployment?
A
It ensures that all configurations are securely managed, versioned, and documented to maintain consistency.
4
Q
- What is the purpose of release management?
A
To coordinate software builds, approvals, and deployments, ensuring only authorized versions are released.
5
Q
- Why is a change control process important in operations?
A
It prevents unauthorized modifications and ensures that all changes are assessed, tested, and approved.
6
Q
- What is a rollback plan?
A
A predefined procedure for reverting a system to its previous stable state after a failed deployment.
7
Q
- What is bootstrapping in software deployment?
A
A process that initializes software or systems, ensuring integrity and proper sequencing during startup.
8
Q
- What is secure activation?
A
The process of enabling software functionality in a secure manner, often using cryptographic validation.
9
Q
- What is the difference between hotfix and patch?
A
A hotfix is a quick update to fix a specific issue; a patch is a broader update that may include multiple fixes.
10
Q
- Why is patch management critical to operations?
A
It ensures vulnerabilities are remediated promptly to reduce exposure to known exploits.
11
Q
- What is a vulnerability management process?
A
A continuous cycle of identifying, evaluating, prioritizing, and remediating software vulnerabilities.
12
Q
- What are the stages of vulnerability management?
A
Discovery, Prioritization, Remediation, Verification, and Reporting.
13
Q
- What is the difference between proactive and reactive maintenance?
A
Proactive maintenance prevents issues before they occur; reactive maintenance responds after issues arise.
14
Q
- What is the goal of operational risk analysis?
A
To assess the impact and likelihood of threats affecting software during operation and maintenance.
15
Q
- What is a runbook?
A
A detailed operational guide outlining routine procedures, troubleshooting, and response steps.
16
Q
- What is continuous monitoring?
A
An ongoing process that tracks system performance and security to detect deviations or incidents in real time.
17
Q
- What are examples of monitoring tools?
A
SIEMs like Splunk, Azure Sentinel, and Nagios for performance and security monitoring.
18
Q
- What is mean time to detect (MTTD)?
A
The average time it takes to identify a security incident after it occurs.
19
Q
- What is mean time to recover (MTTR)?
A
The average time required to restore a system after an incident.
20
Q
- What is incident management?
A
A structured process for identifying, containing, eradicating, and recovering from security incidents.
21
Q
- What is the role of an Incident Response Team (IRT)?
A
To coordinate and execute responses to detected security incidents and minimize impact.
22
Q
- What are the main steps in the incident response process?
A
Preparation, Detection, Containment, Eradication, Recovery, and Lessons Learned.
23
Q
- What is the purpose of post-incident analysis?
A
To identify root causes, improve controls, and prevent recurrence of similar incidents.
24
Q
- What is service continuity management?
A
Ensuring critical business services can continue during and after a disruption.
25
25. What is the difference between business continuity and disaster recovery?
Business continuity focuses on maintaining operations; disaster recovery focuses on restoring IT systems.
26
26. What is a backup strategy?
A defined process for copying and storing data securely to enable recovery after loss or corruption.
27
27. What is the 3-2-1 backup rule?
Keep 3 copies of data, on 2 different media, with 1 copy offsite or offline.
28
28. Why is encryption important in backups?
It protects data at rest and ensures confidentiality if backups are lost or stolen.
29
29. What is log management?
The process of collecting, storing, analyzing, and protecting system and application logs for auditing and security.
30
30. What are best practices for secure logging?
Centralized logging, time synchronization, access control, and encryption of sensitive log data.
31
31. What is baseline performance monitoring?
Tracking normal operational parameters to detect deviations that may indicate performance or security issues.
32
32. What are SLAs and why are they important?
Service Level Agreements define expected performance levels, uptime, and response times between provider and customer.
33
33. What is the purpose of service integration and management (SIAM)?
To coordinate multiple service providers to ensure seamless, secure operations across the service chain.
34
34. What is the difference between preventive and detective operational controls?
Preventive controls stop incidents before they happen; detective controls identify them after occurrence.
35
35. What is patch testing?
The process of validating patches in a controlled environment before deployment to production.
36
36. Why is change window scheduling important?
It minimizes operational disruption and ensures appropriate staff availability during changes.
37
37. What is the purpose of service acceptance testing?
To verify that a system meets operational, performance, and security requirements before production release.
38
38. What is meant by 'runtime protection'?
Mechanisms such as RASP (Runtime Application Self-Protection) that detect and block attacks during execution.
39
39. What are common post-deployment security tests?
Vulnerability scanning, configuration audits, penetration tests, and attack surface validation.
40
40. What is the difference between verification and validation?
Verification ensures software was built correctly; validation ensures the right product was built.
41
41. What is an operational readiness review (ORR)?
A pre-deployment assessment confirming that all technical, procedural, and security requirements are met.
42
42. What is secure maintenance?
Regular updating and monitoring of software to maintain its security posture throughout its life.
43
43. Why is access review part of maintenance?
To ensure only authorized users retain access and unnecessary permissions are revoked.
44
44. What is technical debt in operations?
Accumulated deficiencies from postponed maintenance that increase risk and future remediation costs.
45
45. How can automation improve operational security?
By reducing human error, ensuring consistent configuration, and enabling faster response to threats.
46
46. What are the main elements of operational risk management?
Identification, assessment, mitigation, monitoring, and reporting of risks affecting operations.
47
47. What is the role of documentation in operations?
It provides repeatable procedures, ensures accountability, and aids audits and troubleshooting.
48
48. What are end-of-life (EOL) policies?
Guidelines defining how and when software or hardware will be retired, supported, and replaced securely.
49
49. What are common security risks during software decommissioning?
Residual data exposure, unrevoked credentials, and unpatched legacy systems left connected.
50
50. Why is maintenance the most resource-intensive phase of the SDLC?
Because it involves continuous monitoring, updates, and incident management over the system’s lifespan.
51
Question
Model Answer
52
Explain the primary goal of secure software deployment. (Domain 7)
To release software into production safely, ensuring all configurations, controls, and documentation are correct and approved.
53
Describe how deployment planning supports security. (Domain 7)
Planning defines steps, responsibilities, validation checks, and rollback options to minimize risks during go-live.
54
Define deployment validation. (Domain 7)
A process that verifies the software meets operational, functional, and security requirements before release.
55
Explain why pre-deployment testing environments should mirror production. (Domain 7)
Matching configurations ensure that results are accurate and security behaviors remain consistent post-deployment.
56
Describe the importance of automation in secure deployment. (Domain 7)
Automation reduces human error, enforces repeatable processes, and increases deployment consistency.
57
Explain configuration management in operations. (Domain 7)
It maintains consistent, secure system states by tracking, approving, and enforcing authorized configurations.
58
Describe the principle of least functionality. (Domain 7)
Systems should only include the components and services necessary for operation, minimizing the attack surface.
59
Define environment hardening. (Domain 7)
Removing unnecessary software, disabling unused ports, and applying security configurations to reduce vulnerabilities.
60
Explain the purpose of configuration baselines. (Domain 7)
They define approved, secure configurations used to detect and remediate drift or unauthorized changes.
61
Describe how Infrastructure as Code (IaC) improves operational security. (Domain 7)
IaC enforces version control, peer review, and repeatability in environment provisioning, reducing configuration errors.
62
Explain the purpose of patch management in operations. (Domain 7)
To apply updates that fix vulnerabilities and performance issues without disrupting service continuity.
63
Describe the typical steps in the patch management process. (Domain 7)
Identify, evaluate, test, deploy, and verify patches while maintaining rollback options.
64
Define emergency patching. (Domain 7)
Rapid deployment of critical patches to fix high-risk vulnerabilities outside regular release cycles.
65
Explain how risk-based patching prioritizes updates. (Domain 7)
Patches are prioritized by severity, exploitability, and asset criticality to balance risk and resources.
66
Describe how change control complements patch management. (Domain 7)
Change control ensures patches are reviewed, approved, and tracked to maintain auditability and reduce errors.
67
Explain why continuous monitoring is critical in operations. (Domain 7)
It provides real-time visibility into system performance, anomalies, and potential security incidents.
68
Describe how logging supports operational security. (Domain 7)
Logs capture system and user events for detecting, investigating, and preventing incidents.
69
Define centralized logging and its benefit. (Domain 7)
Centralized logging consolidates data for faster analysis, correlation, and threat detection.
70
Explain the purpose of alerting thresholds in monitoring. (Domain 7)
Thresholds define acceptable limits for system metrics, triggering alerts when anomalies occur.
71
Describe the difference between proactive and reactive monitoring. (Domain 7)
Proactive identifies issues before they cause failures; reactive responds after issues occur.
72
Explain the vulnerability management lifecycle. (Domain 7)
Discover, assess, remediate, verify, and report vulnerabilities continuously to maintain resilience.
73
Describe how vulnerability scanning differs from penetration testing. (Domain 7)
Scanning identifies potential weaknesses automatically; penetration testing manually exploits them for validation.
74
Define incident response and its primary phases. (Domain 7)
Preparation, detection, containment, eradication, recovery, and post-incident review.
75
Explain the purpose of root cause analysis after incidents. (Domain 7)
It identifies underlying causes and drives process improvements to prevent recurrence.
76
Describe how lessons learned from incidents improve operational security. (Domain 7)
They guide updates to procedures, training, and configurations to strengthen defenses.
77
Explain how security information and event management (SIEM) enhances operations. (Domain 7)
SIEM aggregates and correlates log data to detect patterns of malicious behavior in real time.
78
Describe the role of anomaly detection in operations. (Domain 7)
It uses baselines and analytics to identify deviations that may indicate compromise or misconfiguration.
79
Define behavioral monitoring. (Domain 7)
Behavioral monitoring establishes patterns of normal activity and flags deviations for investigation.
80
Explain how threat intelligence supports operational security. (Domain 7)
It provides context on emerging threats and indicators of compromise to prioritize defensive actions.
81
Describe the purpose of performance monitoring alongside security monitoring. (Domain 7)
Combining both ensures system stability and availability while safeguarding against attacks.
82
Explain why maintenance is critical to software assurance. (Domain 7)
Ongoing updates, testing, and monitoring ensure software remains secure and reliable over time.
83
Describe the importance of lifecycle documentation during maintenance. (Domain 7)
Up-to-date documentation supports audits, compliance, and consistent operational procedures.
84
Define preventive maintenance in software operations. (Domain 7)
Regular updates and optimizations performed proactively to avoid issues and extend system lifespan.
85
Explain how regression testing supports maintenance. (Domain 7)
Regression testing ensures that patches or updates do not introduce new vulnerabilities or defects.
86
Describe how automation aids maintenance. (Domain 7)
Automation ensures consistency, reduces human error, and supports timely patch and configuration updates.
87
Explain the role of backups in operational security. (Domain 7)
Backups protect data availability and integrity, ensuring recovery after failures or attacks.
88
Describe the characteristics of a secure backup. (Domain 7)
Encrypted, regularly tested, versioned, and stored offline or in isolated environments.
89
Define recovery point objective (RPO) and recovery time objective (RTO). (Domain 7)
RPO defines acceptable data loss; RTO defines acceptable downtime after a disruption.
90
Explain why backup restoration testing is necessary. (Domain 7)
Testing confirms backups are valid and can be restored quickly in an emergency.
91
Describe the importance of redundancy in maintaining availability. (Domain 7)
Redundancy ensures service continuity through duplication of critical systems and components.
92
Explain secure decommissioning of software systems. (Domain 7)
It involves safely retiring applications, removing data, revoking access, and documenting actions taken.
93
Describe secure data disposal techniques. (Domain 7)
Use secure deletion, overwriting, or physical destruction to ensure data cannot be recovered.
94
Define archiving and its role in decommissioning. (Domain 7)
Archiving preserves essential data for compliance or future analysis before disposal of active systems.
95
Explain the purpose of deprovisioning in system retirement. (Domain 7)
Deprovisioning removes users, credentials, and resources associated with the retired system.
96
Describe how post-decommission reviews improve future projects. (Domain 7)
They capture lessons learned to enhance planning and reduce risks in future deployments.
CSSLP DC
flashcards
Decks in class (13)
# Cards
-
CSSLP General327
-
CSSLP Domain 1 – Secure Software Concepts50
-
CSSLP Domain 2 – Secure Software Requirements97
-
CSSLP Domain 3 – Secure Software Architecture and Design71
-
CSSLP Domain 4 – Secure Software Implementation98
-
CSSLP Domain 5 – Secure Software Testin26
-
CSSLP Domain 6 – Secure Software Lifecycle Management101
-
CSSLP Domain 7 – Secure Software Deployment, Operations, and Maintenance96
-
CSSLP Domain 8 – Secure Software Supply Chain96
-
NIST 800-218100
-
CSSLP Study Notes342
-
NIST-800-64r2 (Replaced By 800-218)36
-
SSDLC Gated Process90
