ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During a risk assessment of your organization's Quality Assurance (QA) environment, you learn that testers routinely load a recent copy of the production customer database-containing names, addresses, and payment details-onto QA servers that sit on an internal network segment without a web application firewall or data-loss prevention controls. Which risk should be rated the highest for this QA environment?
Accidental deployment of untested code to production by QA staff because of shared source control repositories
Performance degradation of QA systems caused by verbose security logging enabled for debugging
Inaccurate load-test results leading to potential capacity shortfalls when the application goes live
Exposure of sensitive customer data due to using live production records on less-protected QA servers
Copying real customer data into a QA environment where security controls are weaker greatly increases the likelihood of unauthorized disclosure of personally identifiable information (PII). Because QA servers lack the WAF and DLP protections present in production, any compromise-or even inadvertent access by internal staff-can expose sensitive data. In contrast, the other options describe issues that have lower confidentiality impact (excessive logging), are mitigated by existing separation of duties (QA accounts cannot modify production), or relate to availability rather than confidentiality (test scripts affecting performance). Therefore, the highest-priority risk is leakage of live customer data from the less-protected QA environment.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is personally identifiable information (PII)?
Open an interactive chat with Bash
Why is a QA environment typically less secure than production?
Open an interactive chat with Bash
What is the role of a web application firewall (WAF)?
Open an interactive chat with Bash
What is Personally Identifiable Information (PII)?
Open an interactive chat with Bash
What is a Web Application Firewall (WAF) and how does it protect sensitive data?
Open an interactive chat with Bash
How does Data Loss Prevention (DLP) work and why is it important?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)