Crucial Exams

ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

During an architectural design review, a colleague proposes to use the Common Vulnerability Scoring System (CVSS) as the team's sole threat-modeling approach, arguing it will identify all possible threats and guide mitigation planning. According to secure software lifecycle best practices, what is the most appropriate response?

  • Recommend adding a methodology such as STRIDE, explaining that CVSS only scores severity after vulnerabilities are identified rather than performing threat discovery.

  • Support the idea, because CVSS fully covers identifying and prioritizing threats across the system lifecycle.

  • Accept the plan but insist CVSS be applied early so the team can skip other time-consuming threat-modeling activities.

  • Propose replacing CVSS with the DREAD model, since DREAD is specifically designed for end-to-end threat modeling.

ISC2 Certified Secure Software Lifecycle Professional (CSSLP)
Secure Software Architecture and Design
Your Score:
Settings & Objectives
Random Mixed
Questions are selected randomly from all chosen topics, with a preference for those you haven’t seen before. You may see several questions from the same objective or domain in a row.
Rotate by Objective
Questions cycle through each objective or domain in turn, helping you avoid long streaks of questions from the same area. You may see some repeat questions, but the distribution will be more balanced across topics.

Check or uncheck an objective to set which questions you will receive.

Wipe Score
Bash, the Crucial Exams Chat Bot
AI Bot