ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During an operational risk assessment you learn that developers clone production database snapshots into the shared Quality Assurance (QA) environment so testers have realistic data for functional testing. The QA network is less restricted, contractors have access, and detailed auditing is not enabled. Which risk requires the highest priority mitigation before the next release?
Developers accidentally committing experimental code to the main production branch due to shared credentials.
Violation of third-party software licenses when libraries are executed outside the production environment.
Unauthorized disclosure of sensitive production data because it is stored unmasked in a lower-trust environment.
Performance degradation of test systems leading to delayed release schedules.
The greatest concern is that copying production data into a QA environment that has broader access controls and weaker monitoring exposes real customer or employee information to unauthorized viewing, theft, or alteration. Because QA networks are typically less protected and are accessed by a wider audience-including contractors and testers who do not need to see live personal or financial data-using unsanitized production data violates the principle of least privilege and may breach privacy or regulatory requirements (e.g., GDPR, PCI DSS). While performance, source-code management mistakes, and software license issues all present some risk, none pose the immediate confidentiality and compliance threat that unmasked sensitive data in a QA environment does. Masking or generating synthetic data, coupled with stricter access controls and logging, is the appropriate mitigation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is data masking and how is it implemented?
Open an interactive chat with Bash
Why are QA environments typically less secure than production environments?
Open an interactive chat with Bash
What is the principle of least privilege and how does it apply to this scenario?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)