ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question

User-facing documentation that instructs readers to disable or weaken security controls creates a direct risk: some operators will follow the guidance in production, unintentionally leaving systems exposed. The CSSLP objective for verifying and validating documentation requires ensuring accuracy and assessing security impact. The safest response is to treat the recommendation itself as a defect, raise it with development, and update the guide to reference a secure, documented diagnostic feature that does not suppress authentication (or at least requires strong access control). Simply deleting the section (distractor) may leave support without a sanctioned method, encouraging ad-hoc insecure work-arounds. Approving the text as-is, or merely adding a caution, still publishes knowledge of - and tacitly legitimises - a built-in backdoor, contravening secure documentation practices. Therefore, coordinating a product change or alternative secure process and correcting the documentation is the most appropriate course.