NIST-SSDF Practice Test

NIST-SSDF practice test: what's covered

• PO
• PS
• PW
• RV
• Secure by Design Evidence

Free NIST-SSDF sample questions

1. A SaaS team is moving a customer-facing workflow from quarterly releases to weekly deployment and the security lead must keep evidence defensible. Which response best supports the SSDF objective to prepare people, processes and technology for secure development?

   • A. Create a secure development policy with named owners, risk criteria, training expectations and approved SDLC gates
   • B. Let each squad define its own security gates after release dates are committed
   • C. Use personal laptops and unmanaged build services because they are faster for delivery
   • D. Treat risk acceptance as an informal chat message with no owner or expiry date
   Show answer

   Correct: A. Create a secure development policy with named owners, risk criteria, training expectations and approved SDLC gates is the best answer because SSDF PO practices establish governance, security requirements, roles, training, toolchains and secure development environments before individual teams write or release software. It creates evidence and operational behavior that a reviewer can verify. The other options either postpone security until after release, weaken accountability, or produce artifacts that do not prove the team is managing software risk in a repeatable way.

2. During a pre-release review, the product owner asks which control should be completed before accepting residual software security risk. Which response best supports the SSDF objective to prepare people, processes and technology for secure development?

   • A. Define security requirements as backlog acceptance criteria and link them to product risk and compliance obligations
   • B. Use personal laptops and unmanaged build services because they are faster for delivery
   • C. Treat risk acceptance as an informal chat message with no owner or expiry date
   • D. Copy a generic policy from another company without mapping it to actual products
   Show answer

   Correct: A. Define security requirements as backlog acceptance criteria and link them to product risk and compliance obligations is the best answer because SSDF PO practices establish governance, security requirements, roles, training, toolchains and secure development environments before individual teams write or release software. It creates evidence and operational behavior that a reviewer can verify. The other options either postpone security until after release, weaken accountability, or produce artifacts that do not prove the team is managing software risk in a repeatable way.

3. An engineering manager wants a practical action that improves security without turning the SDLC into a paperwork exercise. Which TWO actions provide the strongest SSDF-aligned evidence for this situation? (Choose TWO)

   • A. Maintain approved secure development environments with hardened build services, access reviews and change records
   • B. Assign security ownership only to the final penetration tester at the end of the project
   • C. Assign security champions and require role-based secure coding and threat modeling training for engineering teams
   • D. Copy a generic policy from another company without mapping it to actual products
   Show answer

   Correct: A and C. Maintain approved secure development environments with hardened build services, access reviews and change records and Assign security champions and require role-based secure coding and threat modeling training for engineering teams are correct because SSDF PO practices establish governance, security requirements, roles, training, toolchains and secure development environments before individual teams write or release software. Together they demonstrate both a preventive control and reviewable evidence. Assign security ownership only to the final penetration tester at the end of the project and Copy a generic policy from another company without mapping it to actual products are weaker because

4. A regulated customer asks how the team can prove that secure development practices are repeatable across products. Which response best supports the SSDF objective to prepare people, processes and technology for secure development?

   • A. Track architecture decisions, security assumptions and risk acceptances in a repository that product and security can review
   • B. Copy a generic policy from another company without mapping it to actual products
   • C. Document security requirements only in a slide deck that developers do not see
   • D. Assign security ownership only to the final penetration tester at the end of the project
   Show answer

   Correct: A. Track architecture decisions, security assumptions and risk acceptances in a repository that product and security can review is the best answer because SSDF PO practices establish governance, security requirements, roles, training, toolchains and secure development environments before individual teams write or release software. It creates evidence and operational behavior that a reviewer can verify. The other options either postpone security until after release, weaken accountability, or produce artifacts that do not prove the team is managing software risk in a repeatable way.

5. A platform squad discovers that different teams use different release tools and inconsistent evidence retention. Which response best supports the SSDF objective to prepare people, processes and technology for secure development?

   • A. Standardize secure toolchain configuration, dependency policy and evidence retention before teams create release branches
   • B. Document security requirements only in a slide deck that developers do not see
   • C. Assign security ownership only to the final penetration tester at the end of the project
   • D. Disable toolchain controls whenever they slow a sprint without recording the exception
   Show answer

   Correct: A. Standardize secure toolchain configuration, dependency policy and evidence retention before teams create release branches is the best answer because SSDF PO practices establish governance, security requirements, roles, training, toolchains and secure development environments before individual teams write or release software. It creates evidence and operational behavior that a reviewer can verify. The other options either postpone security until after release, weaken accountability, or produce artifacts that do not prove the team is managing software risk in a repeatable way.

Last updated: 2026-10-19

NIST-SSDF practice test FAQ