Certified Software Manager (CSM) Exam — Questions and Answers

Question 1: What is the primary goal of 'shift-left testing' in modern software development?

Deferring user acceptance testing until after production deployment
Introducing testing activities earlier in the development lifecycle to detect defects sooner and reduce remediation cost (Correct answer)
Moving QA engineers from the right side to the left side of the office floor plan
Shifting test automation from developers to dedicated QA teams

Correct answer: Introducing testing activities earlier in the development lifecycle to detect defects sooner and reduce remediation cost

Shift-left testing moves quality activities earlier in the SDLC so defects are caught when they are cheapest to fix, rather than at system test or production.

Question 2: What does 'stakeholder salience' refer to in project management?

The number of meetings a stakeholder has attended
A stakeholder's budget authority only
The physical proximity of a stakeholder to the project office
The degree to which stakeholders possess power, legitimacy, and urgency claims on the project (Correct answer)

Correct answer: The degree to which stakeholders possess power, legitimacy, and urgency claims on the project

Salience theory identifies stakeholders by their combination of power to influence, legitimacy of their relationship, and urgency of their claims, helping managers prioritize engagement.

Question 3: Which of the following is an example of a PULL communication method?

Publishing project reports on a shared intranet portal for stakeholders to access (Correct answer)
Sending a project status email to all stakeholders
Calling a stakeholder directly to discuss an issue
Hosting a mandatory team meeting

Correct answer: Publishing project reports on a shared intranet portal for stakeholders to access

Pull communication places information in a central location where stakeholders choose to access it, as opposed to push methods that send information directly to recipients.

Question 4: During risk planning, a CSM identifies a risk that could cause a 3-week schedule delay if a critical vendor misses their delivery deadline. The manager negotiates a contractual penalty clause with the vendor. This is:

Risk mitigation
Risk transference (Correct answer)
Risk acceptance
Risk avoidance

Correct answer: Risk transference

Contractual penalty clauses shift the financial consequences of the vendor's failure to the vendor, transferring the risk.

Question 5: What is the importance of access control in software security?

It increases the complexity of the software.
It allows anyone to access all parts of the software.
It makes the software less user-friendly.
It ensures that only authorized users have access to sensitive information (Correct answer)

Correct answer: It ensures that only authorized users have access to sensitive information

Access control is a critical security mechanism that regulates who can view, use, or modify resources within a software system. Its importance lies in enforcing the principle of least privilege, ensuring that users only have access to the information and functionalities necessary for their roles. This prevents unauthorized access to sensitive data and critical system functions, significantly enhancing overall security.

Question 6: Which of the following is the first phase of the Software Development Lifecycle?

Implementation
Requirement gathering (Correct answer)
Testing
Design

Correct answer: Requirement gathering

The Requirement Gathering phase is the foundational first step in the Software Development Lifecycle (SDLC). During this phase, project managers and business analysts work closely with stakeholders to understand, document, and define the functional and non-functional requirements of the software system. This crucial step ensures that the development team clearly understands what needs to be built before any design or coding begins.

Question 7: A software team shows signs of 'groupthink.' Which management intervention is MOST effective in combating this?

Centralizing all decisions with the team lead
Rewarding unanimous decisions to increase team harmony
Reducing team meeting frequency to limit group influence
Appointing a designated 'devil's advocate' to challenge group consensus (Correct answer)

Correct answer: Appointing a designated 'devil's advocate' to challenge group consensus

A designated devil's advocate formally challenges assumptions and consensus, encouraging critical evaluation that counteracts groupthink's suppression of dissent.

Question 8: Which scenario best illustrates a 'first-mover advantage' in software strategy?

A company enters a new market segment before rivals and establishes brand dominance (Correct answer)
A company copies a competitor's feature set to match market expectations
A company releases a product after competitors to benefit from lessons learned
A company waits for regulatory clarity before launching a product

Correct answer: A company enters a new market segment before rivals and establishes brand dominance

First-mover advantage occurs when a company gains a significant market position by being the first to enter a new space.

Question 9: Which license type grants users the freedom to use, modify, and distribute software and its source code?

Shareware license
Proprietary license
Freeware license
Open source license (Correct answer)

Correct answer: Open source license

Open source licenses explicitly grant users rights to use, study, modify, and redistribute the software and its source code.

Question 10: Which stakeholder communication challenge is MOST commonly associated with large, multi-department software projects?

Overly simple reporting requirements
Too few stakeholders to manage
Information silos creating inconsistent project understanding across departments (Correct answer)
Stakeholders who always agree with the project manager

Correct answer: Information silos creating inconsistent project understanding across departments

Information silos occur when departments receive or interpret project information differently, leading to misaligned expectations, conflicting decisions, and coordination failures.

Question 11: What is the purpose of peer review in CSM professional practice?

To determine who should be promoted
To evaluate work quality through assessment by qualified colleagues and promote continuous improvement (Correct answer)
To create competition between colleagues
To reduce workload through delegation

Correct answer: To evaluate work quality through assessment by qualified colleagues and promote continuous improvement

Peer review provides objective quality assessment by qualified professionals, identifying areas for improvement, validating practices, and promoting professional accountability and continuous quality enhancement.

Question 12: Which of the following best describes 'active listening' in stakeholder meetings?

Taking detailed notes without engaging with the speaker
Asking multiple questions simultaneously to gather information quickly
Fully concentrating, understanding, and responding thoughtfully to the stakeholder (Correct answer)
Preparing your response while the stakeholder is speaking

Correct answer: Fully concentrating, understanding, and responding thoughtfully to the stakeholder

Active listening involves full engagement with the speaker, including understanding their message, asking clarifying questions, and responding in a way that confirms comprehension.

Question 13: What is the purpose of peer review in CSM professional practice?

To determine who should be promoted
To create competition between colleagues
To reduce workload through delegation
To evaluate work quality through assessment by qualified colleagues and promote continuous improvement (Correct answer)

Correct answer: To evaluate work quality through assessment by qualified colleagues and promote continuous improvement

Question 14: In software project management, what is a 'sprint' most closely associated with?

A time-boxed iteration in Agile/Scrum methodology (Correct answer)
An emergency project schedule compression
A performance benchmark test run
A rapid deployment of a hotfix to production

Correct answer: A time-boxed iteration in Agile/Scrum methodology

A sprint is a fixed-length iteration (typically 1-4 weeks) in Scrum where a usable product increment is delivered.

Question 15: Which Agile scaling framework uses a 'Program Increment' (PI) as its primary planning timebox?

LeSS (Large-Scale Scrum)
Disciplined Agile Delivery
Nexus
SAFe (Scaled Agile Framework) (Correct answer)

Correct answer: SAFe (Scaled Agile Framework)

SAFe uses Program Increments, typically 8–12-week planning windows that align multiple Agile teams around a shared mission.

Question 16: What is a Service Level Agreement (SLA) in the context of vendor management?

A contract defining the scope of work and payment terms
A vendor's internal quality management document
An agreement about employee benefits for contracted staff
A formal agreement specifying the expected level of service, metrics, and remedies for non-compliance (Correct answer)

Correct answer: A formal agreement specifying the expected level of service, metrics, and remedies for non-compliance

An SLA defines measurable service standards (e.g., uptime, response times), reporting requirements, and penalties or remedies if the vendor fails to meet those standards.

Question 17: Which vulnerability in web applications occurs when unsanitized user input is executed as script in another user's browser?

XML External Entity (XXE)
SQL injection
Cross-Site Scripting (XSS) (Correct answer)
Server-Side Request Forgery (SSRF)

Correct answer: Cross-Site Scripting (XSS)

XSS injects malicious client-side scripts into web pages viewed by other users, enabling session hijacking, defacement, or malicious redirects.

Question 18: A software manager must communicate a significant project delay caused by a vendor failure. Which communication sequence is MOST appropriate?

Send a group announcement to all stakeholders simultaneously without a plan
Wait until a revised schedule is finalized before informing any stakeholders
Notify senior stakeholders and the sponsor first, then communicate to broader stakeholders with a recovery plan (Correct answer)
Inform the project team last to prevent premature concern

Correct answer: Notify senior stakeholders and the sponsor first, then communicate to broader stakeholders with a recovery plan

Senior stakeholders and sponsors should be informed first so they are prepared for escalations; subsequent broader communication should include a recovery plan to maintain confidence.

Question 19: Which technique is used to estimate the effort required to build each feature in the Agile framework, relying on collective team judgment rather than individual expert opinion?

Parametric Estimation
COCOMO II
Planning Poker (Correct answer)
Function Point Analysis

Correct answer: Planning Poker

Planning Poker uses consensus-based estimation where all team members simultaneously reveal their estimates using cards, promoting discussion and shared understanding.

Question 20: A manager is choosing between mutually exclusive software architecture options with different risk profiles. Which framework explicitly separates probability of occurrence from impact severity?

Force field analysis
Decision matrix with weighted criteria
SWOT analysis
Risk probability and impact matrix (Correct answer)

Correct answer: Risk probability and impact matrix

The risk probability and impact matrix maps each risk on two independent axes — likelihood of occurrence and severity of consequence.

Question 21: A software team consistently misses deadlines despite individual members appearing productive. What management issue does this MOST likely indicate?

Insufficient technical skill in the team
Lack of formal documentation
Poor integration and coordination between team members (Correct answer)
Inadequate hardware resources

Correct answer: Poor integration and coordination between team members

Individual productivity without team coordination causes integration failures and missed deadlines; this is a systemic team management problem, not an individual skill gap.

Question 22: In a stakeholder communication plan, what does 'communication frequency' refer to?

The priority level of each stakeholder
How often each stakeholder receives project updates (Correct answer)
The number of words in each message
The technical channels used to send information

Correct answer: How often each stakeholder receives project updates

Communication frequency specifies how often particular stakeholders receive updates, such as weekly status reports or monthly executive summaries.

Question 23: When managing a geographically distributed software team across multiple time zones, which practice is MOST critical for maintaining cohesion?

Establishing clear communication protocols and overlapping core hours (Correct answer)
Requiring all team members to work the same hours
Limiting communication to email only to create an audit trail
Assigning all critical tasks to the team in the manager's time zone

Correct answer: Establishing clear communication protocols and overlapping core hours

Clear protocols and defined overlapping hours ensure all distributed team members can collaborate effectively without requiring unreasonable schedule changes.

Question 24: When a software project enters a critical phase, a manager shifts from a participative to a more directive style. This adaptation is BEST described by which theory?

Trait Theory of Leadership
Path-Goal Theory
Transformational Leadership Theory
Situational Leadership Theory (Correct answer)

Correct answer: Situational Leadership Theory

Situational Leadership Theory (Hersey & Blanchard) prescribes adapting leadership style based on the task maturity and readiness of team members in each specific situation.

Question 25: A software manager applies the 'five whys' technique to a production outage. What is the primary goal of this technique?

To generate five possible causes ranked by probability
To assign blame to the team member who caused the outage
To identify the root cause by iteratively asking why an event occurred (Correct answer)
To document the outage for compliance reporting purposes

Correct answer: To identify the root cause by iteratively asking why an event occurred

The five whys technique drills down to the systemic root cause of a problem by repeatedly asking 'why' until no deeper cause exists.

Question 26: What is the primary purpose of a stakeholder influence/interest matrix (power-interest grid)?

To prioritize stakeholder engagement efforts based on their power and level of interest (Correct answer)
To rank stakeholders by their salary level
To track stakeholder meeting attendance
To determine which stakeholders should be removed from the project

Correct answer: To prioritize stakeholder engagement efforts based on their power and level of interest

The power-interest grid helps managers allocate engagement effort appropriately, giving high attention to stakeholders with both high power and high interest.

Question 27: A CSM is reviewing a process where developers examine each other's code for defects. This is best described as:

Pair programming
Code walkthrough
Peer code review (Correct answer)
Static analysis

Correct answer: Peer code review

Peer code review is a static testing technique where developers inspect each other's code to find defects before execution.

Question 28: In software asset management, 'End of Life' (EOL) means:

The process of uninstalling software from all systems
The date a software application is first deployed
The date after which a vendor provides no further updates, patches, or support (Correct answer)
The time when a software license must be renewed

Correct answer: The date after which a vendor provides no further updates, patches, or support

EOL is the vendor-designated date after which a software product no longer receives security patches, updates, or technical support.

Question 29: Which risk response strategy involves shifting the negative impact of a risk to a third party?

Mitigate
Transfer (Correct answer)
Avoid
Accept

Correct answer: Transfer

Transferring risk shifts the financial impact or ownership to a third party, such as through insurance or outsourcing.

Question 30: Schedule compression technique 'crashing' involves which of the following?

Adding resources to critical path activities to reduce duration (Correct answer)
Overlapping sequential activities to shorten duration
Re-sequencing activities to eliminate float
Removing non-critical activities from the project plan

Correct answer: Adding resources to critical path activities to reduce duration

Crashing adds resources (and cost) to critical path activities to shorten the project schedule.

Question 31: A software manager is preparing communication for a technically diverse stakeholder group that includes both developers and business executives. What is the best approach?

Tailor communication content and format separately for technical and non-technical audiences (Correct answer)
Limit communication to the most senior stakeholder who can relay information to others
Create a single standardized report for all stakeholders to ensure consistency
Ask all stakeholders to improve their technical literacy

Correct answer: Tailor communication content and format separately for technical and non-technical audiences

Tailoring communication ensures that developers receive technical details they need while executives receive business-level summaries, maximizing relevance and comprehension for each audience.

Question 32: A software manager wants to delegate a task to a team member. Which factor is LEAST relevant when choosing who to delegate to?

The team member's relevant skill set
The team member's interest in developing the skill
The team member's current workload
The team member's physical office location (Correct answer)

Correct answer: The team member's physical office location

Physical location is largely irrelevant to delegation decisions in modern software teams; workload, skills, and developmental interest are the primary considerations.

Question 33: Which U.S. federal law primarily governs the privacy and security of protected health information (PHI) in software systems used by healthcare providers?

FERPA
COPPA
GLBA
HIPAA (Correct answer)

Correct answer: HIPAA

HIPAA (Health Insurance Portability and Accountability Act) establishes national standards for protecting PHI in healthcare-related software and systems.

Question 34: A team's velocity drops 30% after two senior engineers rotate off a Scrum project. The BEST short-term response for the CSM is to:

Increase sprint length to compensate
Cancel the current sprint and restart planning
Replace the engineers immediately before the next sprint
Re-baseline the project schedule with updated velocity (Correct answer)

Correct answer: Re-baseline the project schedule with updated velocity

Re-baselining with the new, realistic velocity gives stakeholders an accurate forecast rather than committing to unachievable targets.

Question 35: A company requires all software changes to be reviewed and approved by a separate team before deployment. This is an example of which control type?

Detective control
Corrective control
Compensating control
Preventive control (Correct answer)

Correct answer: Preventive control

A preventive control stops an undesirable event from occurring; requiring change approval before deployment prevents unauthorized or flawed code from reaching production.

Question 36: How can project managers optimize resource allocation?

By reducing the number of resources required.
By overworking resources to meet deadlines.
By carefully balancing resource availability and task importance (Correct answer)
By assigning resources randomly.

Correct answer: By carefully balancing resource availability and task importance

Project managers optimize resource allocation by strategically matching available resources with the most critical tasks, considering both skill sets and workload capacity. This involves prioritizing tasks, identifying potential resource conflicts, and making informed decisions to ensure that key deliverables are met without over-burdening or under-utilizing team members. Balancing these factors leads to efficient project execution and timely completion.

Question 37: What is 'license harvesting' in the context of software asset management?

Distributing licenses to newly hired employees
Purchasing discounted licenses in bulk
Automatically generating software license keys
Reclaiming unused licenses from retired systems for reuse (Correct answer)

Correct answer: Reclaiming unused licenses from retired systems for reuse

License harvesting involves recovering unused software licenses from decommissioned or underutilizing systems and reassigning them to active users, reducing procurement costs.

Question 38: Which of the following is a best practice for secure software development?

Ignoring security risks in the development phase.
Following secure coding practices and performing regular security assessments (Correct answer)
Only testing the software after the final release.
Writing code without considering security vulnerabilities.

Correct answer: Following secure coding practices and performing regular security assessments

Best practices for secure software development integrate security throughout the entire Software Development Lifecycle (SDLC). This includes training developers in secure coding practices to prevent common vulnerabilities from being introduced. Additionally, performing regular security assessments, such as penetration testing and vulnerability scanning, helps identify and remediate flaws before deployment, ensuring a more resilient and secure application.

Question 39: In resource planning, a histogram showing resource demand versus availability over time is called a:

Resource histogram (Correct answer)
Responsibility assignment matrix
Gantt chart
Network diagram

Correct answer: Resource histogram

A resource histogram visually displays resource demand versus capacity over time, making over-allocation and under-utilization immediately apparent.

Question 40: Which stakeholder engagement level describes a stakeholder who is aware of the project but not supportive or resistant?

Unaware
Supportive
Resistant
Neutral (Correct answer)

Correct answer: Neutral

A neutral stakeholder knows about the project and its impacts but is neither actively supporting nor opposing it.

Question 41: A software manager uses Monte Carlo simulation to estimate project completion dates. What is the primary advantage over a single-point estimate?

It produces a probability distribution of outcomes rather than one deterministic date (Correct answer)
It guarantees the project will finish within the simulated range
It eliminates the need for expert judgment in planning
It reduces the number of risk events that need to be tracked

Correct answer: It produces a probability distribution of outcomes rather than one deterministic date

Monte Carlo simulation runs thousands of iterations with varied inputs to produce a probability distribution showing the likelihood of different completion dates.

Question 42: In qualitative risk analysis, risks are assessed based on:

Statistical models and Monte Carlo simulations
Earned value metrics
Subjective judgment of probability and impact (Correct answer)
Net present value calculations

Correct answer: Subjective judgment of probability and impact

Qualitative risk analysis uses expert judgment and descriptive scales (e.g., high/medium/low) rather than numerical data.

Question 43: A manager wants to increase intrinsic motivation among software developers. Which approach aligns with Herzberg's Two-Factor Theory?

Providing free lunches and parking
Increasing base salary by 15%
Offering more challenging and meaningful work assignments (Correct answer)
Installing a ping-pong table in the office

Correct answer: Offering more challenging and meaningful work assignments

Herzberg identified achievement, recognition, and meaningful work as motivators (intrinsic), while salary and perks are hygiene factors that prevent dissatisfaction but don't motivate.

Question 44: Which approach to software quality focuses on preventing defects rather than detecting them after the fact?

Quality Control (QC)
Root Cause Analysis
Quality Assurance (QA) (Correct answer)
Defect Triage

Correct answer: Quality Assurance (QA)

Quality Assurance is a proactive, process-oriented approach aimed at preventing defects by improving development processes.

Question 45: In a software organization, the concept of 'psychological safety' primarily enables teams to:

Follow strict security protocols without question
Prioritize documentation over rapid delivery
Avoid all forms of conflict in team meetings
Speak up, take risks, and report mistakes without fear of punishment (Correct answer)

Correct answer: Speak up, take risks, and report mistakes without fear of punishment

Psychological safety, as defined by Amy Edmondson, is the belief that one will not be punished for speaking up, which is critical for innovation and learning.

Question 46: In risk management, what does a 'risk appetite' statement define?

The budget allocated for security controls
The maximum number of vulnerabilities allowed in production code
The types of risks that must always be transferred to insurers
The level of risk an organization is willing to accept in pursuit of its objectives (Correct answer)

Correct answer: The level of risk an organization is willing to accept in pursuit of its objectives

Risk appetite articulates how much risk an organization is willing to tolerate, guiding decisions about which risks to mitigate, accept, or avoid.

Question 47: In project management, 'float' (also called slack) represents:

The difference between planned and actual costs
The overlap between two parallel activities
The maximum time an activity can be delayed without delaying the project finish (Correct answer)
The amount of budget reserve available

Correct answer: The maximum time an activity can be delayed without delaying the project finish

Float is the amount of time a task can be delayed without affecting the project's critical path or end date.

Question 48: What does the 'pesticide paradox' in software testing warn against?

Repeating the same tests, which stops finding new defects (Correct answer)
Over-relying on formal inspections
Using automated tests exclusively
Testing too early in the development cycle

Correct answer: Repeating the same tests, which stops finding new defects

The pesticide paradox states that running the same tests repeatedly will eventually stop finding new bugs, requiring tests to be updated.

Question 49: A tester uses boundary value analysis on a field accepting ages 18–65. Which values should be tested?

17, 18, 65, 66 (Correct answer)
20, 40, 60
18, 65 only
18, 41, 65

Correct answer: 17, 18, 65, 66

Boundary value analysis tests the values at and just outside the boundaries: 17 (below), 18 (lower bound), 65 (upper bound), and 66 (above).

Question 50: In Kanban methodology, what is the purpose of setting a Work-in-Progress (WIP) limit?

To prevent overloading the system and expose bottlenecks in the workflow (Correct answer)
To cap the budget allocated to active development tasks
To limit the total number of features delivered per quarter
To restrict the number of team members who can work simultaneously

Correct answer: To prevent overloading the system and expose bottlenecks in the workflow

WIP limits prevent teams from starting too many tasks at once, making bottlenecks visible and promoting a smoother flow of work.

Question 51: Vroom's Expectancy Theory of motivation suggests that employee motivation is highest when:

Rewards are distributed equally regardless of performance
Employees believe effort leads to performance, which leads to valued rewards (Correct answer)
Pay is the only reward offered
Managers set goals without employee input

Correct answer: Employees believe effort leads to performance, which leads to valued rewards

Vroom's theory holds that motivation results from the combination of Expectancy (effort→performance), Instrumentality (performance→outcome), and Valence (value of the outcome).

Question 52: Which of the following BEST describes a 'strategic inflection point' in the software industry?

A scheduled quarterly business review
A regulatory compliance deadline
A fundamental shift in the industry that dramatically changes competitive dynamics (Correct answer)
A mid-project scope change request

Correct answer: A fundamental shift in the industry that dramatically changes competitive dynamics

A strategic inflection point (coined by Andy Grove) is a moment when a fundamental change in the business environment forces a significant strategic response.

Question 53: What is the key purpose of conducting a vendor risk assessment before signing a software contract?

To negotiate a lower contract price
To evaluate the vendor's marketing materials
To identify potential risks (financial, security, operational) the vendor poses to the organization (Correct answer)
To determine how many developers the vendor employs

Correct answer: To identify potential risks (financial, security, operational) the vendor poses to the organization

A vendor risk assessment identifies and evaluates threats from the vendor relationship—such as data breach risk, business continuity risk, and regulatory exposure—before commitment.

Question 54: A CSM is implementing Continuous Integration (CI). How does CI primarily support quality assurance?

By automatically building and testing code with each commit to catch defects early (Correct answer)
By replacing the test plan with automated documentation
By scheduling weekly releases to reduce defect frequency
By eliminating the need for manual testing entirely

Correct answer: By automatically building and testing code with each commit to catch defects early

CI integrates code frequently and runs automated tests on each commit, enabling early detection of integration defects.

Question 55: In project procurement, what type of contract places the MOST financial risk on the buyer?

Fixed Price (FP)
Time and Material (T&M)
Cost Plus Fixed Fee (CPFF) (Correct answer)
Fixed Price Incentive Fee (FPIF)

Correct answer: Cost Plus Fixed Fee (CPFF)

In Cost Plus contracts, the buyer reimburses all allowable costs plus a fee, so cost overruns are absorbed by the buyer, placing maximum risk on them.

Question 56: A software team uses static application security testing (SAST) tools. At what stage of the SDLC is SAST MOST effectively applied?

During user acceptance testing
During the coding and build phase (Correct answer)
During production deployment
After a security audit

Correct answer: During the coding and build phase

SAST analyzes source code or binaries without executing the program, making it most effective during development and build phases to catch issues early.

Question 57: In software governance, a 'policy exception' process is used when:

A policy is found to be outdated and needs revision
An employee violates a policy and requires disciplinary action
A vendor fails to meet contractual security requirements
A business need requires deviation from an established policy temporarily (Correct answer)

Correct answer: A business need requires deviation from an established policy temporarily

A policy exception process provides a formal, documented mechanism for granting temporary deviations from policy when business necessity requires it, with defined compensating controls.

Question 58: In DSDM (Dynamic Systems Development Method), which principle states that quality and scope are fixed but time and resources may vary?

Deliver on Time
Develop Iteratively
Never Compromise Quality (Correct answer)
Build Incrementally from Firm Foundations

Correct answer: Never Compromise Quality

DSDM's 'Never Compromise Quality' principle means the fitness-for-purpose level is set early and fixed, so scope is reduced rather than quality degraded when deadlines approach.

Question 59: A software manager discovers that a third-party vendor has access to customer PII but has not signed a Data Processing Agreement (DPA). Under GDPR, what is the immediate required action?

Terminate the vendor contract immediately
Execute a DPA before any further data processing (Correct answer)
Encrypt all data shared with the vendor
Report the vendor to the supervisory authority

Correct answer: Execute a DPA before any further data processing

GDPR Article 28 requires a written DPA to be in place before a processor can lawfully handle personal data on behalf of a controller.

Question 60: A software manager purchases cybersecurity insurance to cover losses from a potential data breach. This is an example of:

Risk acceptance
Risk transference (Correct answer)
Risk avoidance
Risk mitigation

Correct answer: Risk transference

Purchasing insurance transfers the financial consequences of a risk to a third party (the insurer).

Question 61: Which cryptographic concept ensures that a sender cannot later deny having sent a message?

Availability
Integrity
Non-repudiation (Correct answer)
Confidentiality

Correct answer: Non-repudiation

Non-repudiation uses digital signatures or audit logs to provide proof of origin, preventing a sender from denying their actions.

Question 62: What is the first step in risk management for software security?

Encrypting all data immediately.
Fixing defects after the software is released.
Identifying potential threats and vulnerabilities (Correct answer)
Ignoring minor security risks.

Correct answer: Identifying potential threats and vulnerabilities

The initial and most crucial step in risk management for software security is to thoroughly identify all potential threats and vulnerabilities that could impact the software system. This involves understanding what assets need protection, what risks they face, and what weaknesses exist in the system. Without this foundational understanding, effective risk assessment and mitigation strategies cannot be developed.

Question 63: Which quality model defines characteristics such as functionality, reliability, usability, efficiency, maintainability, and portability?

ISO/IEC 9126 (Correct answer)
Six Sigma DMAIC
CMMI
IEEE 829

Correct answer: ISO/IEC 9126

ISO/IEC 9126 is a software quality model that defines six major quality characteristics for evaluating software products.

Question 64: What is vendor lock-in, and why is it a concern for software managers?

Excessive dependency on a single vendor's proprietary technology, making switching costly and difficult (Correct answer)
A pricing model where costs are locked in for a fixed multi-year term
A security control that restricts vendor access to sensitive systems
A legal clause that prevents a vendor from working with competitors

Correct answer: Excessive dependency on a single vendor's proprietary technology, making switching costly and difficult

Vendor lock-in occurs when proprietary formats, APIs, or platforms make it technically or financially prohibitive to switch vendors, reducing bargaining power and increasing long-term risk.

Question 65: A software manager is coaching an underperforming developer. Which coaching model uses the sequence: Goal, Reality, Options, Will (Way forward)?

ADDIE model
GROW model (Correct answer)
SBI model
SMART model

Correct answer: GROW model

The GROW model is a structured coaching framework that guides coachees from goal-setting through reality assessment, option exploration, and commitment to action.

Question 66: A software manager is analyzing team velocity over 10 sprints. The median velocity is significantly lower than the mean. What does this suggest about the data distribution?

The distribution is negatively skewed with low outliers
The distribution has no outliers and is uniform
The distribution is symmetric and normally distributed
The distribution is positively skewed with high-velocity outliers (Correct answer)

Correct answer: The distribution is positively skewed with high-velocity outliers

When the mean exceeds the median, a few high values are pulling the mean up, indicating a right (positive) skew.

Question 67: In equivalence partitioning, what is a valid equivalence class for a field accepting values 1–100?

Values 50–75 only
Values above 100
Value exactly 50
Values 1–100 (Correct answer)

Correct answer: Values 1–100

A valid equivalence class contains values that are expected to be processed correctly, so 1–100 represents the valid partition.

Question 68: In software asset management, 'license entitlement' refers to:

The process of testing software functionality before deployment
The rights to use software as granted by the license agreement (Correct answer)
A volume discount provided by software vendors
The total number of software applications currently installed

Correct answer: The rights to use software as granted by the license agreement

License entitlement defines the specific rights granted to an organization under a license agreement, including permitted use, number of installations, and geographic scope.

Question 69: Under the NIST Cybersecurity Framework (CSF), which core function focuses on detecting the occurrence of a cybersecurity event?

Identify
Detect (Correct answer)
Respond
Protect

Correct answer: Detect

The Detect function of the NIST CSF focuses on developing and implementing activities to identify the occurrence of a cybersecurity event in a timely manner.

Question 70: User Acceptance Testing (UAT) is BEST described as testing performed by:

Third-party security auditors
End users or clients to validate the system meets business needs (Correct answer)
Developers before code is committed
QA engineers in a lab environment

Correct answer: End users or clients to validate the system meets business needs

UAT is conducted by end users or clients to ensure the system satisfies real-world business requirements before go-live.

Question 71: A software manager wants to measure the effectiveness of stakeholder communications. Which metric is MOST directly relevant?

Size of the distribution list for status reports
Number of emails sent per week
Stakeholder satisfaction scores gathered through surveys or feedback sessions (Correct answer)
Total hours spent in meetings

Correct answer: Stakeholder satisfaction scores gathered through surveys or feedback sessions

Stakeholder satisfaction scores directly measure whether communications are meeting stakeholder needs, unlike activity-based metrics that measure volume rather than impact.

Question 72: A software manager must choose between two risk mitigation strategies. Strategy A has a 70% chance of saving $200K and Strategy B has a 40% chance of saving $400K. Based purely on expected value, which is preferred?

Strategy B ($160K expected value) (Correct answer)
Strategy A ($140K expected value)
Neither can be evaluated without standard deviation data
Both are equal in expected value

Correct answer: Strategy B ($160K expected value)

Strategy B's expected value is 0.40 × $400K = $160K, which exceeds Strategy A's 0.70 × $200K = $140K.

Question 73: A risk register entry shows a vulnerability with LOW likelihood but HIGH impact. How should a software manager prioritize it?

Monitor it and plan contingency measures (Correct answer)
Transfer it without further analysis
Immediately assign maximum resources to eliminate it
Ignore it since the likelihood is low

Correct answer: Monitor it and plan contingency measures

Low-likelihood, high-impact risks warrant monitoring and contingency planning rather than immediate full-scale mitigation.

Question 74: A CSM candidate is analyzing a software project with a Cost Performance Index (CPI) of 0.82. What does this indicate?

The project is 18% under budget
The project is 18% ahead of schedule
The project is receiving $0.82 in value for every $1.00 spent (Correct answer)
The project will finish 18% early

Correct answer: The project is receiving $0.82 in value for every $1.00 spent

A CPI below 1.0 means the project is over budget; a CPI of 0.82 means only $0.82 of planned value is being earned per dollar spent.

Question 75: Which document formally authorizes a project and grants the project manager authority to apply organizational resources?

Business Case
Project Management Plan
Statement of Work
Project Charter (Correct answer)

Correct answer: Project Charter

The Project Charter formally authorizes the project and gives the project manager authority to use organizational resources.

Question 76: A software manager reviews the Estimate to Complete (ETC) for a project. The ETC is BEST defined as:

The expected cost to finish all remaining project work from the current date (Correct answer)
The total amount already spent on the project
The difference between the budget at completion and the cost baseline
The sum of all approved change requests to date

Correct answer: The expected cost to finish all remaining project work from the current date

ETC is the forecasted cost required to complete all work not yet performed, used with Actual Cost (AC) to calculate the Estimate at Completion (EAC = AC + ETC).

Question 77: What does the 'integrity' component of the CIA triad ensure in software security?

Data is backed up and recoverable
Data is protected from unauthorized disclosure
Data remains accurate and unaltered by unauthorized parties (Correct answer)
Data is accessible to authorized users when needed

Correct answer: Data remains accurate and unaltered by unauthorized parties

Integrity ensures that data and systems are accurate and have not been improperly modified by unauthorized users or processes.

Question 78: A software manager discovers that a key stakeholder has been receiving status reports but never reads them. What is the most appropriate response?

Continue sending reports as documentation
Escalate the issue to senior management
Discontinue all reporting to that stakeholder
Schedule a meeting to understand their preferred communication format (Correct answer)

Correct answer: Schedule a meeting to understand their preferred communication format

Understanding a stakeholder's preferred communication style and format is essential to ensuring information is actually received and acted upon.

Question 79: A CSM is managing a software project where a critical vendor will deliver an API 3 weeks late. This event was identified in the risk register. What should the CSM execute first?

Implement the pre-planned risk response strategy (Correct answer)
Conduct a new risk assessment
Issue a change request to extend the deadline
Escalate to the project sponsor immediately

Correct answer: Implement the pre-planned risk response strategy

When a known risk occurs, the first action is to implement the pre-planned risk response, as it was designed specifically for this scenario.

Question 80: Which data quality dimension measures the degree to which data correctly represents the real-world entities or events it describes?

Consistency
Accuracy (Correct answer)
Completeness
Timeliness

Correct answer: Accuracy

Accuracy (also called validity) measures how well data represents the true state of the real-world entities being modeled.

Question 81: In the context of strategic planning, what does 'competitive parity' mean for a software organization?

Matching competitors' capabilities to avoid disadvantage (Correct answer)
Ignoring competitor benchmarks entirely
Exceeding competitors in all capabilities
Acquiring competitors to eliminate rivalry

Correct answer: Matching competitors' capabilities to avoid disadvantage

Competitive parity means achieving at least the same level of performance as competitors so the organization is not at a strategic disadvantage.

Question 82: In CSM practice, what is the purpose of a standard operating procedure (SOP)?

To restrict employee creativity
To satisfy management preferences only
To create unnecessary paperwork
To document step-by-step instructions for routine tasks to ensure consistency and quality (Correct answer)

Correct answer: To document step-by-step instructions for routine tasks to ensure consistency and quality

SOPs provide standardized, detailed instructions for routine operations, ensuring consistency, quality, efficiency, and safety regardless of which qualified individual performs the task.

Question 83: Which testing level verifies that separately developed software modules work correctly when combined?

Integration testing (Correct answer)
Acceptance testing
Unit testing
System testing

Correct answer: Integration testing

Integration testing focuses on the interactions and interfaces between modules or components after unit testing.

Question 84: The 'cost of poor quality' (COPQ) framework categorizes quality costs into four types. Which pair represents costs incurred AFTER a product reaches the customer?

External failure costs and warranty costs (Correct answer)
Appraisal costs and internal failure costs
Internal failure costs and prevention costs
Prevention costs and appraisal costs

Correct answer: External failure costs and warranty costs

External failure costs and warranty costs are incurred after delivery, including field defect repairs, recalls, and customer support.

Question 85: In vendor contract negotiations, what is an 'escrow agreement' for software source code?

A software licensing agreement for on-premise deployment
An arrangement where source code is held by a neutral third party and released to the client if the vendor fails (Correct answer)
A payment plan where funds are held by a neutral third party until deliverables are accepted
A clause that limits the vendor's liability for source code defects

Correct answer: An arrangement where source code is held by a neutral third party and released to the client if the vendor fails

A source code escrow agreement protects the client by having a third party hold the vendor's source code, releasing it to the client if the vendor goes bankrupt or ceases to support the product.

Question 86: In the context of software project stakeholder relations, what does 'managing up' refer to?

Reporting project issues directly to the board without the sponsor's knowledge
Effectively communicating with and influencing senior executives and sponsors above the manager's level (Correct answer)
Increasing the number of management layers in the project
Delegating tasks upward to avoid team overload

Correct answer: Effectively communicating with and influencing senior executives and sponsors above the manager's level

Managing up involves strategically communicating with senior stakeholders, framing information to gain their support, address concerns, and secure resources needed for project success.

Question 87: A software manager is establishing a Vendor Risk Management (VRM) program. Which control is considered the minimum baseline for fourth-party risk (vendors of vendors)?

Requiring primary vendors to contractually flow down security requirements to their subcontractors (Correct answer)
Prohibiting primary vendors from using any subcontractors
Obtaining SOC 2 reports from all fourth-party vendors directly
Conducting annual on-site audits of all subcontractors

Correct answer: Requiring primary vendors to contractually flow down security requirements to their subcontractors

Requiring primary vendors to flow down security and compliance obligations to their subcontractors is the foundational fourth-party risk control, as direct auditing of all subcontractors is impractical.

Question 88: Why is it important to prioritize resources in a project?

It reduces the need for collaboration.
It allows for ignoring resource constraints.
It ensures that the most important tasks are completed first (Correct answer)
It reduces project costs.

Correct answer: It ensures that the most important tasks are completed first

Prioritizing resources means allocating them strategically to the tasks that are most critical for the project's success or those with the highest impact. This ensures that essential deliverables are addressed promptly, even if resource availability is limited. By focusing resources on high-priority items, project managers can mitigate risks and keep the project aligned with its core objectives.

Question 89: What risk management concept describes the maximum tolerable downtime for a critical software system before business impact becomes unacceptable?

Recovery Time Objective (RTO) (Correct answer)
Recovery Point Objective (RPO)
Mean Time Between Failures (MTBF)
Service Level Agreement (SLA)

Correct answer: Recovery Time Objective (RTO)

RTO defines how quickly a system must be restored after a failure to avoid unacceptable business consequences.

Question 90: What is the main goal of regression testing after a software defect is fixed?

To evaluate system performance under load
To train new team members on the codebase
To document the defect in the defect tracking system
To ensure the fix did not introduce new defects in existing functionality (Correct answer)

Correct answer: To ensure the fix did not introduce new defects in existing functionality

Regression testing confirms that a bug fix or change has not broken previously working functionality.

Question 91: Which budgeting technique requires every expense to be justified from scratch each budget cycle, regardless of previous allocations?

Zero-based budgeting (Correct answer)
Incremental budgeting
Rolling-wave budgeting
Parametric budgeting

Correct answer: Zero-based budgeting

Zero-based budgeting starts from a 'zero base' each period, requiring managers to justify all expenditures anew rather than adjusting prior-year figures.

Question 92: In a risk register, which field records the planned actions to reduce a risk's probability or impact?

Risk status
Mitigation plan (Correct answer)
Risk owner
Risk trigger

Correct answer: Mitigation plan

The mitigation plan field documents the specific actions planned to reduce the probability or impact of the identified risk.

Question 93: Which technique involves breaking project scope into smaller, more manageable components to improve cost and schedule estimates?

Analogous estimating
Rolling wave planning
Parametric estimating
Work breakdown structure (WBS) decomposition (Correct answer)

Correct answer: Work breakdown structure (WBS) decomposition

WBS decomposition breaks deliverables into work packages, enabling more accurate bottom-up estimation of cost, duration, and resource needs.

Question 94: In CSM practice, what is evidence-based practice?

Integrating the best available research evidence with professional expertise and client needs (Correct answer)
Following only personal experience and intuition
Using only the newest methods regardless of evidence
Doing whatever the client requests

Correct answer: Integrating the best available research evidence with professional expertise and client needs

Evidence-based practice combines rigorous research evidence, professional clinical expertise, and client/patient preferences and values to make informed decisions that optimize outcomes.

Question 95: In the context of software team management, 'velocity' as a metric BEST supports which management activity?

Evaluating individual developer performance
Assessing code quality and defect rates
Planning and forecasting future sprint capacity (Correct answer)
Determining salary adjustments

Correct answer: Planning and forecasting future sprint capacity

Velocity measures how much work a team completes per sprint, making it a reliable input for capacity planning and release forecasting rather than individual performance evaluation.

Question 96: A software project manager is told the project must finish by a fixed date regardless of scope. This is an example of which type of constraint?

Schedule constraint (Correct answer)
Resource constraint
Budget constraint
Quality constraint

Correct answer: Schedule constraint

A fixed end date regardless of scope represents a schedule constraint that restricts when the project must be completed.

Question 97: What is the difference between a regulation and a standard in CSM practice?

Standards are always stricter than regulations
Regulations apply only to individuals, standards to organizations
Regulations are legally binding requirements; standards are voluntary guidelines that may become regulatory through adoption (Correct answer)
They are exactly the same thing

Correct answer: Regulations are legally binding requirements; standards are voluntary guidelines that may become regulatory through adoption

Regulations are legally enforceable rules issued by government agencies, while standards are developed by industry bodies and are typically voluntary. However, standards often become de facto requirements through regulatory adoption or contractual obligations.

Question 98: In the context of software estimation, what does 'cone of uncertainty' represent?

The range of possible defect counts across different testing phases
The risk that requirements will change after sign-off
The decreasing range of estimate variability as a project progresses and more information becomes known (Correct answer)
The uncertainty about which team members will be assigned to the project

Correct answer: The decreasing range of estimate variability as a project progresses and more information becomes known

The Cone of Uncertainty illustrates that estimates at project inception can vary widely but converge toward accuracy as the project matures and unknowns are resolved.

Question 99: Which of the following BEST describes the purpose of a kick-off meeting in stakeholder communication?

To formally close out project documentation
To review lessons learned from previous projects
To align stakeholders on project goals, roles, timelines, and communication protocols from the outset (Correct answer)
To assign blame for past project failures

Correct answer: To align stakeholders on project goals, roles, timelines, and communication protocols from the outset

A kick-off meeting establishes shared understanding, sets expectations, and creates a foundation of alignment before project work begins.

Question 100: A software budget shows a favorable variance of $30,000 in the current period. How should the manager BEST interpret this?

Actual costs were $30,000 less than planned costs for the period (Correct answer)
The project is guaranteed to finish under budget
The team delivered $30,000 more work than scheduled
Planned value exceeded earned value by $30,000

Correct answer: Actual costs were $30,000 less than planned costs for the period

A favorable cost variance means actual spending came in below the budgeted amount for that period, though it does not guarantee the entire project will finish under budget.

Certified Software Manager (CSM) Exam

The Certified Software Manager (CSM) certification validates an individual's knowledge and skills in managing software projects and teams.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds