You must be able to design and select tests that prove security controls work, not just that features function. The single most important thing is choosing inputs and coverage criteria that reach the vulnerable code path, especially for authentication, session, and API token handling.
Start practicing
Secure Software Testing — choose a session length
Free · No account required
Domain overview
Secure Software Testing on the CSSLP exam covers how verification activities are planned, designed, and executed across the lifecycle: unit, integration, system, and acceptance testing, plus fuzzing, static and dynamic analysis, code review, and regression testing. Questions are scenario-based, asking you to select test coverage, design test cases for authentication and API security, and choose tooling inputs that maximize defect discovery.
Exam objectives
Selecting fuzzing inputs and harnesses that maximize code coverage for compiled applications
Designing test cases for authentication bypass, including credential handling, session state, and access control checks
Building API authentication tests covering token issuance, transport protection, and authorization enforcement
Configuring fuzzers to supply valid JSON Web Tokens and session artifacts to REST endpoints
Treating fuzzing as random input generation and ignoring seed corpora, dictionaries, and coverage feedback that drive real path discovery.
Testing only the happy-path login and omitting negative cases such as missing, malformed, expired, or replayed credentials and tokens.
Fuzzing authenticated APIs without valid tokens, so requests are rejected early and deeper business logic is never exercised.
Click any question to see the full explanation and answer options, or start a focused practice session above.
A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?
2A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?
3During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?
4A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?
5You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?
6When performing automated security testing, which of the following is considered a 'false positive'?
7When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?
8Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?
9When designing a test case for secure API authentication, which THREE elements should be included?
10Which TWO of the following practices are recommended when performing fuzz testing on a web service?
11Which THREE factors should be considered when prioritizing findings from a DAST scan?
12Which TWO of the following are common challenges when implementing IAST?
13Which TWO of the following represent common output formats for security testing reports?
14When designing a test case for a secure authentication bypass, which THREE areas should be covered?
15A security analyst is reviewing the results of a dynamic application security testing (DAST) scan against a REST API. The scan report includes several findings, but the analyst must prioritize remediation. Which two factors are most important to consider when triaging DAST findings for an API? (Choose two.)
16A software development team is adopting a secure software testing strategy. They want to ensure that security testing is performed continuously and that feedback is provided to developers as early as possible. Which testing approach best aligns with this goal?
17A security tester is performing interactive application security testing (IAST) on a Java web application. The IAST agent is deployed in the test environment and instruments the application during automated functional tests. The tester notices that the IAST tool reports a high number of false positives for SQL injection. What is the most likely cause of these false positives?
You must be able to design and select tests that prove security controls work, not just that features function. The single most important thing is choosing inputs and coverage criteria that reach the vulnerable code path, especially for authentication, session, and API token handling.
The Courseiva CSSLP question bank contains 17 questions in the Secure Software Testing domain. Click any question to see the full explanation and answer breakdown.
Start with a 10-question focused session to identify your baseline accuracy in this domain. Read every explanation — even for questions you answer correctly — to understand the reasoning. Once you score consistently above 80%, move to a 20–30 question session to confirm depth before moving to the next domain.
Yes — the session launcher on this page draws questions exclusively from the Secure Software Testing domain. Choose 10, 20, 30, or 50 questions for a focused session, or click individual questions to review them one by one.
Save your results, see per-domain analytics, and get readiness scores — free, for every certification.
Sign Up FreeFree forever · Every certification included