(ISC)² · Free Practice Questions · Last reviewed May 2026
48 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?
Perform a network vulnerability scan
Map the data flow of credit card information
Mapping the cardholder data flow traces credit card information from entry through storage, processing and transmission, exposing every system, network segment and third party that touches it. This directly satisfies PCI-DSS scoping, which defines scope by where cardholder data resides or transits, so the highest-security controls land on precisely those components.
Review the application source code
Update the firewall rule set
A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?
Document the risk and perform a formal risk assessment
Bypassing password complexity for internal testing accounts introduces an authentication weakness that may reach production. Documenting the risk and performing a formal risk assessment satisfies the CSSLP requirement to analyse and quantify security impact before accepting, mitigating or rejecting the stakeholder's request through governance.
Immediately reject the request
Update the password policy
Implement the bypass in dev only
When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?
GDPR
FISMA
HIPAA
HIPAA directly governs the handling of Protected Health Information in the United States, mandating administrative, physical and technical safeguards. Since the application processes PHI, its requirements must be captured during the requirements-gathering phase to ensure compliant data protection controls are designed in from the outset.
SOX
An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?
Threat Intelligence Feed
Change Request Log
Security Requirements Traceability Matrix (SRTM)
The SRTM maps each security requirement to its design, code and test artefacts, so the SMS-MFA prohibition for high-risk accounts is recorded and verifiably traced. This satisfies the stem's documentation need, unlike a general security policy or design document that lacks traceability linkage.
Project Charter
You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?
Non-functional security requirement
Encryption of service-to-service traffic constrains how the system behaves rather than what function it delivers, so it is a quality attribute, not a functional requirement. It specifies a security characteristic the microservices must exhibit, matching the non-functional category.
Functional requirement
Business rule
Use case description
During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?
The Software Requirements Specification (SRS)
The Software Requirements Specification captures functional and non-functional constraints that architects must design against. Documenting GDPR erasure obligations there satisfies the stem's requirement by ensuring deletion timelines and data lifecycle rules are traceable, testable requirements rather than informal assumptions discovered after design.
The Penetration Testing Report
The Infrastructure-as-Code (IaC) templates
The Risk Register
Want more Secure Software Requirements practice?
Practice this domainA developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?
Granting the application access to all system environment variables.
Using a dedicated service account with granular permissions for database access.
Least privilege requires granting only the permissions needed for a task. A dedicated service account with granular database permissions avoids shared, over-privileged credentials, limiting blast radius if compromised and satisfying the constraint that database access be scoped to exactly what the application requires.
Enabling 'Everyone' write access to application configuration files.
Running the application process as 'root' or 'administrator'.
A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?
Availability
Confidentiality
Hardcoded keys sit in source control, readable by anyone with repository access, so the secret is no longer restricted to authorised parties. That exposure breaches confidentiality, the property ensuring information is disclosed only to those permitted to see it.
Non-repudiation
Integrity
Accounting
In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?
Availability
Non-repudiation
Confidentiality
Authentication
Requiring the client_secret proves the token request originates from the legitimate registered client, not an interceptor holding a stolen code. This client authentication mechanism satisfies the stem by binding the code exchange to a verified identity.
Integrity
A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?
Software integrity
Service availability
System hardening
Secure architecture
Spoofing
In STRIDE, 'S' denotes Spoofing, which covers threats where an attacker impersonates a legitimate user, service, or system to gain unauthorised access. It is countered through authentication mechanisms that verify claimed identities before trust is granted.
Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?
Authorization
Encryption
Availability
Non-repudiation
Digital signatures bind the sender's private key to the message, so the signer cannot later deny authorship; this provides non-repudiation, proving origin and integrity to a third party. Confidentiality and authentication alone do not prevent the sender disputing the message.
Confidentiality
A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?
Non-repudiation
Integrity
Availability
Synchronous replication maintains a live duplicate of data, so service continues when the primary database fails. This directly satisfies the stem's requirement that data remain accessible despite server failure, which is the availability leg of the CIA triad rather than integrity or confidentiality.
Confidentiality
Want more Secure Software Concepts practice?
Practice this domainWhen performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?
Elevation of Privilege.
Tampering.
Information Disclosure.
Sniffing traffic exposes data in transit, so the STRIDE category breached is Information Disclosure. The threat targets confidentiality of the client-server communication channel, not integrity, availability or authentication, making Information Disclosure the matching classification for this eavesdropping scenario.
Spoofing.
When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?
System Architecture Diagram.
Software Security Policy (SSP).
A Software Security Policy establishes organisation-wide security expectations, making it the correct governance instrument. Unlike standards or procedures, which specify mandatory controls or step-by-step instructions, the SSP operates at a strategic level and applies across every development project, directly satisfying the stem's requirement for high-level expectations spanning all software work.
Individual Sprint Backlog.
Developer Coding Standards.
You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?
Enabling 'Secret scanning' and 'Push protection' in the repository settings.
GitHub's secret scanning detects committed credentials, and push protection blocks them before they reach the remote repository. This pre-commit interception satisfies the stem's DevSecOps requirement to prevent secrets from being committed, rather than detecting them only after exposure.
Writing a custom shell script to grep all files for common regex patterns.
Relying on developers to manually check for secrets before every push.
Configuring an external firewall to block all traffic containing API keys.
You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?
Storing artifacts in a public S3 bucket for easy access.
Deleting build artifacts immediately after the deployment to production.
Uploading artifacts to a shared developer network drive.
Using digital signatures to verify artifact integrity before deployment.
Signing artifacts with a private key lets Jenkins verify provenance and detect tampering after the build, so only artefacts whose signature validates are deployed. This satisfies the integrity constraint by binding the deployed binary to the trusted build rather than trusting storage or transport.
You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?
Implementing automated DAST tools.
Deploying a Web Application Firewall (WAF) to protect the current environment.
Performing a manual code review on all legacy source code.
Defining security requirements during the initial project planning/requirements phase.
Shift-left means security work migrates to the earliest lifecycle stage. Capturing security requirements during initial planning embeds controls before design and code exist, when change is cheapest, rather than retrofitting them during testing or operations in the legacy waterfall transition.
Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?
Project Manager.
Software Tester.
Security Architect.
The Security Architect translates business and compliance drivers into technical security requirements, threat models and control baselines early, before design is fixed. That forward-looking remit matches identifying security requirements during initial SDLC phases, unlike developers or testers who act later.
Database Administrator.
Want more Secure Software Lifecycle Management practice?
Practice this domainDuring an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?
Clear the application's cache to remove any temporary sensitive data.
Increase the logging level to 'DEBUG' to track the attacker's actions.
Change the password for the database user and update the application deployment manifest.
Exposed environment variables mean the database credential is compromised, so it must be rotated immediately by changing the password and updating the deployment manifest to distribute the new value. This invalidates the leaked credential before the attacker can reuse it.
Re-deploy the application using the same configuration to ensure a clean state.
To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?
Check the file timestamp using the operating system's file system metadata.
Upload the artifact to a public VirusTotal scan before deploying.
Compare the file size of the artifact with the size listed in the manifest file.
Verify the digital signature using a trusted public key from your organization's key store.
Verifying the artifact's digital signature with the organisation's trusted public key proves the build system signed those exact bytes; any tampering invalidates the signature. This satisfies the stem's integrity constraint, unlike checksums, which an attacker who alters the artifact could also recompute.
A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?
Enable the Kubernetes Audit Log and monitor for kubectl exec commands.
Configure PodSecurityPolicies to restrict the containers to non-root users.
Install a Service Mesh like Istio to enforce mTLS.
Apply a NetworkPolicy object that defines specific egress rules for the application namespace.
NetworkPolicy is Kubernetes' native pod-level firewall, and its egress rules restrict outbound connections by namespace and label selector. This directly satisfies the stem's constraint of limiting the microservice's anomalous outbound traffic to only known authorised endpoints, which security groups or service mesh policies cannot enforce at pod granularity.
Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?
Maintaining a consistent and hardened state across all environments.
Secure configuration management enforces baselines that keep development, test and production environments in an identical hardened state, eliminating drift that attackers exploit. This directly satisfies the stem's requirement for a primary objective: consistency across all environments, achieved through automated configuration enforcement rather than one-off manual hardening.
Reducing the total cost of ownership of the cloud infrastructure.
Ensuring that developers have administrative access to production databases.
Maximizing the number of features delivered in each release.
You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?
Configure a post-deployment notification to Slack using a webhook.
Manually verify image signatures using Docker Content Trust after deployment.
Enable Jenkins 'Build periodically' to scan images in the registry.
Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.
The Snyk plugin runs during the image build step, scanning layers for known vulnerabilities before the image is tagged and promoted. This gates the pipeline at the earliest point, satisfying the requirement to scan prior to production promotion.
When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?
Rename the state file to 'secret.tfstate' to hide it from attackers.
Store state files in a version-controlled Git repository for change tracking.
Use a remote backend like S3 with server-side encryption enabled and restricted IAM policies.
Terraform state files store resource attributes and secrets in plaintext, so a remote backend such as S3 with server-side encryption and tightly scoped IAM policies protects that data at rest and restricts who can read or alter it.
Manually delete the state file after every Terraform apply command.
Want more Secure Software Deployment Operations And Management practice?
Practice this domainWhen evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?
The vendor provides a static list of libraries once a year.
The vendor does not use any open-source software.
The vendor maintains a documented process for tracking and patching vulnerable components.
A documented tracking and patching process demonstrates repeatable, proactive vulnerability management rather than ad hoc reaction. This satisfies the stem's demand for the strongest indicator, since it evidences an ongoing capability to identify and remediate vulnerable components before exploitation.
The vendor uses only the newest versions of all libraries.
During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?
Software License Agreement (SLA)
SHA-256 checksum published on a text file
Vendor SOC 2 Type II report
Digital Signature (e.g., Authenticode or GPG)
A digital signature, such as Authenticode or GPG, is verified with the signer's public key to confirm the code's integrity and origin authenticity. This satisfies the stem's proof-of-signing requirement, unlike a hash alone, which detects alteration but does not establish who signed.
An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?
Rely on the developer's ability to check spelling.
Configure an allowlist-only proxy repository.
An allowlist-only proxy permits only explicitly approved package names and versions, so a typosquatted dependency is rejected at resolution time regardless of how similar its name appears. This directly blocks accidental inclusion, satisfying the stem's constraint.
Increase the frequency of penetration tests.
Enable two-factor authentication on developer accounts.
You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?
Snyk Open Source integration.
Snyk Open Source scans dependency manifests against a vulnerability database and fails the GitHub Actions job when high-severity issues are found, gating the build. This satisfies the automated policy requirement by blocking merges rather than merely reporting findings.
GitHub Projects.
Git LFS.
GitHub Pages.
Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?
Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.
Scoping the registry URL in .npmrc to your internal Artifactory or Nexus ensures npm resolves scoped packages only from the private registry, so a malicious public package with the same name cannot be substituted. This directly prevents the dependency confusion attack described in the stem.
Run 'npm audit fix' before every build process.
Add the dependency to the 'bundledDependencies' array in package.json.
Enable 'strict-ssl' in the global npm configuration.
You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?
To encrypt the source code repository.
To generate the final SBOM document.
To list all CVEs found in the dependencies.
To define the supply chain steps, actors, and expected artifacts.
The layout file is the signed root of trust in in-toto; it specifies the ordered supply chain steps, the functionaries authorised to perform each, and the artefacts each step must produce. Verification then checks link metadata against these defined expectations.
Want more Secure Software Supply Chain practice?
Practice this domainWhich cryptographic practice is recommended for protecting sensitive data at rest in a relational database?
Using cleartext with database permissions
Using MD5 hashing
Using AES-256 encryption
AES-256 is a symmetric block cipher providing strong confidentiality for stored data, satisfying the at-rest protection requirement. Its 256-bit key resists brute-force attacks, and it is the standard algorithm for database and volume encryption, unlike hashing or asymmetric ciphers suited to other purposes.
Storing data in base64 encoding
You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?
Using <%- %> tags for all variables
Disabling the template engine
Using <%= %> tags for user data
Using `<%= %>` escapes HTML entities before interpolation, neutralising injected markup so browsers treat user data as text rather than executable script. This directly satisfies the XSS mitigation requirement for EJS rendering, unlike `<%- %>`, which emits raw unescaped output and permits script injection.
Implementing a global regex filter
In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?
Set the Content-Type header to application/json
Use a stateless session strategy with no tokens
Configure the HttpSecurity object to require CSRF tokens
Spring Security's HttpSecurity CSRF configuration enforces synchroniser tokens on state-changing methods (POST, PUT, DELETE), rejecting requests lacking a valid token. This directly satisfies the stem's requirement to prevent CSRF on state-changing HTTP requests in the Spring Boot application.
Enable csrf().disable() in the SecurityFilterChain
A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?
Use Data Transfer Objects (DTOs) to restrict input
DTOs define an explicit allow-list of bindable properties, so the model binder cannot populate fields absent from the DTO. This directly blocks over-posting of sensitive attributes such as role or isAdmin, satisfying the requirement to prevent Mass Assignment during model binding.
Disable SSL on the API endpoint
Increase the request timeout
Store user passwords in plaintext
A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?
--ignore-cve
--exclude-all
--skip-analysis
--suppression
The --suppression flag accepts an XML file listing false-positive identifiers, causing Dependency-Check to omit those matches from reported findings. This directly satisfies the stem's constraint of ignoring specific false-positive vulnerabilities in a third-party library without disabling broader detection.
When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?
Database connection timeout
Business logic flaws
Buffer overflow
Static analysis engines model pointer arithmetic and array bounds, flagging writes beyond allocated buffers. Buffer overflow is a memory-safety defect detectable from source alone, unlike runtime-only faults, so Fortify or Coverity identify it during code review before compilation or execution.
Zero-day authentication bypass
Want more Secure Software Implementation practice?
Practice this domainYou are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?
Using a centralized regex filter to strip HTML tags.
Encrypting all user input before storing it in the database.
Performing context-aware output encoding at the presentation layer.
Context-aware output encoding neutralises injected markup at the exact point of rendering, matching each sink (HTML, attribute, JavaScript, URL). This defeats XSS regardless of how input bypassed earlier filtering, satisfying the presentation-layer defence the scenario requires.
Implementing a strict allow-list for all input fields.
An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?
Centralized database user management.
API Gateway pattern acting as an identity provider proxy.
An API Gateway terminates authentication centrally, validating tokens before routing to microservices, which then trust the gateway's assertions. This decouples identity logic from each service, satisfying the centralised-authentication requirement without embedding credentials handling in every microservice.
Service Mesh with mutual TLS enabled.
Sidecar pattern using a local proxy for mTLS.
When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?
Checking for SQL injection in login forms.
Reviewing the database schema for password hashing algorithms.
Verifying the presence of a Web Application Firewall (WAF).
Analyzing the implementation of HttpOnly and Secure flags on session cookies.
HttpOnly prevents client-side scripts from reading session cookies, while Secure restricts transmission to encrypted channels, so reviewing these flags directly exposes cookie theft and interception weaknesses. This inspection targets the exact session management controls the review must assess.
During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?
To identify which security controls and protection levels are required for specific data assets.
Classifying data sensitivity determines the protection level each asset warrants, driving selection of encryption, access control and handling requirements proportionate to impact. This satisfies the stem's goal of linking sensitivity classification to the controls and protection levels applied to specific data assets.
To identify the database engine version.
To automate the backup frequency of the database.
To determine which data needs to be deleted periodically.
In a cloud-native environment, which design practice minimizes the impact of a compromised container?
Storing secret keys as environment variables in the container spec.
Enforcing read-only root filesystems for containers.
A read-only root filesystem prevents an attacker who compromises a container from writing malware, altering binaries or persisting changes to the image layers. This contains the breach to the running container's ephemeral state, minimising impact within the cloud-native environment.
Running the application process as the root user.
Using a single large image for all microservices.
Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?
Allowing administrative access to all users by default.
Using self-signed certificates in the development environment only.
Disabling all unused services and ports in the production container image.
Disabling unused services and ports shrinks the attack surface, so nothing unnecessary listens for connections. This directly enforces secure-by-default: the production container image exposes only what the application genuinely requires, eliminating latent entry points attackers could exploit.
Providing a configuration wizard to enable SSL after deployment.
Want more Secure Software Architecture And Design practice?
Practice this domainA developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?
Configuring the fuzzer to use only random byte-flipping.
null
Running the fuzzer on a virtual machine without network access.
Instrumenting the code during compilation with afl-clang or afl-gcc.
AFL relies on compile-time instrumentation to insert coverage-tracking probes at basic blocks, feeding feedback to the fuzzer's queue. Without afl-clang or afl-gcc instrumentation, AFL falls back to blind fuzzing with no coverage signal, so high coverage demands instrumented binaries.
Providing the fuzzer with a binary that was stripped of all symbols.
A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?
null
Set the analysis mode to 'Incremental' only.
Increase the heap memory allocation for the JVM running the scanner.
Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.
Taint analysis is the primary mechanism for tracking data from sources to sinks in SAST.
Configure the 'Exclude' patterns to include all library dependencies.
During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?
Delete the record to prove the IDOR is exploitable.
Attempt to access resources associated with other users.
An IDOR means the application fails to enforce object-level authorisation, so the test must confirm whether another user's resources are reachable by manipulating the identifier. Attempting access to other users' objects directly validates the vulnerability and satisfies the stem's next-step requirement.
null
Report the finding immediately without further testing.
Run a full automated DAST scan against the entire application.
A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?
null
Changing the user agent header to a random string.
Injecting characters like single quotes (') and comments (--) into input fields.
Injecting quotes and comment markers directly exercises the parser's handling of untrusted input, satisfying the requirement for a test case that detects SQL injection resistance. Single quotes break string literals, while `--` truncates the remaining query, so unsanitised concatenation produces malformed SQL or altered logic, revealing the vulnerability.
Uploading a large file to test buffer overflow.
Adding a long string to an email field.
You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?
null
Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.
Injecting a fresh, valid JWT into the Authorization header before each request ensures the fuzzer reaches authenticated API logic rather than being rejected at the authentication layer. This satisfies the stem's constraint by exercising the endpoints under test with legitimate credentials throughout the campaign.
Use the same JWT throughout the entire fuzzing duration.
Exclude the Authorization header from the fuzzing target.
Disable authentication for the entire API during the test.
When performing automated security testing, which of the following is considered a 'false positive'?
The scanner reports a vulnerability that is not present in the application.
A false positive occurs when the scanner flags a vulnerability that does not actually exist in the application, wasting remediation effort. This contrasts with a false negative, where a genuine flaw goes undetected, making the reported-but-absent condition the defining characteristic.
The scanner misses an existing vulnerability.
The scanner causes the application to crash.
The scanner reports a vulnerability that is already fixed.
null
Want more Secure Software Testing practice?
Practice this domainThe CSSLP exam has 125 questions and must be completed in 180 minutes. The passing score is 700 out of 1,000. Always confirm current details on the vendor's official exam page.
Scenario questions on secure software concepts, requirements, design, implementation, testing, and supply chain risk management.
The exam covers 8 domains: Secure Software Requirements, Secure Software Concepts, Secure Software Lifecycle Management, Secure Software Deployment Operations And Management, Secure Software Supply Chain, Secure Software Implementation, Secure Software Architecture And Design, Secure Software Testing. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official (ISC)² CSSLP exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.