(ISC)² · Free Practice Questions · Last reviewed May 2026
48real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?
Using a centralized regex filter to strip HTML tags.
Encrypting all user input before storing it in the database.
Performing context-aware output encoding at the presentation layer.
This ensures input is neutralized based on where it is displayed.
Implementing a strict allow-list for all input fields.
An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?
Centralized database user management.
API Gateway pattern acting as an identity provider proxy.
Centralizes auth logic for easier management and consistent policy enforcement.
Service Mesh with mutual TLS enabled.
Sidecar pattern using a local proxy for mTLS.
During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?
Implement OAuth 2.0 scopes on the API gateway.
Use a Hardware Security Module (HSM) to store API keys.
Implement Mutual TLS (mTLS) for all inter-service communications.
mTLS provides both encryption and mutual identity verification.
Enable request rate limiting on the gateway.
When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?
Checking for SQL injection in login forms.
Reviewing the database schema for password hashing algorithms.
Verifying the presence of a Web Application Firewall (WAF).
Analyzing the implementation of HttpOnly and Secure flags on session cookies.
These flags prevent XSS-based cookie theft and plaintext transmission.
During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?
To identify which security controls and protection levels are required for specific data assets.
Classification drives the selection of encryption, access, and monitoring controls.
To identify the database engine version.
To automate the backup frequency of the database.
To determine which data needs to be deleted periodically.
In a cloud-native environment, which design practice minimizes the impact of a compromised container?
Storing secret keys as environment variables in the container spec.
Enforcing read-only root filesystems for containers.
This prevents attackers from installing persistent malware or modifying binaries.
Running the application process as the root user.
Using a single large image for all microservices.
Want more Secure Software Architecture And Design practice?
Practice this domainYou are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?
Perform a network vulnerability scan
Map the data flow of credit card information
Mapping data flows identifies exactly which components interact with sensitive data, defining the compliance scope.
Review the application source code
Update the firewall rule set
A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?
Document the risk and perform a formal risk assessment
Performing a risk assessment allows stakeholders to understand the impact of the exception before a final decision.
Immediately reject the request
Update the password policy
Implement the bypass in dev only
When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?
GDPR
FISMA
HIPAA
HIPAA sets the requirements for protecting PHI within healthcare software.
SOX
An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?
Threat Intelligence Feed
Change Request Log
Security Requirements Traceability Matrix (SRTM)
The SRTM links security requirements to specific features and business goals, ensuring technical decisions are documented.
Project Charter
You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?
Non-functional security requirement
Encryption constraints are properties of the system architecture that qualify as non-functional requirements.
Functional requirement
Business rule
Use case description
During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?
The Software Requirements Specification (SRS)
The SRS is the formal document where security and privacy constraints must be embedded to ensure they are implemented.
The Penetration Testing Report
The Infrastructure-as-Code (IaC) templates
The Risk Register
Want more Secure Software Requirements practice?
Practice this domainYou are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?
The vulnerability is a logic error that static analysis cannot find.
The .NET framework version is set incorrectly in the project settings.
The scan engine is set to 'Quick Scan' mode.
The third-party DLL is not configured as a source project or included in the scan scope.
SAST tools need access to code or dependencies to perform data flow analysis.
null
When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?
SQLmap.
null
Postman.
Postman allows for easy manipulation of request parameters to test BOLA.
Nmap.
Wireshark.
During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?
null
The DAST scanner is conflicting with the IAST agent.
The agent is not correctly configured to recognize the application's specific data access abstraction layer.
IAST requires accurate mapping of custom ORMs to underlying database drivers.
The source code repository is not accessible to the agent.
The build server lacks sufficient CPU cores for runtime instrumentation.
A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?
Configuring the fuzzer to use only random byte-flipping.
null
Running the fuzzer on a virtual machine without network access.
Instrumenting the code during compilation with afl-clang or afl-gcc.
Instrumentation provides the feedback mechanism AFL uses to find new code paths.
Providing the fuzzer with a binary that was stripped of all symbols.
When using Burp Suite Professional to perform DAST against a web application with a complex multi-step form, what is the most effective way to ensure the scanner completes the workflow?
Decrease the number of concurrent scan threads.
null
Enable 'Live Passive Crawling'.
Set the 'Scan Speed' to 'Thorough'.
Use the 'Macros' feature in Project Options to record and replay the sequence of authentication steps.
Macros are specifically designed to handle session state and multi-step workflows.
You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?
Unit testing with hardcoded values.
Static code analysis.
null
DAST scanning with default payloads.
Mutation-based fuzzing.
Mutation fuzzing systematically perturbs valid inputs to trigger unexpected behavior.
Want more Secure Software Testing practice?
Practice this domainYou are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?
The write is denied because the *-property prohibits writing to a higher security level.
The *-property prevents a user from writing to a higher level to prevent information flow leakage.
The write is permitted.
The write is denied due to the no-write-down rule.
The system allows the write only if encryption is used.
A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?
Granting the application access to all system environment variables.
Using a dedicated service account with granular permissions for database access.
This restricts the account to only the specific permissions needed for the task.
Enabling 'Everyone' write access to application configuration files.
Running the application process as 'root' or 'administrator'.
A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?
Availability
Confidentiality
Exposing keys in source code leads to a breach of secret material, violating confidentiality.
Non-repudiation
Integrity
Accounting
In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?
Availability
Non-repudiation
Confidentiality
Authentication
Authentication verifies the identity of the client application.
Integrity
When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?
Read-up
Write-up
Execute-down
Read-down
Read-down is prohibited to prevent a high-integrity subject from reading lower-integrity (less trusted) data.
Append-down
A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?
Software integrity
Service availability
System hardening
Secure architecture
Spoofing
Spoofing is the first category in the STRIDE threat model.
Want more Secure Software Concepts practice?
Practice this domainYou are troubleshooting a production incident where a legacy application is performing insecure cryptographic operations. Which feature of a Web Application Firewall (WAF) can best help mitigate the risk while a code fix is being developed?
Upgrade the SSL/TLS certificate to a higher bit-length.
Deploy a custom WAF rule to block requests containing anomalous cryptographic parameters.
Custom rules allow for rapid mitigation of specific exploit vectors targeting application logic.
Enable HTTP/2 protocol enforcement on the WAF load balancer.
Disable the WAF's logging feature to improve response time during the incident.
During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?
Clear the application's cache to remove any temporary sensitive data.
Increase the logging level to 'DEBUG' to track the attacker's actions.
Change the password for the database user and update the application deployment manifest.
Credential rotation is the primary remediation for compromised secrets.
Re-deploy the application using the same configuration to ensure a clean state.
To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?
Check the file timestamp using the operating system's file system metadata.
Upload the artifact to a public VirusTotal scan before deploying.
Compare the file size of the artifact with the size listed in the manifest file.
Verify the digital signature using a trusted public key from your organization's key store.
Digital signatures provide non-repudiation and integrity verification.
A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?
Enable the Kubernetes Audit Log and monitor for kubectl exec commands.
Configure PodSecurityPolicies to restrict the containers to non-root users.
Install a Service Mesh like Istio to enforce mTLS.
Apply a NetworkPolicy object that defines specific egress rules for the application namespace.
NetworkPolicies explicitly define which traffic flows are permitted, effectively mitigating unauthorized egress.
Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?
Maintaining a consistent and hardened state across all environments.
Baseline consistency is essential for reducing the attack surface.
Reducing the total cost of ownership of the cloud infrastructure.
Ensuring that developers have administrative access to production databases.
Maximizing the number of features delivered in each release.
You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?
Configure a post-deployment notification to Slack using a webhook.
Manually verify image signatures using Docker Content Trust after deployment.
Enable Jenkins 'Build periodically' to scan images in the registry.
Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.
Snyk enables automated gates that stop deployment if vulnerabilities meet a defined threshold.
Want more Secure Software Deployment Operations And Management practice?
Practice this domainWhen performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?
Elevation of Privilege.
Tampering.
Information Disclosure.
Information Disclosure occurs when unauthorized parties gain access to sensitive data.
Spoofing.
When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?
System Architecture Diagram.
Software Security Policy (SSP).
This is the governance-level document that sets expectations.
Individual Sprint Backlog.
Developer Coding Standards.
You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?
Enabling 'Secret scanning' and 'Push protection' in the repository settings.
These features specifically identify and block secrets in real-time.
Writing a custom shell script to grep all files for common regex patterns.
Relying on developers to manually check for secrets before every push.
Configuring an external firewall to block all traffic containing API keys.
You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?
Storing artifacts in a public S3 bucket for easy access.
Deleting build artifacts immediately after the deployment to production.
Uploading artifacts to a shared developer network drive.
Using digital signatures to verify artifact integrity before deployment.
Signing provides cryptographic proof of the artifact's origin and integrity.
Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?
Governance.
Governance defines the security activities integrated into the management lifecycle.
Implementation.
Verification.
Operations.
You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?
Implementing automated DAST tools.
Deploying a Web Application Firewall (WAF) to protect the current environment.
Performing a manual code review on all legacy source code.
Defining security requirements during the initial project planning/requirements phase.
Requirement phase is the earliest point to integrate security, providing the highest return on investment.
Want more Secure Software Lifecycle Management practice?
Practice this domainYou are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?
hash-algorithm
author-email
license-id
purl
purl provides the standardized format for component identification.
When evaluating a vendor's open-source usage, which factor is the strongest indicator of a proactive security posture?
The vendor provides a static list of libraries once a year.
The vendor does not use any open-source software.
The vendor maintains a documented process for tracking and patching vulnerable components.
Formal processes are the best indicator of long-term security maintenance.
The vendor uses only the newest versions of all libraries.
During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?
Software License Agreement (SLA)
SHA-256 checksum published on a text file
Vendor SOC 2 Type II report
Digital Signature (e.g., Authenticode or GPG)
Digital signatures are the industry standard for verifying code integrity.
An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?
Rely on the developer's ability to check spelling.
Configure an allowlist-only proxy repository.
If it is not on the allowlist, it cannot be downloaded.
Increase the frequency of penetration tests.
Enable two-factor authentication on developer accounts.
You are auditing a third-party vendor's CI/CD pipeline integration. You notice they pull dependencies from public mirrors without pinning them to specific hashes. What is the primary security risk here?
Incompatible library versions.
Excessive bandwidth usage.
Version hijacking due to lack of immutability.
Lockfiles ensure that the exact byte-for-byte code is used in every build.
Failure to meet license requirements.
Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?
Implement image signing and verification (e.g., Docker Content Trust or Cosign).
Signing and verifying images guarantees that the container running the build is exactly what was approved.
Disable all outbound network access from the build server.
Automatically pull the latest 'alpine' image during build time.
Rotate the build server SSH keys daily.
Want more Secure Software Supply Chain practice?
Practice this domainWhich cryptographic practice is recommended for protecting sensitive data at rest in a relational database?
Using cleartext with database permissions
Using MD5 hashing
Using AES-256 encryption
AES-256 is the current standard for secure encryption.
Storing data in base64 encoding
You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?
Using <%- %> tags for all variables
Disabling the template engine
Using <%= %> tags for user data
The <%= tag performs HTML entity escaping on the rendered content.
Implementing a global regex filter
In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?
Set the Content-Type header to application/json
Use a stateless session strategy with no tokens
Configure the HttpSecurity object to require CSRF tokens
Validating CSRF tokens ensures the request originated from the trusted UI.
Enable csrf().disable() in the SecurityFilterChain
A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?
Use Data Transfer Objects (DTOs) to restrict input
DTOs act as an allow-list for fields, preventing unauthorized property injection.
Disable SSL on the API endpoint
Increase the request timeout
Store user passwords in plaintext
A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?
--ignore-cve
--exclude-all
--skip-analysis
--suppression
The suppression file is the standard mechanism to filter out known false positives.
When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?
Database connection timeout
Business logic flaws
Buffer overflow
Static analysis tools scan for dangerous function calls like strcpy or gets that cause buffer overflows.
Zero-day authentication bypass
Want more Secure Software Implementation practice?
Practice this domainThe CSSLP exam has 200 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario questions on secure software concepts, requirements, design, implementation, testing, and supply chain risk management.
The exam covers 8 domains: Secure Software Architecture And Design, Secure Software Requirements, Secure Software Testing, Secure Software Concepts, Secure Software Deployment Operations And Management, Secure Software Lifecycle Management, Secure Software Supply Chain, Secure Software Implementation. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official (ISC)² CSSLP exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.