CSSLP Practice Test 1 — 10 Questions

Question 1

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 2

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 3

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 4

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Option A is correct because a secure credential vault (e.g., HashiCorp Vault, AWS Secrets Manager, or Jenkins Credentials Binding) injects secrets at runtime so they are never hardcoded or persisted in source control or build logs. Option B is correct because SAST tools (e.g., SonarQube, Checkmarx, Semgrep) analyze source code for vulnerabilities such as injection flaws and insecure deserialization before artifacts are built, shifting security left in the pipeline. Option D is correct because isolating build runners in a restricted network segment limits lateral movement and blast radius if a build agent is compromised, enforcing least-privilege network access to only required dependencies and registries. Option C is wrong because granting Admin privileges to all developers violates least privilege and enables unauthorized pipeline, credential, and configuration changes. Option E is wrong because storing secrets in plain text within a Jenkinsfile exposes them to anyone with repository read access and to build log leakage, rather than using masked, runtime-injected credentials.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 5

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Accepted Answer

Spoofing. STRIDE is Microsoft's threat modeling framework, and the 'S' stands for Spoofing, which is the threat of an attacker impersonating a legitimate user, system, or process. Spoofing violates authentication and is typically mitigated with strong authentication mechanisms such as MFA or certificates.

Answer

Software integrity

Answer

Service availability

Answer

System hardening

Answer

Secure architecture

Question 6

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Accepted Answer

Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.. Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Answer

Store all application logs in a publicly accessible S3 bucket for easy debugging.

Answer

Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

Answer

Increase the log verbosity to the maximum level in production indefinitely.

Question 7

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Option A (System functional requirements) is correct because abuse cases are derived by systematically negating and misusing each legitimate function the system is specified to perform, so the functional requirements define the attack surface and the intended behaviors that must be subverted. Option D (Known threat intelligence and past incident history) is correct because real-world attacker tactics, techniques, and procedures (TTPs) and prior incidents reveal which abuses are realistic and likely, grounding the abuse cases in evidence rather than speculation. The annual maintenance budget (B) is a financial planning input that does not describe attacker behavior or system functionality, so it cannot drive abuse-case content. Developer performance metrics (C) measure productivity or code quality and are irrelevant to modeling adversarial misuse. The internal office floor plan (E) is a physical-security artifact and, while tangentially related to facility security, is not a primary input for developing abuse cases about system behavior.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 8

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 9

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Accepted Answer

Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.. Integrating the Snyk Security plugin into the Jenkins build step scans the container image at build time, before promotion, enabling fail-fast remediation. This shifts security left and blocks vulnerable images from reaching production. It is the most effective because scanning occurs in the pipeline stage where the image is created.

Answer

Configure a post-deployment notification to Slack using a webhook.

Answer

Manually verify image signatures using Docker Content Trust after deployment.

Answer

Enable Jenkins 'Build periodically' to scan images in the registry.

Question 10

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

Accepted Answer

Digitally sign the message payload with the sender's private key and have the receiver verify the signature using the sender's public key.. Digital signatures bind the message content to the sender's private key, so any modification invalidates the signature. Unlike transport-layer protections, a signature remains verifiable after the message leaves the TLS tunnel and is stored in a queue. This provides end-to-end integrity and authenticity, which is critical for payment messages that may traverse multiple services.

Answer

Enable TLS mutual authentication (mTLS) between the sender and the message queue and between the queue and the receiver.

Answer

Encrypt the message payload with a symmetric key shared between the sender and receiver before placing it on the queue.

Answer

Use a message authentication code (MAC) with a key shared between all services that interact with the queue.