CSSLP Practice Test 1 — 10 Questions

Question 1

When designing secure software, why is 'Economy of Mechanism' important?

Accepted Answer

To minimize the attack surface by keeping the design simple.. Economy of mechanism suggests that designs should be as simple and small as possible to minimize the attack surface and make security easier to verify.

Answer

To lower the cost of hardware infrastructure.

Answer

To increase the lines of code for better functionality.

Answer

To ensure that the software is faster at runtime.

Answer

To enable easier debugging for developers.

Question 2

Which TWO of the following are essential components for achieving 'Non-repudiation'?

Accepted Answer

Digital signatures. Non-repudiation requires proof of origin (usually via digital signature) and a secure, immutable audit trail.

Answer

Multi-factor authentication.

Answer

Load balancing.

Answer

Strong encryption of data in transit.

Question 3

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Accepted Answer

One developer commits code, and a separate user with deployment permissions triggers the release.. Separation of Duties prevents one person from having enough access to execute a malicious change without oversight.

Answer

The same developer writes, reviews, and deploys the code.

Answer

The QA team is allowed to modify production database records.

Answer

The build server automatically deploys code without human verification.

Answer

All developers have access to the production environment credentials.

Question 4

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Accepted Answer

Spoofing. STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Answer

Software integrity

Answer

Service availability

Answer

System hardening

Answer

Secure architecture

Question 5

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

Accepted Answer

Authentication. The client_secret provides authentication of the client to the authorization server, ensuring only the intended client can exchange the code.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 6

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

Accepted Answer

Using a dedicated service account with granular permissions for database access.. Least privilege requires granting only the minimum necessary permissions for a task.

Answer

Granting the application access to all system environment variables.

Answer

Enabling 'Everyone' write access to application configuration files.

Answer

Running the application process as 'root' or 'administrator'.

Question 7

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

Accepted Answer

Checking authorization for every access request.. Complete mediation requires that every access request to every object must be checked for authorization, with no caching or bypassing allowed.

Answer

Granting permanent access to all authenticated users.

Answer

Checking authorization only at login.

Answer

Relying on the user to request access when needed.

Answer

Caching permissions to reduce latency.

Question 8

When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?

Accepted Answer

Read-down. Biba is the inverse of Bell-LaPadula, focusing on integrity. It prevents 'read-down' to ensure a process doesn't ingest corrupted data from a lower level.

Answer

Read-up

Answer

Write-up

Answer

Execute-down

Answer

Append-down

Question 9

Which of the following is an example of defense-in-depth in a web application architecture?

Accepted Answer

Implementing input validation, parameterized queries, and a Web Application Firewall (WAF).. Defense-in-depth uses multiple layers of security so that if one fails, others compensate.

Answer

Disabling all firewall rules for testing purposes.

Answer

Storing all application data in a single encrypted volume.

Answer

Removing all logs to prevent unauthorized access to audit trails.

Answer

Using a single strong password for all database accounts.

Question 10

Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?

Accepted Answer

Requiring two distinct roles to approve a production code deployment.. Assigning different roles for code deployment and database management prevents one person from having total control.

Answer

Granting developers full access to production database backups.

Answer

Using a single shared admin account for all system functions.

Answer

Allowing a single admin to manage all user accounts.