CSSLP Practice Test 10 — 10 Questions

Question 1

Which THREE of the following practices contribute to secure configuration of a web server?

Accepted Answer

Remove default files and pages. Option A is correct because removing default files and pages (e.g., Apache's /var/www/html/index.html, IIS's iisstart.htm, or sample scripts like phpinfo.php) eliminates well-known entry points and information-disclosure vectors that attackers routinely probe. Option D is correct because disabling directory listing (Apache's Options -Indexes or nginx's autoindex off) prevents the server from exposing file and folder names that could reveal sensitive resources or aid reconnaissance. Option E is correct because enforcing HTTPS with TLS (e.g., via HSTS and redirecting port 80 to 443) protects credentials and session data from interception and man-in-the-middle attacks, which is a core secure-configuration requirement. Option B is wrong because allowing all HTTP methods such as TRACE and OPTIONS enables cross-site tracing and method enumeration; these should be restricted to only those required (typically GET, POST, HEAD). Option C is wrong because verbose error reporting leaks stack traces, file paths, and server versions that assist attackers; production servers should return generic error messages and log details server-side instead.

Answer

Allow all HTTP methods (TRACE, OPTIONS)

Answer

Enable verbose error reporting

Question 2

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Accepted Answer

Providing secure coding training to developers.. Option B is correct because secure coding training equips developers to recognize and avoid vulnerabilities such as SQL injection, XSS, and buffer overflows, which is a foundational Secure Software Lifecycle Management (SSLM) practice for building security in from the start. Option C is correct because periodic risk assessments identify, prioritize, and track application threats and weaknesses throughout the lifecycle, enabling risk-based decisions on controls and remediation. Option E is correct because defining audit logging and monitoring requirements ensures security-relevant events are captured, retained, and reviewed, supporting detection, incident response, and compliance within the SSLM plan. Option A does not belong because mandating a single programming language is an architectural or standardization choice, not a security lifecycle control, and it does not inherently reduce risk. Option D does not belong because purchasing cyber insurance is a risk-transfer business decision, not a Secure Software Lifecycle Management activity, and it does not prevent or remediate software vulnerabilities.

Answer

Requiring developers to use only one specific programming language.

Answer

Buying insurance for all cyber incidents.

Question 3

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

Accepted Answer

Using random, non-predictable UUIDs for resource identifiers.. Option C is correct because using random, non-predictable UUIDs (e.g., UUIDv4) for resource identifiers makes it impractical for an attacker to guess or enumerate other users' object IDs, removing the easy ID-guessing vector that BOLA exploits. Option E is correct because BOLA fundamentally occurs when an API endpoint accepts an object ID and returns/modifies it without checking that the authenticated session user actually owns or is authorized for that object; explicitly verifying that the session's user ID matches the owner of the requested resource ID enforces object-level authorization on every request. Option A is wrong because sequentially incrementing IDs are trivially enumerable, making it easy to probe other users' objects. Option B is wrong because hiding objects in the frontend provides no security—attackers can call the API directly, bypassing any UI concealment. Option D is wrong because base64 is an encoding, not encryption or randomization; base64-encoded IDs are reversible and predictable, so they do not prevent enumeration or unauthorized access.

Answer

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Answer

Relying on the frontend to hide sensitive objects.

Answer

Using base64 encoded strings for all database IDs.

Question 4

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. In EJS, the <%= %> tag performs HTML entity escaping on the output, converting characters like <, >, &, and quotes into safe entities so injected markup cannot execute in the browser. This directly neutralizes the most common XSS vector — reflected or stored script tags in user-supplied data. Using escaped output is the canonical secure-coding practice for rendering untrusted content in EJS templates.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 5

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

Accepted Answer

Maintaining an updated contact list and clear incident escalation paths.. Option A is correct because an updated contact list and clearly defined escalation paths ensure the right responders are notified quickly and incidents are routed to the appropriate teams, which is foundational to any Incident Response (IR) plan. Option D is correct because a post-mortem analysis identifies root causes and lessons learned, enabling corrective actions and continuous improvement of security controls and IR procedures. Option E is correct because isolating affected systems (for example, network segmentation or host containment) limits lateral movement and prevents the attack from spreading to other assets. Option B is not appropriate because deliberately allowing a threat actor to continue accessing systems risks further compromise and data loss; observation should only occur under controlled, authorized threat-hunting or deception operations, not as a general IR action. Option C is wrong because deleting production logs destroys forensic evidence, violates audit and legal retention requirements, and undermines the ability to investigate and remediate the incident.

Answer

Allowing the threat actor to continue accessing the system to observe their tactics.

Answer

Immediately deleting all production logs to hide the incident from auditors.

Question 6

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

Accepted Answer

Using a dedicated service account with granular permissions for database access.. Using a dedicated service account with granular permissions for database access embodies least privilege by granting only the necessary permissions to perform specific tasks. This minimizes the attack surface and limits potential damage from compromised credentials. The other options either grant excessive permissions or violate least privilege by allowing broad access.

Answer

Granting the application access to all system environment variables.

Answer

Enabling 'Everyone' write access to application configuration files.

Answer

Running the application process as 'root' or 'administrator'.

Question 7

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 8

What is the primary goal of performing a 'Security Gap Analysis' during the requirements phase?

Accepted Answer

To identify missing security controls against a baseline or standard. A gap analysis compares the existing state or desired requirements against security standards to identify missing controls.

Answer

To find bugs in the application code

Answer

To calculate the ROI of security spending

Answer

To document the project budget

Question 9

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

Accepted Answer

Use built-in language APIs instead of shell commands. The most secure way to handle user input that would otherwise be used to construct an OS command is to avoid shell invocation entirely and use built-in language APIs that perform the desired operation (e.g., file I/O, process spawning with argument arrays). This eliminates the shell interpreter and the possibility of command injection, because user input is passed as data, not parsed as shell syntax. Sanitization and escaping are fallback mitigations that are error-prone and shell-specific.

Answer

Run the command as a root user

Answer

Sanitize the input with a blacklist

Answer

Escape the input with shell-specific characters

Question 10

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

Accepted Answer

Provide a secure channel for researchers to report vulnerabilities.. A Vulnerability Disclosure Policy (VDP) defines how external security researchers can report vulnerabilities to an organization, specifying the scope, reporting channel, and safe harbor terms. Its primary function is to provide a clear, secure, and legal channel for receiving vulnerability reports so they can be triaged and remediated. It is a foundational element of coordinated vulnerability disclosure (CVD) and is distinct from bug bounty programs, which add incentives.

Answer

Automate the patching of production servers.

Answer

Create a list of known hardware defects.

Answer

Legal protection against data breaches.