CSSLP Practice Test 11 — 15 Questions

Question 1

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

Accepted Answer

Implementing granular network segmentation to limit lateral movement.. Option A is correct because granular network segmentation (e.g., VLANs, microsegmentation, and least-privilege firewall rules) limits lateral movement, so even an unknown zero-day exploit that compromises one host cannot easily spread to other production systems. Option E is correct because RASP agents instrument the application runtime itself, detecting and blocking malicious behavior such as unexpected command execution or injection attempts in real time, which defends against zero-day flaws for which no signature or patch yet exists. Options B, C, and D are not appropriate: disabling security logging destroys the audit trail and detection capability needed to identify zero-day exploitation, perimeter-only firewalls fail against attacks that bypass or originate inside the perimeter, and annual patching is far too infrequent to address rapidly emerging vulnerabilities.

Answer

Disabling all security logging to prevent alert fatigue.

Answer

Relying solely on perimeter-based firewalls for security.

Answer

Updating the application to the latest version once per year.

Question 2

Which THREE categories are typically used to classify security requirements?

Accepted Answer

Confidentiality. Security requirements are generally grouped by confidentiality, integrity, and availability (the CIA triad).

Answer

Project Profitability

Answer

Marketing Appeal

Question 3

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

Accepted Answer

Tampering. STRIDE is Microsoft's threat modeling mnemonic, and its six explicitly defined categories are Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Option A (Tampering) is correct because STRIDE defines Tampering as the unauthorized modification of data or systems, such as altering a database record or a message in transit. Option B (Repudiation) is correct because STRIDE defines Repudiation as the ability of a user or system to deny having performed an action, which is countered by non-repudiation controls like digital signatures and audit logs. Option D (Spoofing) is correct because STRIDE defines Spoofing as impersonating a user, process, or system to gain unauthorized access, typically mitigated by authentication. Option C (Encryption) is not a STRIDE category; encryption is a mitigation technique rather than a threat class. Option E (Identification) is not a STRIDE category either; identification is an authentication-related process, not one of the six threat types.

Answer

Encryption

Answer

Identification

Question 4

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

Accepted Answer

Disable network access during the build process.. Hermetic builds require that a build is isolated from external influences and fully reproducible, so option C (disable network access during the build process) is correct because it prevents the build from fetching unpinned or potentially tampered artifacts, dependencies, or tooling from the internet at build time. Option D (use pinned dependencies with cryptographic hashes) is also correct because pinning exact dependency versions and verifying them against cryptographic hashes guarantees that only the intended, untampered artifacts are consumed, which is essential for reproducibility and supply-chain integrity. In contrast, option A (verbose logging to standard output) only improves observability and does not enforce isolation or reproducibility. Option B (automatically pulling the latest compiler version) is the opposite of hermetic, since it introduces non-deterministic, mutable toolchain inputs. Option E (allowing developers to trigger manual builds via SSH) expands the attack surface and bypasses controlled, automated build pipelines, so it does not support hermetic builds.

Answer

Enable verbose logging to standard output.

Answer

Automatically pull the latest compiler version.

Answer

Allow developers to trigger manual builds via SSH.

Question 5

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Accepted Answer

Using a user-friendly mobile app push notification for authentication.. Psychological acceptability ensures that security measures are easy for users to understand and use, so they don't circumvent them.

Answer

Providing zero feedback to users during the login process.

Answer

Requiring a 64-character password changed every 24 hours.

Answer

Disabling the ability for users to reset their own passwords.

Answer

Forcing users to solve a complex CAPTCHA at every login attempt.

Question 6

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

Accepted Answer

Managing API keys using a secure vault.. Option B is correct because API keys are credentials that grant access to external services, and storing them in a secure vault (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) prevents exposure through source code, config files, or logs. Option D is correct because data returned by an external API is untrusted input; validating and sanitizing it before processing defends against injection attacks, malformed payloads, and downstream data corruption. Option E is correct because HTTPS/TLS encrypts data in transit, providing confidentiality and integrity and preventing man-in-the-middle attacks, eavesdropping, and credential theft over the network. Option A is not a security consideration—plain HTTP transmits data unencrypted and is less secure, not faster in any security-relevant sense. Option C is not a security consideration and is in fact poor practice, since hard-coding endpoint URLs reduces flexibility and can expose internal or non-production endpoints; endpoint configuration should be externalized and managed securely.

Answer

Only using HTTP for faster communication.

Answer

Hard-coding the API endpoint URLs in the application.

Question 7

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

Accepted Answer

Economy of mechanism.. Economy of mechanism ensures that small, simple security designs are easier to verify and less prone to vulnerabilities.

Answer

Open design.

Answer

Complete mediation.

Answer

Defense in depth.

Question 8

Your organization is adopting the SLSA framework to improve supply chain security. You are evaluating a build system that claims to meet SLSA level 3. During an assessment, you find that the build system generates provenance but does not sign it, and the provenance is stored on the same server that performs builds. Which SLSA level requirement is most directly violated by this finding?

Accepted Answer

The provenance must be signed by the build system and stored in a tamper-resistant location separate from the build infrastructure.. SLSA level 3 requires that provenance be signed and stored in a tamper-resistant location isolated from the build infrastructure. This ensures that an attacker who compromises the build system cannot forge or alter provenance. The scenario describes unsigned provenance stored on the same server, which directly violates this requirement. Other options refer to practices that are either not mandated by SLSA or are associated with lower levels.

Answer

The build system must provide a software bill of materials (SBOM) for every artifact it produces.

Answer

All build steps must be defined in a human-readable configuration file that is version-controlled.

Answer

The build system must be hosted by a third-party cloud provider and not on-premises.

Question 9

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

Accepted Answer

If the authorization check fails, explicitly deny the request.. Fail-safe defaults mean that if an error or crash occurs, the system defaults to the most secure state (e.g., access denied).

Answer

If the authentication service is down, allow access to all users.

Answer

If the firewall fails, allow all traffic to pass through.

Answer

Default all new user accounts to 'Administrator' role.

Answer

If the load balancer times out, bypass the application logic.

Question 10

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

Accepted Answer

Authentication. Requiring the client_secret during the token exchange authenticates the client to the authorization server, ensuring that only the legitimate registered client can redeem the authorization code. This is fundamentally an authentication control — it verifies the identity of the client application — which is why D is correct.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 11

When performing automated security testing, which of the following is considered a 'false positive'?

Accepted Answer

The scanner reports a vulnerability that is not present in the application.. A false positive is a report of a vulnerability that does not actually exist in the target application.

Answer

The scanner misses an existing vulnerability.

Answer

The scanner causes the application to crash.

Answer

The scanner reports a vulnerability that is already fixed.

Answer

null

Question 12

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

Accepted Answer

Availability. Availability specifically refers to the system's ability to remain operational and accessible.

Answer

Non-repudiation

Answer

Integrity

Answer

Authentication

Answer

Confidentiality

Question 13

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Accepted Answer

The use of secure vaulting mechanisms for application secrets and keys.. Option C is correct because storing application secrets and keys in a secure vaulting mechanism (such as AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault) prevents unauthorized disclosure of credentials that protect application data, directly preserving confidentiality. Option E is correct because enforcing TLS/SSL for all data in transit between components encrypts network traffic, preventing eavesdropping or man-in-the-middle interception that would otherwise expose confidential data. The speed at which deployment occurs (A) affects availability and change risk, not confidentiality. The number of instances in an auto-scaling group (B) affects availability and scalability, not confidentiality. The UI color scheme (D) is purely cosmetic and has no bearing on data confidentiality.

Answer

The speed at which the deployment occurs.

Answer

The number of instances deployed in the auto-scaling group.

Answer

The color scheme used in the application UI.

Question 14

A healthcare SaaS provider is designing a new document-sharing feature for its patient portal. Clinicians upload sensitive records that must be readable only by the patient and the assigned care team, even if an attacker later gains read access to the storage bucket. The architect decides to implement envelope encryption using a cloud KMS. Which design decision best ensures that a storage-bucket compromise does not expose plaintext records?

Accepted Answer

Encrypt each record with a unique data encryption key (DEK), wrap that DEK with a KMS-held key encryption key (KEK), and store only the wrapped DEK alongside the ciphertext.. Envelope encryption with a KMS-held KEK and per-record DEKs is the standard design for this threat. The DEK is generated locally, used to encrypt the record, then wrapped by the KEK; only the wrapped DEK is stored. An attacker reading the bucket obtains ciphertext and wrapped keys, but unwrapping requires authenticated KMS access that can be revoked, audited, and scoped independently of storage permissions.

Answer

Encrypt all records with a single AES-256 key that is stored in the application configuration file and rotated annually.

Answer

Rely on the cloud provider's default server-side encryption (SSE) with provider-managed keys and enable bucket versioning.

Answer

Hash each record with SHA-256 before storage and compare hashes at read time to verify integrity.

Question 15

Which TWO methods are effective for eliciting security requirements from non-technical business stakeholders?

Accepted Answer

Presenting misuse case scenarios. Option A (Presenting misuse case scenarios) is correct because misuse cases describe how an actor could abuse or attack a system in business language, letting non-technical stakeholders articulate what must be prevented and thereby surface security requirements without requiring technical expertise. Option C (Conducting risk impact workshops) is correct because facilitated workshops let business stakeholders identify assets, threats, and the business impact of adverse events, translating their domain knowledge into prioritized security requirements. Option B (Analyzing server log architecture) is not appropriate here since it is a technical infrastructure activity that non-technical business stakeholders cannot meaningfully contribute to. Option D (Reviewing raw packet captures) is likewise a deep technical task requiring protocol-level knowledge, not a business elicitation technique. Option E (Reading the OWASP Top 10 documentation) is a reference standard for common web application risks, but passively reading it does not actively elicit requirements from non-technical stakeholders.

Answer

Analyzing server log architecture

Answer

Reviewing raw packet captures

Answer

Reading the OWASP Top 10 documentation