CSSLP Practice Test 12 — 15 Questions

Question 1

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Accepted Answer

To act as a security advocate and bridge between security and dev teams.. Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Answer

To perform all manual code reviews for the entire department.

Answer

To handle all incident responses for the organization.

Answer

To replace the need for professional security audits.

Question 2

Which THREE of the following are common threats to the Software Supply Chain that an SBOM can help mitigate?

Accepted Answer

Identification of end-of-life (EOL) software components.. Option C is correct because an SBOM enumerates every component and its version, allowing teams to compare those versions against vendor end-of-life (EOL) and end-of-support dates so obsolete libraries can be flagged and replaced before they become an unpatched supply-chain risk. Option D is correct because an SBOM's component inventory (typically expressed in SPDX or CycloneDX with Package URLs) can be correlated against vulnerability databases such as the NVD to identify dependencies containing known CVEs, which is the core use case for SBOM-driven vulnerability management. Option E is correct because an SBOM records component names, versions, and license identifiers, enabling automated license-compliance scanning to detect restrictive or non-compliant open-source licenses (for example GPL obligations in a proprietary product). Option A does not belong because SQL injection is an application-layer coding defect remediated through secure coding and input validation, not through component inventory. Option B does not belong because brute-force attacks on login are mitigated by account lockout, rate limiting, MFA, and CAPTCHAs, none of which an SBOM addresses.

Answer

Mitigation of SQL injection flaws in custom code.

Answer

Prevention of brute-force attacks on application login.

Question 3

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law governing the privacy and security of Protected Health Information (PHI), including the Privacy Rule, Security Rule, and Breach Notification Rule. Any application handling PHI for a covered entity or business associate must comply with HIPAA's administrative, physical, and technical safeguards.

Answer

GDPR

Answer

FISMA

Answer

SOX

Question 4

Which TWO of the following are common challenges when implementing IAST?

Accepted Answer

Inability to find vulnerabilities in unreachable code.. Option B is correct because IAST instruments the running application and observes execution paths, so code that is never reached during testing (unreachable or dormant code paths) cannot be exercised and therefore its vulnerabilities go undetected. Option E is correct because IAST agents hook into runtime execution and add instrumentation overhead, which can degrade application performance and throughput, making performance impact a well-known implementation challenge. Option A is not a defining IAST challenge since IAST relies on runtime instrumentation rather than requiring full source code access, unlike SAST. Option C is incorrect because IAST typically still produces false positives, so a 'lack of false positives' is not a challenge. Option D is incorrect because IAST agents are deployed on the application server or runtime environment, not on client machines.

Answer

Requirement for full source code access.

Answer

Lack of false positives.

Answer

Difficulty in installing agents on client machines.

Question 5

You are setting up an automated policy in GitHub Actions to block builds that contain dependencies with known high-severity vulnerabilities. Which tool is standard for this type of automated gated check?

Accepted Answer

Snyk Open Source integration.. Snyk is widely used in CI/CD pipelines as a gatekeeper to block builds based on vulnerability thresholds.

Answer

GitHub Projects.

Answer

Git LFS.

Answer

GitHub Pages.

Question 6

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Accepted Answer

Buffer overflow. Buffer overflow is a memory safety vulnerability that arises from improper bounds checking on arrays or pointer arithmetic, leading to out-of-bounds writes. Static analysis tools like Fortify and Coverity use data flow analysis and taint tracking to identify such patterns by examining array indices, pointer dereferences, and memory copy operations. They can flag potential overflows without executing the code, making it a prime target for static analysis in C++ applications.

Answer

Database connection timeout

Answer

Business logic flaws

Answer

Zero-day authentication bypass

Question 7

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Accepted Answer

Using a Content Security Policy (CSP). Option D, using a Content Security Policy (CSP), is correct because CSP is an HTTP response header (e.g., Content-Security-Policy: default-src 'self') that restricts which sources of scripts, styles, and other resources the browser may load, thereby blocking inline script execution and mitigating reflected and stored XSS even if an injection occurs. Option E, context-aware output encoding, is correct because encoding untrusted data according to its output context (HTML entity encoding for HTML body, JavaScript escaping for script blocks, attribute encoding for HTML attributes, URL encoding for URLs) ensures injected characters are rendered as inert text rather than executable markup or script, which is the primary defense against XSS. Option A, relying on antivirus software, is not appropriate because antivirus operates on the client endpoint and cannot reliably detect or block browser-executed script injections delivered through web applications. Option B, disabling cookies, does not prevent XSS; it only removes one target of session theft and may break application functionality, while the injected script still executes in the victim's browser. Option C, using insecure HTML comments, is not a security control at all and can even worsen exposure by leaving sensitive data or code in page source.

Answer

Relying on antivirus software

Answer

Disabling cookies

Answer

Using insecure HTML comments

Question 8

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

Accepted Answer

Creating an abstraction layer (wrapper/adapter) to sanitize all data exchanged.. An abstraction layer acts as a buffer, sanitizing and normalizing data before it enters or leaves the application.

Answer

Migrating all legacy data immediately.

Answer

Direct integration via shared database tables.

Answer

Granting the legacy system full administrative privileges in the new system.

Question 9

In the context of 'Secure Software Requirements', what should the security team do when they encounter a conflict between usability and security?

Accepted Answer

Conduct a risk-based assessment to find a balanced approach. When usability and security conflict, the correct approach is a risk-based assessment that weighs the likelihood and impact of the threat against the usability cost of the control, then selects a balanced mitigation. Security is not absolute — controls that destroy usability drive users to work around them (shadow IT, password reuse), which often increases overall risk. A documented risk-based decision also provides defensible rationale for auditors and stakeholders.

Answer

Ignore the usability concern

Answer

Always prioritize security over usability

Answer

Ask the developers to make the final decision

Question 10

Which TWO of the following are essential components for achieving 'Non-repudiation'?

Accepted Answer

Digital signatures. Digital signatures (A) are essential for non-repudiation because they cryptographically bind a signer's private key to the message, allowing any party to verify origin and integrity and preventing the signer from later denying authorship. Immutable audit logs (B) are also essential because they provide tamper-evident, append-only records of actions that can be used as evidence to prove what occurred and who did it, which is required to prevent denial of an action. Multi-factor authentication (C) strengthens authentication and reduces account compromise but does not by itself prove which specific action a user performed, so it does not establish non-repudiation. Load balancing (D) is an availability and performance mechanism and has no bearing on proving the origin or integrity of a transaction. Strong encryption of data in transit (E) protects confidentiality against eavesdropping but does not bind an identity to a message or prevent a party from denying an action.

Answer

Multi-factor authentication.

Answer

Load balancing.

Answer

Strong encryption of data in transit.

Question 11

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

Accepted Answer

Extract and re-inject unique anti-CSRF tokens for each request.. CSRF tokens are unique per session; the scanner must be able to extract the token from the response and include it in the subsequent request.

Answer

Attempt to brute force the user's password.

Answer

null

Answer

Scan the client-side JavaScript code for vulnerabilities.

Answer

Bypass the need for authentication.

Question 12

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks. The 'state' parameter in OAuth2 is an opaque value generated by the client and returned unchanged by the authorization server in the redirect. The client verifies that the returned state matches the value it sent, which binds the authorization response to the user's session and prevents cross-site request forgery (CSRF) attacks where an attacker tricks a victim into submitting an attacker's authorization code.

Answer

To store the user's password

Answer

To track the user's location

Answer

To encrypt the access token

Question 13

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Accepted Answer

Integrating security unit tests into the automated test suite.. Option A is correct because integrating security unit tests (e.g., SAST checks, input-validation and authentication tests) into the CI/CD automated test suite lets the team catch vulnerabilities on every build without slowing the sprint cadence, which directly sustains security velocity. Option D is correct because regular threat modeling sessions (for example, using STRIDE during backlog refinement or design sprints) identify design-level risks early, when they are cheapest to fix, rather than after code is written. Option E is correct because incorporating security requirements into user stories, with explicit acceptance criteria such as OWASP ASVS controls or abuse cases, makes security work visible, estimable, and testable inside the normal Agile workflow. Option B does not belong because manual penetration testing on every commit is impractical, slow, and not automatable, which destroys velocity; pen tests are better performed periodically or on significant releases. Option C does not belong because deferring security documentation review to the final release contradicts Agile's iterative delivery and creates a late-stage bottleneck where remediation is far more costly.

Answer

Performing manual penetration tests on every commit.

Answer

Waiting for the final release to review security documentation.

Question 14

Which TWO of the following are required to successfully implement a secure logging mechanism?

Accepted Answer

Filter sensitive data before logging. Option C is correct because filtering sensitive data (e.g., passwords, PII, tokens, credit-card numbers) before it is written to logs prevents confidential information from being exposed in log files, which is a core requirement of a secure logging mechanism and aligns with standards like PCI DSS and GDPR. Option D is correct because storing logs in a tamper-evident system (e.g., append-only storage, write-once buckets, cryptographic hashing/chaining, or a SIEM with integrity controls) ensures that attackers cannot alter or delete records to hide their activity, preserving the logs' evidentiary value for auditing and incident response. Option A is not required and would generate excessive noise and storage costs while providing little security value. Option B is wrong because sending logs to a publicly accessible bucket exposes potentially sensitive data to unauthorized parties. Option E is wrong because disabling logging removes the very visibility needed for detection, investigation, and compliance.

Answer

Log every single user mouse movement

Answer

Send logs to a publicly accessible bucket

Answer

Disable all logging to improve performance

Question 15

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

Accepted Answer

Perform incremental scans of the changed code.. Incremental scanning analyzes only the code changed since the last scan, dramatically reducing scan time and noise so developers get fast, relevant feedback on their own commits. This preserves SAST value in CI/CD while minimizing the friction that causes teams to disable or bypass security gates. Full scans can still run nightly or on release branches for complete coverage.

Answer

Disable all rules except for critical-level vulnerabilities.

Answer

Run full scans on every single commit.

Answer

Set the tool to break the build for every warning.