CSSLP Practice Test 13 — 15 Questions

Question 1

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Accepted Answer

Immediate feedback on secure coding patterns.. Option B is correct because integrating SAST into early SDLC stages (e.g., IDE plugins or pre-commit hooks) gives developers immediate feedback on secure coding patterns while code is being written, enabling them to fix issues before they propagate. Option C is correct because SAST analyzes source code statically without executing it, allowing vulnerabilities such as SQL injection, XSS, or hardcoded credentials to be identified early in development when remediation is cheapest and least disruptive. Option A is incorrect because SAST does not reduce developer education; it typically requires security training so developers can interpret findings and apply secure coding practices. Option D is incorrect because SAST tools inherently produce false positives due to limitations in static analysis, and no tool eliminates all of them. Option E is incorrect because SAST is not penetration testing; pen testing involves dynamic exploitation of running applications, whereas SAST is a static code review technique and does not automate pen testing.

Answer

Reduced developer education.

Answer

Elimination of all false positives.

Answer

Automation of penetration testing.

Question 2

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Accepted Answer

Integrating security linting into the IDE.. Option A is correct because integrating security linting into the IDE catches insecure coding patterns (e.g., hardcoded secrets, unsafe API usage) at the moment code is written, which is the earliest practical point in the lifecycle and embodies the Shift-Left principle of moving controls leftward. Option B is correct because security design reviews before coding begins address architectural flaws such as missing authentication, improper trust boundaries, or weak cryptography when they are cheapest to fix, rather than after implementation. Option D is correct because running SAST during the development phase analyzes source code for vulnerabilities like injection or buffer overflows before the artifact reaches testing or production, directly shifting detection earlier. Option C does not belong because post-deployment vulnerability scanning occurs after release, which is a Shift-Right activity, not Shift-Left. Option E does not belong because relying solely on external bug bounty programs is a reactive, post-release detection strategy that outsources discovery rather than preventing defects earlier in the lifecycle.

Answer

Conducting post-deployment vulnerability scanning.

Answer

Relying solely on external bug bounty programs.

Question 3

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Accepted Answer

Review of third-party audit reports (e.g., SOC 2, ISO 27001).. Effective programs combine standardized assessment questionnaires with a review of objective evidence, such as third-party audit reports (SOC 2).

Answer

Physical inspection of the vendor's data center.

Answer

Mandatory integration of your internal tools with the vendor.

Answer

Requiring the vendor to use your internal developers.

Question 4

A software architect is designing a component that will process untrusted input from external sources. To prevent injection attacks, the architect decides to implement input validation. Which design approach for input validation is most effective at mitigating injection flaws?

Accepted Answer

Use a whitelist of allowed characters and patterns, and reject any input that does not strictly conform to the expected format.. Whitelist validation, also known as positive validation, is the most effective design approach for input validation because it strictly defines what is allowed and rejects all other input. This prevents attackers from injecting malicious characters or patterns, regardless of the injection type. It is a fundamental secure design principle that should be applied to all untrusted input.

Answer

Rely on parameterized queries and stored procedures to handle all input, and skip additional validation.

Answer

Use a blacklist of known dangerous characters and patterns, and sanitize the input by removing or escaping them.

Answer

Validate input on the client side using JavaScript to provide immediate feedback and reduce server load.

Question 5

You are a security analyst tasked with reviewing a set of security requirements for a new web application. One requirement states: 'The application must be secure.' What is the PRIMARY issue with this requirement?

Accepted Answer

It is not testable because it lacks specific criteria for verification.. The primary issue with a requirement like 'The application must be secure' is that it is not testable. Security requirements must be specific and measurable to allow verification. Without concrete criteria, such as 'all data in transit must be encrypted with TLS 1.3,' testers cannot objectively assess compliance. This leads to ambiguity and potential unaddressed risks.

Answer

It is too broad and should be broken down into multiple functional requirements.

Answer

It duplicates existing security policies and is therefore redundant.

Answer

It does not align with business objectives and should be removed.

Question 6

A software development team is designing a new web application that will handle sensitive personal data. The security architect recommends incorporating privacy by design principles. Which two design practices best align with the principle of data minimization? (Choose two.)

Accepted Answer

Design the application to use pseudonymization for all user identifiers in analytics and logging systems.. Data minimization in privacy by design means collecting only necessary data and keeping it only as long as needed, as well as reducing identifiability where possible. Collecting and deleting data based on purpose, and pseudonymizing identifiers in analytics and logging, both directly reduce the amount of personal data processed and its linkability. These practices limit privacy risk and align with regulatory requirements.

Answer

Implement field-level encryption for all personal data fields in the database to protect data at rest.

Answer

Store all personal data in a single, centralized database to simplify access control and auditing.

Answer

Implement role-based access control (RBAC) to ensure only authorized users can access personal data.

Question 7

You are eliciting security requirements for a new online banking application. The business stakeholders are focused on features and have limited security knowledge. You need to ensure that security requirements are complete, unambiguous, and testable. Which technique is MOST appropriate to achieve this?

Accepted Answer

Create misuse cases that describe how an attacker might abuse the system, and derive security requirements from them.. Misuse cases are particularly effective for eliciting security requirements from stakeholders with limited security expertise. By framing threats as stories of misuse, they make abstract security concepts concrete and relatable. This technique ensures that requirements are derived from actual attack scenarios, making them specific, testable, and directly tied to risk mitigation. It also fosters collaboration between security and business stakeholders.

Answer

Organize a focus group where stakeholders brainstorm all possible security features they want in the application.

Answer

Interview the IT security team to document their existing security policies and apply them as requirements.

Answer

Conduct a survey asking stakeholders to rate the importance of various security controls from a predefined list.

Question 8

You are leading a requirements elicitation session for a new EHR system. A stakeholder from the legal department insists that the system must comply with HIPAA. Another stakeholder from the clinical team wants quick access to patient records for emergency situations. You need to document a security requirement that balances these needs. Which requirement BEST addresses both compliance and usability?

Accepted Answer

Implement role-based access control (RBAC) with break-glass emergency access that logs all access and requires retrospective review.. The break-glass RBAC requirement directly addresses both compliance and usability. It allows emergency access, satisfying the clinical need, while logging and retrospective review ensure accountability and HIPAA compliance. This balanced approach is a recognized best practice in healthcare systems, providing a controlled mechanism for exceptions without sacrificing security.

Answer

Enforce multi-factor authentication (MFA) for all users, including emergency responders, with no exceptions.

Answer

Conduct annual security awareness training for all clinical staff on HIPAA privacy rules.

Answer

Encrypt all patient data at rest and in transit using AES-256 and TLS 1.3.

Question 9

A software architect is designing a multi-tenant SaaS application that must prevent a user from one tenant from accessing another tenant's data through the application's API. The architect wants to enforce this isolation at the architectural level rather than relying on developers to remember to include a tenant filter in every query. Which design approach best achieves this goal?

Accepted Answer

Implement row-level security (RLS) policies in the database that automatically filter data based on the tenant identity associated with the current session.. Row-level security is a database-enforced access control mechanism that automatically restricts which rows a session can see or modify based on a security predicate. By tying the predicate to the tenant identity, the database becomes the enforcement point, so application bugs cannot easily bypass isolation. This is a strong architectural control for multi-tenant isolation.

Answer

Require developers to use a shared data access library that always adds a tenant_id parameter to every SQL query.

Answer

Encrypt each tenant's data with a unique encryption key and store the keys in a hardware security module (HSM).

Answer

Assign each tenant a separate database schema and require the application to connect with a schema-specific database user.

Question 10

A financial services firm is designing a new web application that will allow customers to transfer funds between accounts. The security architect has mandated that the application must enforce the principle of 'least privilege' for all user actions. Which design approach best achieves this?

Accepted Answer

Assign each user a role with the minimum permissions necessary to perform their job functions, and regularly review role assignments.. Least privilege requires that users and processes operate with only the permissions essential to their function. Assigning minimal role-based permissions and conducting regular reviews ensures that access remains tightly scoped over time. The other options either grant excessive permissions, share accounts broadly, or automate elevation without oversight, all of which violate the principle.

Answer

Implement a single administrative account with full access to all application functions, and require strong multi-factor authentication for its use.

Answer

Use a shared service account for all application components to simplify permission management and reduce administrative overhead.

Answer

Allow users to request additional permissions through a self-service portal that automatically grants access after a short delay.

Question 11

A healthcare organization is designing a system to store and process electronic protected health information (ePHI). The system must comply with HIPAA and ensure data confidentiality at rest. Which cryptographic design choice is most appropriate?

Accepted Answer

Encrypt the data using AES-256 in Galois/Counter Mode (GCM) with a unique key per data record, and store the keys in a hardware security module (HSM).. For protecting ePHI at rest, symmetric encryption with AES-256-GCM offers both confidentiality and integrity, and using a unique key per record with HSM-based key storage ensures strong key management. The other options either use asymmetric encryption inefficiently, apply hashing which is irreversible, or rely on encoding without encryption, all of which fail to meet the confidentiality requirement.

Answer

Hash the data using SHA-256 with a salt, and store the hash in the database to protect confidentiality.

Answer

Encrypt the data using RSA-2048 with OAEP padding, and store the private key in a configuration file on the application server.

Answer

Encode the data using Base64 encoding, and rely on network-level encryption to protect it at rest.

Question 12

A software development team is beginning a new project and wants to integrate security into the design phase. Which activity is most effective for identifying potential security requirements early in the software development lifecycle (SDLC)?

Accepted Answer

Performing threat modeling sessions with the architecture team.. Threat modeling is a proactive design-phase activity that systematically identifies threats and derives security requirements. It involves understanding the system architecture, identifying assets and trust boundaries, and enumerating potential threats. This early analysis allows the team to incorporate appropriate security controls into the design, reducing vulnerabilities and remediation costs. The other options are later-stage activities that do not fulfill the goal of early security requirement identification.

Answer

Deploying a web application firewall (WAF) to protect the application in production.

Answer

Conducting a penetration test on a prototype of the application.

Answer

Reviewing the source code for common vulnerabilities using static analysis tools.

Question 13

A software development team is designing a new internal employee portal. The security architect recommends implementing the principle of least privilege. Which design decision best applies this principle to the portal's database access?

Accepted Answer

Create a dedicated database account for the portal that has only the specific SELECT, INSERT, UPDATE, and DELETE permissions required on the tables the portal uses.. Least privilege means giving an entity only the access required to perform its function. A dedicated database account with a minimal set of DML permissions on specific tables ensures the portal can operate without granting unnecessary rights. This reduces the impact of a compromise and is a fundamental secure design practice.

Answer

Grant the portal's database account full administrative rights so that developers can quickly fix data issues without waiting for DBA approval.

Answer

Allow the portal to connect as the database schema owner so that it can create temporary tables and stored procedures as needed.

Answer

Use a shared database account for all internal applications so that connection strings are easier to manage and rotate.

Question 14

A software architect is designing a system that must be resilient to failures and attacks. Which two design principles best contribute to system resilience? (Choose two.)

Accepted Answer

Implementing redundant components with automatic failover.. Resilience is achieved through redundancy, automatic failover, and graceful degradation. Redundancy ensures availability during failures, while graceful degradation allows critical functions to continue when non-essential features are impaired. These principles together enable the system to withstand and recover from disruptions, whether from attacks or accidental failures. The other options either introduce single points of failure or weaken security, reducing overall resilience.

Answer

Hardcoding credentials in configuration files for ease of deployment.

Answer

Using a single, monolithic component to simplify management and reduce complexity.

Answer

Relying on a single security control to protect all assets.

Question 15

You are a security architect for a FinTech startup building a mobile payment app. The product owner has provided a list of functional user stories but no security requirements. You need to integrate security into the Agile development process without disrupting the sprint cadence. Which approach BEST ensures security requirements are identified and documented continuously?

Accepted Answer

Define security requirements as acceptance criteria within each user story and refine them during backlog grooming.. Integrating security requirements as acceptance criteria within user stories ensures they are continuously identified, refined, and validated throughout the Agile lifecycle. This approach aligns security with business value, promotes collaboration, and makes security a natural part of the definition of done. Other approaches either delay security consideration or isolate it from the development flow, reducing effectiveness.

Answer

Assign a dedicated security champion to write security requirements for each sprint after the sprint planning meeting.

Answer

Conduct a comprehensive security requirements workshop at the project initiation and document all requirements in a separate security requirements specification.

Answer

Rely on the QA team to identify security requirements during test case creation for each user story.