CSSLP Practice Test 15 — 15 Questions

Question 1

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Accepted Answer

One developer commits code, and a separate user with deployment permissions triggers the release.. Separation of Duties (SoD) requires that no single individual controls all phases of a critical process. In a CI/CD pipeline, having one developer commit code and a different user with deployment permissions trigger the release enforces a check-and-balance so that the author cannot unilaterally push code to production. This is the canonical SoD implementation.

Answer

The same developer writes, reviews, and deploys the code.

Answer

The QA team is allowed to modify production database records.

Answer

The build server automatically deploys code without human verification.

Answer

All developers have access to the production environment credentials.

Question 2

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

Accepted Answer

Integrity. Option C (Integrity) is correct because the CIA triad explicitly consists of Confidentiality, Integrity, and Availability, where integrity ensures data is accurate, complete, and unaltered by unauthorized parties. Option D (Confidentiality) is correct because it is the core element of the triad that ensures information is accessible only to authorized individuals, typically enforced through encryption and access controls. The unmarked options do not belong: Non-repudiation (A) is a separate security property proving a party cannot deny an action, Accounting (B) relates to auditing and tracking user activity, and Authentication (E) is the process of verifying identity, all of which support but are not components of the CIA triad itself.

Answer

Non-repudiation

Answer

Accounting

Answer

Authentication

Question 3

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Accepted Answer

Implement robust authentication. Option A (Implement robust authentication) is correct because requiring strong, verified identity via mechanisms such as OAuth 2.0, API keys, or mTLS prevents unauthenticated or spoofed clients from reaching API endpoints, directly shrinking the set of reachable, exploitable entry points. Option C (Implement rate limiting) is correct because throttling requests per client/IP (e.g., HTTP 429 responses, token buckets) reduces the exposure window for brute-force, credential-stuffing, and abuse-based attacks, which is a core attack-surface reduction technique. Option E (Disable unused HTTP methods) is correct because turning off methods like PUT, DELETE, TRACE, or OPTIONS that the API does not need removes unnecessary verbs and handlers that attackers could otherwise probe or exploit. Option B (Use cleartext headers for all communication) is not correct because transmitting headers in cleartext exposes credentials and tokens to interception, increasing rather than minimizing the attack surface. Option D (Expose full internal database schemas) is not correct because revealing internal schema details gives attackers structural intelligence that aids injection and enumeration attacks, which expands the attack surface instead of reducing it.

Answer

Use cleartext headers for all communication

Answer

Expose full internal database schemas

Question 4

Which TWO of the following represent common output formats for security testing reports?

Accepted Answer

PDF.. Option B (PDF) is correct because PDF is a standard, widely used format for delivering polished security testing reports, preserving layout, tables, and charts for stakeholders and clients. Option E (JSON) is correct because JSON is a common machine-readable format used to export structured findings from scanners and testing tools, enabling automation, parsing, and integration with other systems. Option A (PNG) is an image format, suitable for screenshots or diagrams but not a typical full report output format. Option C (MP3) is an audio format and is irrelevant to security report deliverables. Option D (BIOS) is firmware, not a report format at all.

Answer

PNG.

Answer

MP3.

Answer

BIOS.

Question 5

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 6

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Accepted Answer

The use of native object serialization. Native object serialization features (e.g., Java's ObjectInputStream, PHP's unserialize(), Python's pickle, .NET's BinaryFormatter) reconstruct objects from attacker-controlled byte streams, and if the classpath contains gadget chains, this leads directly to remote code execution. JSON.parse() only produces plain data structures (objects, arrays, primitives) with no code execution or object instantiation semantics, so it is not the classic source of insecure deserialization. The vulnerability arises because deserialization trusts the serialized data to define object state and type, which the attacker fully controls.

Answer

The use of internal logging

Answer

The use of JSON.parse()

Answer

The use of static typing

Question 7

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

Accepted Answer

Maintaining a consistent and hardened state across all environments.. Secure Configuration Management ensures systems are deployed and maintained in a known, hardened, consistent state across development, test, and production — removing default accounts, disabling unnecessary services, applying CIS benchmarks, and detecting drift. Consistency across environments prevents 'it works in dev but is insecure in prod' gaps and supports reproducible audits.

Answer

Reducing the total cost of ownership of the cloud infrastructure.

Answer

Ensuring that developers have administrative access to production databases.

Answer

Maximizing the number of features delivered in each release.

Question 8

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

Accepted Answer

Enabling 'Secret scanning' and 'Push protection' in the repository settings.. GitHub's native Secret scanning with Push protection is the most effective DevSecOps control because it detects known secret patterns (and partner-verified tokens) at the platform level and blocks the push before the secret ever lands in the remote repository. This shifts detection left into the developer's workflow with zero custom tooling, and it covers the entire history of pushes rather than a single manual check. Because it is enforced server-side by GitHub, it cannot be bypassed by a developer forgetting to run a local script.

Answer

Writing a custom shell script to grep all files for common regex patterns.

Answer

Relying on developers to manually check for secrets before every push.

Answer

Configuring an external firewall to block all traffic containing API keys.

Question 9

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

Accepted Answer

Pin dependencies to specific versions and verify hashes. Pinning dependencies to specific versions and verifying hashes ensures that the exact, known-good version of a library is used in every build, preventing unexpected updates that could introduce vulnerabilities or break functionality. Hash verification (e.g., via SHA-256 checksums) confirms the integrity of the downloaded package, guarding against tampering or supply chain attacks. This approach aligns with CSSLP principles of secure build processes and supply chain risk management.

Answer

Trust all repositories by default

Answer

Download libraries from the developer's website

Answer

Always use the 'latest' version

Question 10

A development team is designing a desktop application that must call a third-party payment API. The vendor requires the application to prove its identity to the API using a shared secret. A junior engineer proposes embedding the secret directly in the compiled client binary. The security architect must recommend a design change. Which approach best addresses the underlying design flaw?

Accepted Answer

Route the payment call through a server-side component that holds the secret and authenticates to the payment API on the client's behalf.. A secret embedded in a client binary is inside a trust boundary controlled by the attacker, so no amount of obfuscation, local storage, or transport encryption makes it safe. The correct design moves the privileged credential to a server-side broker that the client calls, keeping the vendor secret out of the untrusted environment. This is the standard pattern for public clients that must reach an API requiring a confidential credential.

Answer

Obfuscate the binary and encrypt the embedded secret with a hardcoded key so that casual inspection tools cannot recover it.

Answer

Store the secret in the operating system credential manager on the user's machine and have the application read it at runtime.

Answer

Require the client to send the secret over TLS so that network eavesdroppers cannot capture it in transit.

Question 11

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

Accepted Answer

Isolate the fuzzing environment from production data.. Option C is correct because fuzz testing deliberately sends malformed, unexpected, and potentially destructive inputs, so the fuzzing environment must be isolated from production data to prevent corruption, data leakage, or service disruption. Option E is correct because monitoring application logs for crash signals, exceptions, stack traces, and error codes is essential to detect the faults fuzzing is designed to uncover and to reproduce and triage them. Option A is wrong because disabling logging removes the very evidence needed to identify crashes and exceptions, undermining the purpose of fuzzing. Option B is wrong because manual input does not scale and defeats the automation that makes fuzzing effective at generating large volumes of varied test cases. Option D is wrong because using a production environment risks real data and availability, whereas fuzzing should run in an isolated, non-production environment.

Answer

Disable all logging to improve fuzzing speed.

Answer

Manually input all test cases.

Answer

Use a production environment for maximum realism.

Question 12

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

Accepted Answer

Document the risk and perform a formal risk assessment. A CSSLP's role in requirements analysis is to surface and quantify security risk, not to unilaterally veto business requests. Documenting the risk and performing a formal risk assessment gives stakeholders the information needed to make an informed accept/mitigate/reject decision, preserving the requirements-engineering process. This aligns with CSSLP's emphasis on integrating risk management into the SDLC rather than acting as a gatekeeper.

Answer

Immediately reject the request

Answer

Update the password policy

Answer

Implement the bypass in dev only

Question 13

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

Accepted Answer

Checking authorization for every access request.. The Complete Mediation principle requires that every access request to a resource be checked for authorization, not just at login or at certain times. This ensures that no access is granted without a current authorization decision, preventing bypasses due to cached permissions or session hijacking. It is a core principle of secure design, ensuring that each access is validated against the security policy.

Answer

Granting permanent access to all authenticated users.

Answer

Checking authorization only at login.

Answer

Relying on the user to request access when needed.

Answer

Caching permissions to reduce latency.

Question 14

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

Accepted Answer

Define specific versions for all dependencies in a lock file and use a private repository with scoped registries.. Dependency confusion attacks exploit misconfigured package managers that check public registries for packages not found internally. Option B directly mitigates this by using a lock file to pin exact versions (preventing automatic pulling of newer malicious versions) and a private repository with scoped registries (ensuring that internal packages are only fetched from trusted sources, not public ones). This combination prevents the attacker from registering a public package with the same name as an internal one and having it pulled during build.

Answer

Run all build processes in an isolated network segment without internet access.

Answer

Use only open-source software libraries.

Answer

Regularly scan the public registries for malicious packages.

Question 15

Which design activity helps identify security requirements during the earliest phases of the SDLC?

Accepted Answer

Abuse case modeling.. Abuse case modeling is a design activity that helps identify security requirements early in the SDLC by considering how an attacker might misuse the system. It involves brainstorming potential abuse scenarios and deriving security requirements to prevent them. Penetration testing, incident response planning, and static code analysis are typically performed later in the SDLC and do not primarily serve to identify security requirements during the earliest phases.

Answer

Penetration testing.

Answer

Incident response planning.

Answer

Static code analysis.