CSSLP Practice Test 17 — 15 Questions

Question 1

Which of the following is an example of defense-in-depth in a web application architecture?

Accepted Answer

Implementing input validation, parameterized queries, and a Web Application Firewall (WAF).. Defense-in-depth layers multiple independent controls so that a failure or bypass of one does not compromise the whole system. Option C combines three distinct layers: input validation at the application code layer, parameterized queries at the data-access layer to prevent SQL injection, and a WAF at the network/edge layer to filter malicious HTTP traffic. Together they address the same threat class (injection) through different mechanisms, which is the textbook definition of layered defense.

Answer

Disabling all firewall rules for testing purposes.

Answer

Storing all application data in a single encrypted volume.

Answer

Removing all logs to prevent unauthorized access to audit trails.

Answer

Using a single strong password for all database accounts.

Question 2

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.

Question 3

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

Accepted Answer

The Software Requirements Specification (SRS). Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Answer

The Penetration Testing Report

Answer

The Infrastructure-as-Code (IaC) templates

Answer

The Risk Register

Question 4

When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?

Accepted Answer

Use a remote backend like S3 with server-side encryption enabled and restricted IAM policies.. Terraform state files contain sensitive data such as resource IDs, IP addresses, and sometimes plaintext secrets. Storing them in a remote backend like Amazon S3 with server-side encryption (SSE) and tightly scoped IAM policies ensures that the state is encrypted at rest, access is audited and controlled, and the file is not exposed on local disks or in version control. This practice aligns with the principle of least privilege and defense in depth for infrastructure secrets.

Answer

Rename the state file to 'secret.tfstate' to hide it from attackers.

Answer

Store state files in a version-controlled Git repository for change tracking.

Answer

Manually delete the state file after every Terraform apply command.

Question 5

A security analyst is reviewing the results of a dynamic application security testing (DAST) scan against a REST API. The scan report includes several findings, but the analyst must prioritize remediation. Which two factors are most important to consider when triaging DAST findings for an API? (Choose two.)

Accepted Answer

The potential impact on confidentiality, integrity, and availability of the API's data.. Triage of DAST findings should focus on risk, which is a function of impact and likelihood. The potential impact on confidentiality, integrity, and availability determines the consequences of exploitation, while ease of exploitation indicates likelihood. Together, these factors allow the analyst to prioritize vulnerabilities that pose the greatest threat to the API and its data.

Answer

The HTTP status code returned by the API endpoint when the vulnerability is triggered.

Answer

The number of times the vulnerability appears in the scan report.

Answer

The scanner's confidence level as reported in the tool's output.

Question 6

A healthcare SaaS provider must ensure that only authorized clinicians can view patient records, and that any access is logged with a tamper-evident trail. The lead architect proposes implementing role-based access control (RBAC) with digital signatures on audit logs. Which security objective does this combination primarily satisfy?

Accepted Answer

Accountability. Accountability is the security objective that ties actions to identities. RBAC enforces authorized access, and tamper-evident audit logs provide a reliable record of who did what. Together, they enable holding clinicians responsible for viewing patient records. Non-repudiation is related but focuses on preventing denial of an action, while confidentiality and availability address different aspects of security.

Answer

Availability

Answer

Confidentiality

Answer

Non-repudiation

Question 7

A financial services firm is designing a new mobile banking app. The security team wants to ensure that even if an attacker compromises one component, they cannot easily move laterally to access sensitive customer data. Which secure design principle should be prioritized to limit the blast radius of a compromise?

Accepted Answer

Isolation and compartmentalization. Isolation and compartmentalization directly address the need to contain a compromise by separating components and enforcing boundaries. This limits an attacker's ability to move laterally from a compromised component to sensitive data. While defense in depth is valuable, it is a broader concept; the specific goal of limiting blast radius is best served by isolating components and controlling interfaces.

Answer

Separation of duties

Answer

Least common mechanism

Answer

Defense in depth

Question 8

A retail company runs a payment microservice in production. During a security review, the team must confirm that the service can detect and respond to anomalous administrative actions in near real time. The service runs on a container platform and writes structured events to a central log store. Which practice best ensures that administrative actions are detected and acted upon promptly?

Accepted Answer

Configure the platform audit log to record administrative API calls, forward those events to a SIEM, and create correlation rules that alert the on-call team when anomalous patterns occur.. Audit logs from the container platform capture authoritative records of administrative API calls. Forwarding them to a SIEM with correlation rules enables near-real-time detection of anomalous patterns, and routing alerts to the on-call team closes the response loop. This combination directly addresses both detection speed and response capability required for the payment microservice.

Answer

Deploy a host-based intrusion detection agent on each node and depend on its generic signature set to flag administrative misuse.

Answer

Rely on the container platform's default event stream and review it weekly during the operations stand-up meeting.

Answer

Enable verbose application logging at the debug level for all requests and retain logs for thirty days in the central store.

Question 9

A team is designing a browser-based single-page application that will call backend microservices directly from the client. The security architect wants to reduce the risk that a malicious script injected into the page can silently perform privileged actions on behalf of a logged-in user. Which TWO design choices best reduce this risk? (Choose two.)

Accepted Answer

Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to a vetted allowlist.. The two effective controls are keeping tokens out of persistent browser storage with short lifetimes, and enforcing a strict Content Security Policy. Together they reduce both the likelihood that injected script executes and the value of any token it might obtain. Neither alone is sufficient, and controls aimed at cross-site request forgery or permissive CORS do not address the same-origin injection threat described.

Answer

Move all authorization decisions to the client so the backend can trust requests that pass the UI checks.

Answer

Rely on the SameSite=Strict attribute on the session cookie as the sole control against cross-site request forgery.

Answer

Enable CORS with the wildcard origin so any front end can call the microservices without preflight failures.

Question 10

A software development team is adopting a secure software testing strategy. They want to ensure that security testing is performed continuously and that feedback is provided to developers as early as possible. Which testing approach best aligns with this goal?

Accepted Answer

Integrate automated security testing into the CI/CD pipeline.. Integrating automated security testing into the CI/CD pipeline embeds security checks into the development workflow, running on every commit or build. This provides immediate, continuous feedback to developers, allowing them to fix issues early when they are cheapest to remediate. It aligns with the shift-left philosophy and ensures consistent security coverage without relying on manual triggers.

Answer

Perform manual code reviews for security issues before each release.

Answer

Conduct a penetration test at the end of each development cycle.

Answer

Run a static analysis scan only when a security champion requests it.

Question 11

A software vendor provides a critical component to your organization. During contract negotiations, you request that the vendor provide a Software Bill of Materials (SBOM) for each release. The vendor agrees to provide a document listing all open-source libraries and their versions. Which additional attribute is most important to include in the SBOM to support rapid vulnerability response?

Accepted Answer

The cryptographic hash of each component artifact.. Including cryptographic hashes in an SBOM provides a precise fingerprint for each component. When a vulnerability is announced, you can compare the hash of your deployed artifact against known vulnerable hashes or use it to verify that the correct component is being analyzed. This eliminates ambiguity from version strings and supports automated, rapid response. Other attributes like licenses and repository URLs are valuable but do not fulfill the critical need for exact identification.

Answer

The URL of the project's public repository.

Answer

The name of the developer who contributed the most lines of code to each library.

Answer

The license type of each component.

Question 12

A security tester is performing interactive application security testing (IAST) on a Java web application. The IAST agent is deployed in the test environment and instruments the application during automated functional tests. The tester notices that the IAST tool reports a high number of false positives for SQL injection. What is the most likely cause of these false positives?

Accepted Answer

The IAST agent is detecting tainted data flows that are actually safe due to input validation or parameterized queries.. IAST tools instrument the application and monitor data flow at runtime. False positives for SQL injection often occur when the tool fails to recognize that input validation or parameterized queries have neutralized the taint. The agent may still track the tainted data to the database sink and flag it as a vulnerability, even though the query is safe. Tuning the tool's rules and ensuring it understands the application's frameworks can mitigate this issue.

Answer

The application is using an object-relational mapping (ORM) framework that generates dynamic SQL.

Answer

The IAST agent is not configured to monitor database queries.

Answer

The automated functional tests do not exercise all application code paths.

Question 13

You are leading a secure software initiative at a mid-sized fintech company. The development teams have adopted an Agile methodology with two-week sprints, and management wants to ensure that security activities are integrated into the development process without slowing down delivery. Which of the following is the MOST effective approach to integrate security into the Agile lifecycle?

Accepted Answer

Define security requirements as user stories and include security-focused acceptance criteria in each sprint.. Integrating security into Agile requires making it part of the routine work, not an afterthought. Defining security requirements as user stories with acceptance criteria ensures that security is planned, implemented, and tested within each sprint. This approach is proactive, scalable, and aligns with the shift-left philosophy, enabling teams to maintain velocity while building secure software.

Answer

Assign a dedicated security team to perform penetration testing after each sprint.

Answer

Conduct a comprehensive security review at the end of each sprint before the release.

Answer

Implement a security gate that requires a full threat model before any code is written for each user story.

Question 14

A software development team is adopting a Secure Software Lifecycle (S-SDLC) process. They have defined security requirements, performed threat modeling, and are now in the implementation phase. Which of the following activities is MOST critical during the implementation phase to ensure secure code?

Accepted Answer

Performing static application security testing (SAST) on the code as it is written.. During implementation, the most critical activity is to ensure that code is written securely. Integrating SAST into the development environment provides real-time feedback, enabling developers to identify and fix security flaws as they code. This proactive approach is central to the shift-left philosophy and is more effective than relying on later testing phases.

Answer

Reviewing the threat model with the development team before coding begins.

Answer

Creating a detailed security architecture document for future reference.

Answer

Conducting a penetration test of the application in a staging environment.

Question 15

A financial services firm is rolling out a new release of its customer portal. The release includes updated third-party libraries and a modified container base image. Before promoting the build to production, the release manager must ensure the integrity and provenance of the artifacts. Which action best provides verifiable provenance and tamper detection for the container image?

Accepted Answer

Sign the container image with a cryptographic private key and record the signature plus build metadata in an attestation that consumers verify with the corresponding public key before deployment.. Cryptographic signing of the container image, combined with an attestation of build metadata, delivers both provenance and tamper detection because consumers can verify the signature against a trusted public key before deployment. Access controls and vulnerability scans address adjacent risks but cannot prove that the artifact is unmodified or identify its origin, which is what the release gate requires.

Answer

Compute an MD5 checksum of the compiled binary and publish it alongside the release notes so operators can compare it after download.

Answer

Restrict registry access with role-based credentials so only the release team can push images, and rely on that access control as the integrity guarantee.

Answer

Scan the image with a vulnerability scanner and block promotion if any critical CVEs are found, treating a clean scan as proof of integrity.