CSSLP Practice Test 18 — 15 Questions

Question 1

A software company is developing a cloud-based collaboration platform that will be used by government agencies. The platform must adhere to FedRAMP requirements. The security team is defining security requirements and needs to ensure that data in transit is protected. Which of the following requirements is MOST appropriate to include in the security requirements specification to meet FedRAMP requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The platform must use TLS 1.2 or higher for all data in transit, with approved cipher suites.. FedRAMP requires the use of TLS 1.2 or higher with approved cipher suites for protecting data in transit. This requirement is specific and directly addresses the need to secure data transmitted between users and the cloud platform. Other options address different security aspects or are not the standard for user-facing data in transit.

Answer

The platform must implement IPsec VPN for all user connections.

Answer

The platform must use SSH for all administrative access to the cloud infrastructure.

Answer

The platform must encrypt all data at rest using AES-256.

Question 2

A developer is implementing a file upload feature in a web application. The application must allow users to upload images but prevent the execution of malicious scripts. The developer decides to validate the file extension and MIME type. Which additional security control is most effective to prevent stored cross-site scripting (XSS) via uploaded files?

Accepted Answer

Store uploaded files outside the web root and serve them through a handler that sets the Content-Disposition header to attachment and a safe Content-Type.. The most effective control is to store uploaded files outside the web root and serve them with headers that prevent inline rendering. This ensures that even if a malicious file is uploaded, it cannot be executed in the browser as part of the application's origin. Extension and MIME type validation alone can be bypassed, so additional measures like safe storage and serving are critical.

Answer

Rename all uploaded files to a random string with a .png extension and store them in a directory within the web root.

Answer

Scan all uploaded files with an antivirus engine and reject any that contain suspicious patterns.

Answer

Use a client-side JavaScript validation to check the file's magic bytes before upload.

Question 3

A retail company is designing a mobile application that stores a long-lived refresh token on the device so users stay signed in. The security architect is concerned that a stolen device or a rooted device could yield the token to an attacker. Which design choice best limits the usefulness of a stolen refresh token?

Accepted Answer

Bind the refresh token to a device-held private key using a proof-of-possession mechanism such as DPoP or mutual TLS, and rotate the token on each use.. Proof-of-possession binding ties the token to a non-exportable private key in hardware-backed storage, so possession of the token string alone is insufficient. Rotation on each use adds replay detection. Together these turn a stolen token from a durable credential into a limited, detectable artifact, which is the goal when the device itself may be compromised.

Answer

Encrypt the refresh token with a symmetric key that is embedded in the application binary and obfuscated.

Answer

Require the user to re-enter their password every time the refresh token is used to obtain a new access token.

Answer

Increase the refresh token lifetime to ninety days and store it in the platform keychain or keystore.

Question 4

You are a security architect at a company that develops a widely used mobile banking application. The development team uses a third-party open-source library for encryption. A critical vulnerability is disclosed in that library. What is the MOST effective first step to manage this risk within the secure software lifecycle?

Accepted Answer

Assess the impact of the vulnerability on your application and determine if the vulnerable code path is reachable.. When a vulnerability is disclosed in a third-party component, the first step is to assess its impact on your specific application. This involves determining if the vulnerable code is used and if it is reachable by an attacker. Only then can you decide on the appropriate response, whether it's patching, mitigating, or accepting the risk. This risk-based approach is a core practice in secure software lifecycle management.

Answer

Disable all encryption functionality in the application until a patch is available.

Answer

Immediately remove the library and replace it with a custom-built encryption module.

Answer

Wait for the library maintainers to release a patch and then apply it immediately.

Question 5

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

Accepted Answer

Encode output based on the context where it will be displayed, such as HTML, JavaScript, or SQL.. Whitelist validation and context-aware output encoding are two fundamental techniques for preventing injection attacks. Whitelisting ensures only expected data is accepted, while output encoding neutralizes dangerous characters when data is rendered. Together, they provide strong defense against injection. Blacklisting, client-side validation, and deferred sanitization are less effective and can be bypassed.

Answer

Use a blacklist of known malicious characters and remove them from the input.

Answer

Store all user input in a database without modification and rely on database triggers to sanitize data.

Answer

Rely on client-side JavaScript validation to ensure data integrity before submission.

Question 6

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?

Accepted Answer

Use a dedicated hardware security module (HSM) or key management service (KMS) to store and manage keys.. Using a dedicated HSM or KMS is the most secure way to manage cryptographic keys. These systems provide strong access controls, audit logging, and protection against key extraction. Hard-coding, version-controlled config files, or storing encryption keys with the data are all insecure practices that can lead to key compromise.

Answer

Hard-code the keys in the source code to ensure they are always available.

Answer

Encrypt the keys with a symmetric algorithm and store the encryption key in the same database.

Answer

Store keys in a configuration file that is checked into the version control system.

Question 7

A security architect is reviewing the design of a new web application. The application must ensure that session identifiers are unpredictable and resistant to guessing attacks. The development team proposes using a random number generator. Which approach should the architect recommend to meet this requirement?

Accepted Answer

Use a cryptographically secure pseudo-random number generator (CSPRNG) seeded with a high-entropy source, such as the operating system's entropy pool.. Session identifiers must be generated using a cryptographically secure pseudo-random number generator (CSPRNG) seeded with high entropy to ensure unpredictability. This prevents attackers from guessing or predicting valid session IDs. Other methods, such as standard random generators or predictable data hashing, lack the necessary security properties and can lead to session hijacking.

Answer

Use a sequential counter combined with a secret salt, and store the counter in a client-side cookie.

Answer

Generate session identifiers by hashing the current timestamp and the user's IP address using MD5.

Answer

Use the language's standard random number generator, such as java.util.Random or rand() in C, because it is fast and sufficient for generating session IDs.

Question 8

A healthcare software development team is building a patient portal that must comply with HIPAA. The team has completed a risk assessment and identified several potential threats. They now need to translate these findings into actionable security requirements. Which of the following is the MOST effective approach to ensure that the security requirements adequately address the identified risks?

Accepted Answer

Create a security requirements traceability matrix that links each threat to one or more mitigating security requirements and verifies coverage.. The most effective way to ensure security requirements address identified risks is to establish traceability from threats to requirements. This creates a verifiable link that supports compliance and ensures coverage. Other options either lack structure, rely on generic practices, or are reactive rather than proactive.

Answer

Incorporate general security best practices from OWASP Top 10 into the design and assume they cover the identified threats.

Answer

Hire an external penetration testing firm to test the application after development and fix any vulnerabilities found.

Answer

Document the threats in the risk register and assign them to the development team to address during coding as they see fit.

Question 9

A software team is designing a new employee scheduling application. The architect wants to ensure that if a developer accidentally introduces a memory-safety flaw, the impact is contained and the flaw is detected before release. Which design decision best supports this goal at the architecture level?

Accepted Answer

Choose a memory-safe language for new components and isolate any legacy native code behind a narrow, validated interface.. Selecting a memory-safe language removes the root cause of most memory-safety vulnerabilities, and isolating any legacy native code behind a validated interface contains the remainder. This is an architectural decision that shapes the whole system, unlike tooling or testing practices that act later and depend on developer compliance. The combination addresses both prevention and containment.

Answer

Require developers to run a static analysis tool locally before committing code to the repository.

Answer

Deploy the application behind a web application firewall and enable rate limiting on all endpoints.

Answer

Increase the unit test coverage target to ninety percent for all modules handling employee data.

Question 10

A software architect is designing a system to enforce the principle of least privilege. Which two practices should be implemented to achieve this? (Choose two.)

Accepted Answer

Running services with the minimum required operating system privileges. Least privilege requires that users and services operate with only the permissions necessary to perform their tasks. Assigning permissions based on job roles ensures users have appropriate access, and running services with minimal OS privileges limits the impact of a compromise. These two practices directly enforce least privilege, while the other options either grant excessive rights or fail to revoke unnecessary access.

Answer

Allowing users to retain access rights after they change roles

Answer

Granting users administrative rights by default to avoid access issues

Answer

Using a shared administrator account for all IT staff to simplify management

Question 11

You are the security lead for a healthcare software product that must comply with HIPAA. The organization is adopting a DevSecOps model and wants to ensure that security is measured and improved continuously. Which TWO of the following metrics are MOST appropriate for tracking the effectiveness of the secure software lifecycle management process? (Choose two.)

Accepted Answer

Percentage of applications that have completed a threat model.. Effective security metrics should be outcome-based and drive improvement. MTTR for critical vulnerabilities measures response efficiency, while the percentage of applications with threat models shows proactive risk identification. Both are directly tied to reducing security risk and improving the secure software lifecycle, unlike activity or vanity metrics.

Answer

Average time from code commit to production deployment.

Answer

Total number of security tools deployed in the CI/CD pipeline.

Answer

Number of lines of code reviewed per developer per day.

Question 12

A software development team is adopting a secure design principle that requires the security of a system to depend on the secrecy of the keys, not on the secrecy of the algorithm. Which principle are they implementing?

Accepted Answer

Open design. Open design, also known as Kerckhoffs's principle, asserts that a cryptographic system should be secure even if everything about the system, except the key, is public knowledge. This allows for public scrutiny and avoids reliance on obscurity. The scenario explicitly describes this principle, making open design the correct answer.

Answer

Fail-safe defaults

Answer

Least privilege

Answer

Security by obscurity

Question 13

You are designing a secure software supply chain for a healthcare application that must comply with FDA premarket cybersecurity guidance. Your team proposes using the OWASP Dependency-Check tool within the CI pipeline to identify vulnerable third-party libraries. Which TWO additional practices are essential to establish a defensible component governance process that meets regulatory expectations? (Choose two.)

Accepted Answer

Maintain a formal component inventory that records the exact version, license, and provenance of every third-party library used in the application.. A defensible component governance process requires both transparency and control. Maintaining a formal component inventory provides the traceability needed for incident response and regulatory reporting. Defining and enforcing a policy for handling components with known critical vulnerabilities ensures that risks are explicitly accepted and mitigated. Together, these practices create an auditable, repeatable process that meets FDA expectations and supports ongoing supply chain security.

Answer

Configure the CI pipeline to automatically upgrade all dependencies to the latest version whenever a new release is published, ensuring no known vulnerabilities remain.

Answer

Use a single proprietary scanner for all vulnerability detection and forbid the use of any other tools to ensure consistency across the organization.

Answer

Require all developers to manually review the source code of every third-party library before inclusion to verify there are no security flaws.

Question 14

A security engineer at a healthcare SaaS provider is planning the disposal of decommissioned application servers that hosted an electronic health records system. The servers held encrypted databases and application logs. Which action best satisfies secure decommissioning requirements for the data at rest on these disks while preserving the ability to repurpose the hardware internally?

Accepted Answer

Cryptographically erase the data by destroying the key-encryption keys and the wrapped data-encryption keys held in the application key store, then verify the disks contain only ciphertext.. When data at rest is protected by full-disk or database-level encryption, cryptographic erasure is the most reliable and verifiable decommissioning technique because it removes the means to decrypt rather than relying on overwriting every block. Destroying key-encryption keys and wrapped data-encryption keys, then confirming only ciphertext remains, neutralizes the data while allowing the hardware to be repurposed internally.

Answer

Run the vendor's secure erase command that issues an ATA Secure Erase to the drive controller, then immediately return the disks to the spare pool without further validation.

Answer

Perform a single-pass overwrite of the entire disk with zeros using the manufacturer's low-level format utility, then reinstall the base operating system image.

Answer

Remove the disks, store them in a locked evidence cage indefinitely, and redeploy only the chassis with new disks to the internal lab.

Question 15

A financial services firm mandates that every open-source component pulled into its build pipeline must carry a cryptographically signed provenance attestation from the original project maintainer. During a review, you discover that Sigstore's cosign verification succeeds, but the attestation was generated by an internal CI runner rather than the upstream maintainer. What is the most significant supply chain risk introduced by this configuration?

Accepted Answer

The signature does not bind the artifact to the actual build environment, so a compromised internal runner could attest to malicious code as if it originated upstream.. A provenance attestation is only as trustworthy as the identity it binds to. When an internal CI runner signs an attestation claiming to represent upstream code, the signature proves internal origin, not upstream origin. An attacker who compromises that runner can attest to malicious artifacts, and cosign verification will still succeed because the internal identity is trusted. The correct answer identifies this identity mismatch as the core supply chain risk.

Answer

The cosign verification will fail because Sigstore requires the signer's identity to match the artifact's origin repository, causing builds to break unpredictably.

Answer

The attestation lacks a timestamp from a trusted timestamp authority, making it impossible to determine whether the artifact was built before or after a known vulnerability disclosure.

Answer

The use of an internal runner instead of the upstream maintainer violates the SLSA level 3 requirement for a hosted build platform, automatically downgrading the artifact to SLSA level 1.