CSSLP Practice Test 2 — 10 Questions

Question 1

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

Accepted Answer

Setting the HttpOnly and Secure flags on session cookies.. Using secure, HTTP-only, and SameSite flags are critical for cookie security, and regenerating session IDs prevents fixation.

Answer

Allowing multiple simultaneous sessions for a single user.

Answer

Using long-lived sessions to improve user experience.

Answer

Storing session tokens in the browser's local storage.

Question 2

Which design activity helps identify security requirements during the earliest phases of the SDLC?

Accepted Answer

Abuse case modeling.. Abuse case modeling explores how an attacker might misuse a feature, which helps define security requirements.

Answer

Penetration testing.

Answer

Incident response planning.

Answer

Static code analysis.

Question 3

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Accepted Answer

Repudiation.. Digital signatures provide integrity (detecting tampering) and non-repudiation (proving source).

Answer

Elevation of Privilege.

Answer

Information Disclosure.

Answer

Denial of Service.

Question 4

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Accepted Answer

The type of action performed.. Who (user/service), what (action), and result (success/failure) are mandatory for reconstruction.

Answer

The full password of the user involved in the event.

Answer

The user's home address and phone number.

Question 5

When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?

Accepted Answer

Managing API keys using a secure vault.. Validating input, securing transport, and managing API keys are crucial for third-party integrations.

Answer

Only using HTTP for faster communication.

Answer

Hard-coding the API endpoint URLs in the application.

Question 6

Which THREE of the following are key components of a 'Secure Design Review' process?

Accepted Answer

Validating the architecture against established security patterns.. Reviewing security requirements, threat models, and architectural patterns are foundational to design reviews.

Answer

Writing the final deployment documentation.

Answer

Performing dynamic analysis on the final build.

Question 7

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

Accepted Answer

Digital signatures on the message payload.. Message signing ensures integrity by verifying that the data was not altered after being signed by the sender.

Answer

Logging all messages to a central server.

Answer

Encryption of the message payload.

Answer

Using a private network for all communication.

Question 8

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

Accepted Answer

API Gateway pattern acting as an identity provider proxy.. The API Gateway pattern centralizes authentication, preventing every microservice from having to implement its own logic.

Answer

Centralized database user management.

Answer

Service Mesh with mutual TLS enabled.

Answer

Sidecar pattern using a local proxy for mTLS.

Question 9

You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?

Accepted Answer

The write is denied because the *-property prohibits writing to a higher security level.. The *-property (star-property) of Bell-LaPadula prevents 'write-down', meaning a subject cannot write to a lower level, but also enforces no-read-up/no-write-down rules.

Answer

The write is permitted.

Answer

The write is denied due to the no-write-down rule.

Answer

The system allows the write only if encryption is used.

Question 10

During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?

Accepted Answer

Implement Mutual TLS (mTLS) for all inter-service communications.. TLS is the standard design pattern for ensuring confidentiality and integrity in transit.

Answer

Implement OAuth 2.0 scopes on the API gateway.

Answer

Use a Hardware Security Module (HSM) to store API keys.

Answer

Enable request rate limiting on the gateway.