CSSLP Practice Exam 2 — 20 Questions

Question 1

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 2

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

Accepted Answer

To identify which security controls and protection levels are required for specific data assets.. Data classification allows for the application of appropriate security controls based on the data's risk profile.

Answer

To identify the database engine version.

Answer

To automate the backup frequency of the database.

Answer

To determine which data needs to be deleted periodically.

Question 3

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Accepted Answer

Analyzing the implementation of HttpOnly and Secure flags on session cookies.. Session management is best reviewed by analyzing the cookie attributes and token handling flows.

Answer

Checking for SQL injection in login forms.

Answer

Reviewing the database schema for password hashing algorithms.

Answer

Verifying the presence of a Web Application Firewall (WAF).

Question 4

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

Accepted Answer

Enforcing centralized, server-side authorization checks for every request.. Policy-based access control (RBAC or ABAC) ensures users only access resources they are authorized to.

Answer

Using HTTPS for all communications.

Answer

Implementing a strong password policy.

Answer

Relying on client-side hidden fields to identify user roles.

Question 5

Which design principle is exemplified by implementing a Web Application Firewall (WAF) to inspect incoming traffic before it hits the application logic?

Accepted Answer

Defense in depth.. Defense in depth uses multiple layers of security to protect assets, ensuring that one failure does not lead to a total compromise.

Answer

Fail-safe defaults.

Answer

Complete mediation.

Answer

Economy of mechanism.

Question 6

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

Accepted Answer

If the authorization check fails, explicitly deny the request.. Fail-safe defaults mean that if an error or crash occurs, the system defaults to the most secure state (e.g., access denied).

Answer

If the authentication service is down, allow access to all users.

Answer

If the firewall fails, allow all traffic to pass through.

Answer

Default all new user accounts to 'Administrator' role.

Answer

If the load balancer times out, bypass the application logic.

Question 7

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

Accepted Answer

Verify the digital signature using a trusted public key from your organization's key store.. Cryptographic signing (such as GPG or Cosign for containers) creates a verifiable link between the source code and the binary.

Answer

Check the file timestamp using the operating system's file system metadata.

Answer

Upload the artifact to a public VirusTotal scan before deploying.

Answer

Compare the file size of the artifact with the size listed in the manifest file.

Question 8

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.

Question 9

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Accepted Answer

Disabling all unused services and ports in the production container image.. Secure by default means security controls are enabled without user intervention, such as disabling unnecessary features.

Answer

Allowing administrative access to all users by default.

Answer

Using self-signed certificates in the development environment only.

Answer

Providing a configuration wizard to enable SSL after deployment.

Question 10

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

Accepted Answer

To restrict access to the minimum necessary for a task.. PoLP ensures that entities are granted only the minimum level of access required to perform their functions.

Answer

To simplify administrative tasks by giving everyone full access.

Answer

To ensure that security controls are invisible to users.

Answer

To provide all users with the same set of permissions.

Answer

To automatically grant permissions based on time of day.

Question 11

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

Accepted Answer

Integrity. The CIA triad consists of Confidentiality, Integrity, and Availability.

Answer

Non-repudiation

Answer

Accounting

Answer

Authentication

Question 12

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Accepted Answer

Assume breach. Zero trust assumes no implicit trust and requires constant verification.

Answer

Trust but verify

Answer

Trust all internal network traffic

Question 13

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

Accepted Answer

Availability. Availability is prioritized by ensuring data access despite server failure through replication.

Answer

Non-repudiation

Answer

Integrity

Answer

Confidentiality

Question 14

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

Accepted Answer

Performing context-aware output encoding at the presentation layer.. Context-aware output encoding prevents browsers from interpreting user input as active content.

Answer

Using a centralized regex filter to strip HTML tags.

Answer

Encrypting all user input before storing it in the database.

Answer

Implementing a strict allow-list for all input fields.

Question 15

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

Accepted Answer

If a system error occurs during login, the system denies access by default.. If the module crashes or encounters an error, the system should default to 'deny' access rather than 'allow'.

Answer

The system automatically resets passwords if a login failure occurs.

Answer

The system permits login if the authentication server is unreachable.

Answer

All new users are granted guest access until the admin verifies them.

Question 16

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Accepted Answer

Confidentiality. Hardcoded keys violate confidentiality because the keys are exposed to anyone with access to the source code.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Answer

Accounting

Question 17

When designing an API, which approach best supports the 'Complete Mediation' principle?

Accepted Answer

Verifying authorization on every single API request.. Complete mediation requires that every access to every object be checked for authority.

Answer

Relying on the frontend to filter out unauthorized menu items.

Answer

Checking authorization only once at the beginning of the user session.

Answer

Allowing public access to all GET methods in the API.

Question 18

You are designing a web application and need to ensure the Principle of Least Privilege is applied to database access. Which approach best satisfies this requirement?

Accepted Answer

Use a dedicated service account restricted to execute-only permissions on specific stored procedures.. Using a service account with scoped permissions to specific tables and stored procedures adheres to least privilege.

Answer

Configure the web application to run as the database administrator account.

Answer

Grant the web application service account DBOwner rights on the production database.

Answer

Enable integrated Windows authentication for all database connections.

Question 19

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

Accepted Answer

Economy of mechanism.. Economy of mechanism ensures that small, simple security designs are easier to verify and less prone to vulnerabilities.

Answer

Open design.

Answer

Complete mediation.

Answer

Defense in depth.

Question 20

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

Accepted Answer

Using a dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager) to inject secrets at runtime.. Retrieving secrets dynamically from a dedicated secret manager at runtime prevents hard-coding and exposure in configuration files.

Answer

Storing secrets in a configuration file within the deployment container.

Answer

Requesting secrets from the user at application startup.

Answer

Hard-coding secrets in the source code as encrypted strings.