CSSLP Practice Exam 2 — 20 Questions

Question 1

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 2

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Accepted Answer

Using AES-256 encryption. AES-256 is a symmetric block cipher approved by NIST (FIPS 197) and is the standard recommendation for encrypting data at rest in databases, offering strong confidentiality with acceptable performance. It is used in modes like GCM or CBC with proper key management (e.g., KMS, HSM) to protect sensitive fields, tablespaces, or full-disk volumes.

Answer

Using cleartext with database permissions

Answer

Using MD5 hashing

Answer

Storing data in base64 encoding

Question 3

A healthcare SaaS provider is designing a multi-tenant web application where each hospital customer's data must remain logically isolated. The design team proposes using a single shared database schema with a tenant identifier column on every table, enforced by application-layer query filters. A security architect must evaluate this proposal. Which design concern is the MOST significant risk with this approach?

Accepted Answer

A defect in any single query filter can expose one tenant's records to another tenant, because isolation depends entirely on application code being correct in every data access path.. Application-enforced tenant filtering places the entire isolation guarantee inside code that changes constantly, so any missed predicate, raw SQL query, or new feature path can leak one hospital's records to another. Database-enforced controls such as row-level security or schema-per-tenant provide a backstop that survives application defects. The dominant design risk is therefore the absence of a defense-in-depth boundary, not encryption, performance, or a non-existent regulatory mandate.

Answer

A tenant identifier column prevents the database from using indexes effectively, causing query performance to degrade until row-level security can be introduced.

Answer

Multi-tenant applications built on a single schema cannot meet HIPAA because the regulation explicitly requires physically separate databases for each covered entity.

Answer

Shared schemas cannot support per-tenant encryption keys, so data at rest would necessarily be stored in plaintext across all hospital customers.

Question 4

A healthcare SaaS provider is designing a multi-tenant system where each tenant's data is stored in a shared database. To prevent one tenant from accessing another tenant's records, the design team decides to enforce isolation at the data-access layer. Which secure design approach best ensures tenant isolation while maintaining a single logical database?

Accepted Answer

Implement row-level security (RLS) policies in the database that automatically filter rows based on the tenant identifier associated with the authenticated session.. Row-level security (RLS) enforces tenant isolation directly in the database engine, automatically filtering data based on the authenticated tenant context. This provides a strong, centralized control that is not dependent on application code correctness, reducing the risk of cross-tenant data leakage. It aligns with the principle of defense in depth and is well-suited for multi-tenant architectures with shared databases.

Answer

Use a separate database schema for each tenant within the same database instance, and grant each tenant's application role access only to its own schema.

Answer

Rely on application code to always include a WHERE clause filtering by tenant ID in every query, and perform code reviews to ensure compliance.

Answer

Encrypt each tenant's data with a unique encryption key and store the keys in a hardware security module (HSM), decrypting only after the application retrieves the data.

Question 5

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

Accepted Answer

Setting the HttpOnly and Secure flags on session cookies.. Option C is correct because setting the HttpOnly flag prevents client-side JavaScript from accessing the session cookie, mitigating XSS-based session theft, while the Secure flag ensures the cookie is only transmitted over HTTPS, protecting it from interception on plaintext channels. Option E is correct because regenerating the session ID after successful authentication prevents session fixation attacks, where an attacker pre-sets a known session ID and hijacks the authenticated session. Option A is not essential and can actually weaken security by increasing the attack surface and complicating session tracking. Option B is incorrect because long-lived sessions increase the window of opportunity for token theft or replay; secure designs favor short lifetimes with re-authentication or refresh tokens. Option D is incorrect because storing session tokens in localStorage exposes them to XSS since JavaScript can read them, unlike HttpOnly cookies.

Answer

Allowing multiple simultaneous sessions for a single user.

Answer

Using long-lived sessions to improve user experience.

Answer

Storing session tokens in the browser's local storage.

Question 6

When designing secure software, why is 'Economy of Mechanism' important?

Accepted Answer

To minimize the attack surface by keeping the design simple.. Economy of Mechanism is a core security design principle (from Saltzer and Schroeder) that advocates for simple, minimal designs. By keeping the design as simple as possible, the number of potential vulnerabilities and entry points for attackers is reduced, directly minimizing the attack surface. This simplicity also makes the system easier to verify and secure.

Answer

To lower the cost of hardware infrastructure.

Answer

To increase the lines of code for better functionality.

Answer

To ensure that the software is faster at runtime.

Answer

To enable easier debugging for developers.

Question 7

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 8

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Accepted Answer

Non-repudiation. Digital signatures are the standard mechanism for proving authenticity and non-repudiation.

Answer

Authorization

Answer

Encryption

Answer

Availability

Answer

Confidentiality

Question 9

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE's Information Disclosure category covers the exposure of information to unauthorized parties, which is exactly what traffic sniffing achieves — an attacker on the network path reads data that should be confidential. Sniffing between a client and web server exposes credentials, session tokens, or sensitive payloads, so the threat being modeled is Information Disclosure. The other STRIDE categories describe different attacker goals (spoofing identity, tampering with data, etc.), not confidentiality loss.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 10

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

Accepted Answer

If a system error occurs during login, the system denies access by default.. If the module crashes or encounters an error, the system should default to 'deny' access rather than 'allow'.

Answer

The system automatically resets passwords if a login failure occurs.

Answer

The system permits login if the authentication server is unreachable.

Answer

All new users are granted guest access until the admin verifies them.

Question 11

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 12

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Accepted Answer

Implement centralized log aggregation with automated alerting for security events.. Option B is correct because centralized log aggregation (e.g., shipping application and server logs to a SIEM such as Splunk, ELK, or a cloud-native service) combined with automated alerting enables continuous detection of security events like brute-force attempts, privilege escalation, or anomalous access patterns during the operational lifecycle. Option C is correct because strict egress filtering — allowing outbound traffic only to known, required destinations and ports via firewall or security group rules — limits command-and-control callbacks, data exfiltration, and lateral movement if the application is compromised. Option A is wrong because publishing internal server IP addresses in public DNS records exposes the internal topology and increases the attack surface rather than securing the application. Option D is wrong because permitting all inbound traffic on port 80 (HTTP) unconditionally removes access controls and enables exploitation of web-facing vulnerabilities; availability should be achieved through redundancy, not open ports. Option E is wrong because disabling all egress traffic breaks legitimate application functionality (updates, APIs, database calls) and is an over-restrictive measure; egress should be filtered to approved destinations, as in option C.

Answer

Share all internal server IP addresses in the public DNS records.

Answer

Permit all inbound traffic on port 80 to ensure maximum availability.

Answer

Disable all egress traffic from the application servers to prevent data exfiltration.

Question 13

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 14

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case modeling deliberately thinks like an attacker, enumerating misuse scenarios and entry points that legitimate use cases overlook. It is specifically designed to surface attack surfaces such as unauthenticated endpoints, parameter tampering, and privilege escalation paths. This makes it the best elicitation technique for identifying exploitable API entry points.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 15

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

Accepted Answer

To intercept and manage network traffic to enforce mTLS and authorization policies.. A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Answer

To act as a backup for the main container if it crashes.

Answer

To provide additional CPU and memory resources to the main container.

Answer

To store persistent data for the main application.

Question 16

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 17

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 18

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 19

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). A digital signature (e.g., Authenticode on Windows, GPG on Linux) uses asymmetric cryptography to provide both integrity and origin authenticity. The vendor signs the code with its private key; you verify with the vendor's public key, confirming the code has not been tampered with and genuinely came from that vendor. This is the only mechanism in the list that proves both integrity and origin.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 20

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.