CSSLP Practice Exam 3 — 20 Questions

Question 1

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

Accepted Answer

Digitally signing code commits and build artifacts.. Code signing and dependency analysis are essential for verifying the source of code and the security of imported libraries.

Answer

Increasing the frequency of manual code uploads.

Answer

Using only open-source libraries without vetting.

Answer

Ensuring all developers have root access to production.

Question 2

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 3

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

Accepted Answer

Transformation Procedures (TPs). Clark-Wilson uses Transformation Procedures (TPs) to move system state from one consistent state to another, strictly controlling access.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Security Labels

Question 4

You are designing an application that integrates with a legacy system. Which design strategy minimizes the risk of the legacy system's vulnerabilities affecting your application?

Accepted Answer

Creating an abstraction layer (wrapper/adapter) to sanitize all data exchanged.. An abstraction layer acts as a buffer, sanitizing and normalizing data before it enters or leaves the application.

Answer

Migrating all legacy data immediately.

Answer

Direct integration via shared database tables.

Answer

Granting the legacy system full administrative privileges in the new system.

Question 5

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

Accepted Answer

Enforcing mutual TLS (mTLS) for authentication.. Input validation, rate limiting, and mTLS are three different layers of defense protecting the API.

Answer

Hardcoding API keys in the code for efficiency.

Answer

Relying solely on the WAF for security.

Question 6

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Accepted Answer

Non-repudiation. Digital signatures are the standard mechanism for proving authenticity and non-repudiation.

Answer

Authorization

Answer

Encryption

Answer

Availability

Answer

Confidentiality

Question 7

Which TWO of the following design patterns improve the resilience of a secure system?

Accepted Answer

Fail-safe defaults.. Fail-safe defaults and fail-secure design ensure systems remain in a known secure state upon failure.

Answer

Allowing all traffic on port 80 for compatibility.

Answer

Security through obscurity.

Answer

Hard-coding credentials for quick recovery.

Question 8

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

Accepted Answer

Using random, non-predictable UUIDs for resource identifiers.. Checking ownership on every request and using non-predictable resource IDs are key BOLA defenses.

Answer

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Answer

Relying on the frontend to hide sensitive objects.

Answer

Using base64 encoded strings for all database IDs.

Question 9

Which TWO of the following actions support the 'Open Design' security principle?

Accepted Answer

Publishing the system architecture for security review.. Open design suggests that security should not rely on the secrecy of the design or the algorithm itself (Kerckhoffs's principle).

Answer

Keeping the API endpoint documentation private.

Answer

Hiding the source code from all development team members.

Answer

Using a proprietary, secret encryption algorithm.

Question 10

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

Accepted Answer

Availability. Availability specifically refers to the system's ability to remain operational and accessible.

Answer

Non-repudiation

Answer

Integrity

Answer

Authentication

Answer

Confidentiality

Question 11

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

Accepted Answer

Tampering. STRIDE categories are Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Answer

Encryption

Answer

Identification

Question 12

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Accepted Answer

Using a user-friendly mobile app push notification for authentication.. Psychological acceptability ensures that security measures are easy for users to understand and use, so they don't circumvent them.

Answer

Providing zero feedback to users during the login process.

Answer

Requiring a 64-character password changed every 24 hours.

Answer

Disabling the ability for users to reset their own passwords.

Answer

Forcing users to solve a complex CAPTCHA at every login attempt.

Question 13

Which TWO of the following are examples of how software can maintain 'Integrity'?

Accepted Answer

Using cryptographic hash functions (e.g., SHA-256) to verify file contents.. Integrity is maintained through mechanisms that ensure data is not tampered with.

Answer

Encrypting data at rest using AES.

Answer

Ensuring the server is always online.

Answer

Forcing users to change passwords regularly.

Question 14

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 15

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Accepted Answer

Encoding output to prevent XSS attacks in the browser.. Defense-in-depth uses multiple layers like input validation, authentication, and output encoding.

Answer

Relying solely on the network firewall for all security.

Answer

Allowing all traffic through the API Gateway for performance.

Question 16

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 17

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 18

Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?

Accepted Answer

Implement image signing and verification (e.g., Docker Content Trust or Cosign).. Using signed, immutable images from a private container registry ensures that build environments cannot be altered by unauthorized parties.

Answer

Disable all outbound network access from the build server.

Answer

Automatically pull the latest 'alpine' image during build time.

Answer

Rotate the build server SSH keys daily.

Question 19

When setting up operational monitoring, what is the 'Golden Signal' that specifically indicates a potential Denial of Service (DoS) attack?

Accepted Answer

A significant increase in the rate of 5xx errors and request latency.. A sudden spike in error rates or latency, combined with high request volume, is a primary indicator of a DoS attack.

Answer

An increase in the number of developers logged into the system.

Answer

A decrease in CPU utilization across all servers.

Answer

A reduction in database write operations.

Question 20

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Accepted Answer

Implement robust authentication. Disabling unused methods, authentication, and rate limiting are standard API hardening techniques.

Answer

Use cleartext headers for all communication

Answer

Expose full internal database schemas