CSSLP Practice Exam 3 — 20 Questions

Question 1

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

Accepted Answer

Lack of security expertise within development teams.. Option B is correct because in large organizations development teams often lack dedicated application-security skills (e.g., secure coding, threat modeling, SAST/DAST interpretation), so security must be embedded via training and champions rather than assumed. Option C is correct because integrating security tooling such as SAST, DAST, SCA, and secret scanning into existing CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions) is technically complex, often slows builds, and produces false positives that must be triaged. Option D is correct because a Secure SDLC requires cultural and process change—shifting security left, adding gates, and changing developer workflows—which typically meets organizational resistance. Option A is not a standard challenge of Secure SDLC implementation; the real tension is balancing security with delivery speed, not that development itself is inherently too slow. Option E is incorrect because large organizations rarely suffer from having too much security budget; budget constraints and tool sprawl are the more common issues.

Answer

The speed of software development is too slow.

Answer

Having too much budget for security tools.

Question 2

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

Accepted Answer

Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.. Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Answer

Run 'npm audit fix' before every build process.

Answer

Add the dependency to the 'bundledDependencies' array in package.json.

Answer

Enable 'strict-ssl' in the global npm configuration.

Question 3

Which document is essential to map regulatory compliance requirements to specific software features?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A Security Requirements Traceability Matrix (SRTM) maps security and regulatory requirements to specific software features, controls, and test cases, providing bidirectional traceability from requirement to implementation and verification. It is the essential document for demonstrating that each regulatory obligation is addressed by a concrete feature or control. This traceability is critical for audits (e.g., PCI DSS, HIPAA, SOX) and for change management.

Answer

System Architecture Document

Answer

Incident Response Plan

Answer

Software Development Plan

Question 4

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Accepted Answer

Reduces the total cost of remediation. Option A is correct because addressing security requirements during early SDLC phases (such as requirements and design) allows flaws to be identified and fixed before code is written or deployed, and defects found later in production or even in testing are dramatically more expensive to remediate — this is the well-established "shift left" cost curve. Option B is correct because incorporating security requirements early ensures that security controls and architecture are designed to support the organization's business objectives, compliance obligations, and risk tolerance rather than being bolted on afterward, keeping security aligned with business requirements. Option C is incorrect because penetration testing remains a necessary validation activity regardless of when security requirements are introduced; early requirements reduce but never eliminate the need for adversarial testing. Option D is incorrect because security requirements typically increase documentation (policies, threat models, control mappings, test evidence) rather than reduce it. Option E is incorrect because security testing cannot be removed — early requirements complement, not replace, verification and validation activities such as SAST, DAST, and penetration testing.

Answer

Eliminates the need for penetration testing

Answer

Reduces the amount of documentation required

Answer

Allows for the removal of all security testing

Question 5

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline

Question 6

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

Accepted Answer

To restrict access to the minimum necessary for a task.. PoLP ensures that entities are granted only the minimum level of access required to perform their functions.

Answer

To simplify administrative tasks by giving everyone full access.

Answer

To ensure that security controls are invisible to users.

Answer

To provide all users with the same set of permissions.

Answer

To automatically grant permissions based on time of day.

Question 7

Which TWO of the following are examples of how software can maintain 'Integrity'?

Accepted Answer

Using cryptographic hash functions (e.g., SHA-256) to verify file contents.. Integrity means ensuring data is not altered in an unauthorized or undetected way, and option C supports this directly: cryptographic hash functions such as SHA-256 produce a fixed-length digest of file contents, so recomputing the hash and comparing it to a trusted value detects any modification to the data. Option D also supports integrity because strong access control lists (ACLs) restrict who may write to or modify a resource, preventing unauthorized changes at the source. By contrast, option A (AES encryption at rest) primarily provides confidentiality, option B (server always online) addresses availability, and option E (forcing regular password changes) is an authentication/credential-hygiene control, none of which by themselves guarantee that data remains unaltered.

Answer

Encrypting data at rest using AES.

Answer

Ensuring the server is always online.

Answer

Forcing users to change passwords regularly.

Question 8

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) is the recommended mechanism for gRPC service-to-service authentication because gRPC is built on HTTP/2 over TLS, and mTLS provides bidirectional certificate-based authentication of both client and server. Each service presents a certificate, so the caller verifies the callee's identity and vice versa, and the channel is encrypted end-to-end. This aligns with zero-trust principles and is natively supported by gRPC's channel credentials without application-layer token handling.

Answer

HTTP Basic Auth

Answer

IP allow-listing

Answer

Shared API keys in headers

Question 9

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 10

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase

Question 11

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

Accepted Answer

Using a dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager) to inject secrets at runtime.. Retrieving secrets dynamically from a dedicated secret manager at runtime prevents hard-coding and exposure in configuration files.

Answer

Storing secrets in a configuration file within the deployment container.

Answer

Requesting secrets from the user at application startup.

Answer

Hard-coding secrets in the source code as encrypted strings.

Question 12

What is the primary security benefit of using a hardened container base image for microservices?

Accepted Answer

It reduces the attack surface. A hardened container base image removes unnecessary packages, services, shells, and default credentials, reducing the number of potential vulnerabilities and entry points an attacker can exploit. This directly shrinks the attack surface, which is the primary security benefit. Hardening does not inherently improve speed, encrypt logs, or remove the need for patching.

Answer

It increases execution speed

Answer

It automatically encrypts application logs

Answer

It eliminates the need for patching

Question 13

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 14

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 15

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 16

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Accepted Answer

The tag is mutable, allowing an attacker to inject a malicious image.. The ':latest' tag is a mutable pointer, not a fixed version identifier. When a build server pulls 'image:latest', it retrieves whatever image the registry currently associates with that tag, which may differ from the image previously tested or approved. An attacker who compromises the upstream repository or registry account can push a malicious image under ':latest', and the next build will silently consume it — a classic software supply chain attack.

Answer

The tag prevents container layer caching.

Answer

The registry will throttle downloads of the ':latest' tag.

Answer

The tag is deprecated in favor of ':stable'.

Question 17

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 18

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). The Security Requirements Traceability Matrix (SRTM) is the documentation artifact that maps each security requirement to its source, design, implementation, and test evidence. Since the security team has determined that SMS-based MFA is insufficient for high-risk administrative accounts, this specific requirement must be captured and traced through the SDLC. The SRTM ensures the requirement is not lost and can be verified during testing and audit.

Answer

Threat Intelligence Feed

Answer

Change Request Log

Answer

Project Charter

Question 19

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Accepted Answer

To update the SDLC to prevent similar future vulnerabilities.. Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Answer

To calculate the financial loss of the incident.

Answer

To satisfy external auditors' compliance requirements.

Answer

To assign blame to the developer who wrote the code.

Question 20

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Accepted Answer

Assume breach. In a Zero Trust architecture, 'Assume breach' (A) is fundamental because the model presumes no implicit safety and designs for containment, segmentation, and rapid detection/response as if an attacker is already inside. 'Use least privilege access' (C) is correct because every identity and workload should receive only the minimum permissions needed, enforced with just-in-time and just-enough-access controls to limit lateral movement. 'Verify explicitly' (E) is correct because every access request must be authenticated and authorized using all available signals—identity, device health, location, and behavior—before granting resource access. 'Trust but verify' (B) is not a Zero Trust principle; it reflects a perimeter-based mindset where trust is initially granted, which contradicts Zero Trust's 'never trust, always verify' stance. 'Trust all internal network traffic' (D) is the opposite of Zero Trust, since internal networks are treated as untrusted and traffic must be inspected and authorized regardless of origin.

Answer

Trust but verify

Answer

Trust all internal network traffic