CSSLP Practice Exam 4 — 20 Questions

Question 1

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 2

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

Accepted Answer

Implementing granular network segmentation to limit lateral movement.. Defense-in-depth through runtime application self-protection (RASP) and strict network segmentation provides layered security against unknown threats.

Answer

Disabling all security logging to prevent alert fatigue.

Answer

Relying solely on perimeter-based firewalls for security.

Answer

Updating the application to the latest version once per year.

Question 3

Which TWO of the following are required to successfully implement a secure logging mechanism?

Accepted Answer

Filter sensitive data before logging. Sensitive data must be filtered, and logs must be stored in a secure, tamper-evident location.

Answer

Log every single user mouse movement

Answer

Send logs to a publicly accessible bucket

Answer

Disable all logging to improve performance

Question 4

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 5

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Accepted Answer

The use of secure vaulting mechanisms for application secrets and keys.. Data encryption during transit and the management of secrets are critical for maintaining confidentiality.

Answer

The speed at which the deployment occurs.

Answer

The number of instances deployed in the auto-scaling group.

Answer

The color scheme used in the application UI.

Question 6

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Accepted Answer

Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.. Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Answer

Store all application logs in a publicly accessible S3 bucket for easy debugging.

Answer

Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

Answer

Increase the log verbosity to the maximum level in production indefinitely.

Question 7

Which THREE of the following are best practices for the secure use of third-party libraries?

Accepted Answer

Monitor for vulnerability disclosures. Monitoring for vulnerabilities, pinning versions, and auditing updates are key practices.

Answer

Automatically update to the latest version without testing

Answer

Store all third-party code in the public root folder

Question 8

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Pipeline security requires securing the build environment, scanning the artifacts, and protecting the credentials used for deployment.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 9

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows

Question 10

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 11

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 12

Which THREE of the following practices contribute to secure configuration of a web server?

Accepted Answer

Remove default files and pages. Disabling directory listing, removing default pages, and enforcing HTTPS are essential for server hardening.

Answer

Allow all HTTP methods (TRACE, OPTIONS)

Answer

Enable verbose error reporting

Question 13

During a project migration to GDPR compliance, the development team must ensure that personal data is deleted upon user request. Where should these specific data lifecycle constraints be documented to ensure they influence the architectural design?

Accepted Answer

The Software Requirements Specification (SRS). Security requirements must be integrated into the Software Requirements Specification (SRS) or the project's requirements management tool (like Jira or Azure DevOps) to ensure they are tracked as functional constraints.

Answer

The Penetration Testing Report

Answer

The Infrastructure-as-Code (IaC) templates

Answer

The Risk Register

Question 14

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Accepted Answer

Integrating security linting into the IDE.. Static analysis, secure design reviews, and IDE-integrated tools all move security activities earlier into the developer workflow.

Answer

Conducting post-deployment vulnerability scanning.

Answer

Relying solely on external bug bounty programs.

Question 15

Your company uses a 'Security Champion' model. What is the primary function of these individuals in a DevSecOps environment?

Accepted Answer

To act as a security advocate and bridge between security and dev teams.. Security Champions act as liaisons between security teams and development teams, providing localized expertise and fostering a security culture within the team.

Answer

To perform all manual code reviews for the entire department.

Answer

To handle all incident responses for the organization.

Answer

To replace the need for professional security audits.

Question 16

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 17

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 18

When managing software security in a cloud-native architecture, what is the best practice for ensuring secure configuration throughout the lifecycle?

Accepted Answer

Implementing Infrastructure as Code (IaC) and scanning templates.. Infrastructure as Code (IaC) allows for version-controlled, repeatable, and scanable infrastructure configurations, which can be audited before deployment.

Answer

Using default security settings provided by the cloud provider.

Answer

Relying on manual cloud console configuration.

Answer

Performing monthly manual audits of cloud resources.

Question 19

You are designing a secure pipeline using Jenkins. To ensure integrity, what is the best practice for managing build artifacts?

Accepted Answer

Using digital signatures to verify artifact integrity before deployment.. Digitally signing artifacts ensures that they have not been tampered with between the build stage and deployment, maintaining supply chain integrity.

Answer

Storing artifacts in a public S3 bucket for easy access.

Answer

Deleting build artifacts immediately after the deployment to production.

Answer

Uploading artifacts to a shared developer network drive.

Question 20

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

Accepted Answer

Integrating security unit tests into the automated test suite.. Automated testing, threat modeling sessions, and security-focused user stories all support high-velocity security integration.

Answer

Performing manual penetration tests on every commit.

Answer

Waiting for the final release to review security documentation.