CSSLP Practice Exam 4 — 20 Questions

Question 1

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Accepted Answer

Disabling all unused services and ports in the production container image.. Secure by default means security controls are enabled without user intervention, such as disabling unnecessary features.

Answer

Allowing administrative access to all users by default.

Answer

Using self-signed certificates in the development environment only.

Answer

Providing a configuration wizard to enable SSL after deployment.

Question 2

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Accepted Answer

Confidentiality. Hardcoded keys violate confidentiality because the keys are exposed to anyone with access to the source code.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Answer

Accounting

Question 3

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. The goal of an SBOM is to provide transparency into the software components and dependencies that make up an application, enabling organizations to identify, assess, and manage dependency-related risks such as vulnerable or unlicensed components. It is a visibility and risk-management artifact, not an automation or training replacement. This transparency is foundational to software supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.

Question 4

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Accepted Answer

Use a secret management service. A dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores secrets encrypted, controls access via identity and policy, supports rotation and auditing, and keeps secrets out of source code entirely. This is the correct control because it addresses the root cause — secrets embedded in code — rather than masking the symptom. It also enables centralized revocation and rotation when a key is compromised.

Answer

Store it in a public environment variable

Answer

Add it to the .gitignore file

Answer

Obfuscate the key in the code

Question 5

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Accepted Answer

Mandate the migration to an encrypted transport layer in the SRS. The security requirements phase is where security controls are formally specified in the Software Requirements Specification (SRS). Since the legacy system transmits credentials in plaintext, the priority is to mandate a secure replacement—encrypted transport (e.g., TLS/SSL, SSH, or IPsec)—as a requirement in the SRS. This ensures the security need is captured, tracked, and implemented, rather than deferred or mitigated only at the network level. Documenting technical debt or requesting a waiver does not fix the vulnerability; it merely acknowledges it.

Answer

Request a waiver for the legacy system

Answer

Suggest the use of a VPN for the entire network

Answer

Document the legacy protocol as a technical debt item

Question 6

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Accepted Answer

Establishing and tracking security performance metrics.. Option D is correct because a robust Software Security Governance framework requires measurable oversight: establishing and tracking security performance metrics (e.g., mean time to remediate vulnerabilities, percentage of code scanned, open critical findings) enables an organization to monitor compliance, demonstrate accountability, and drive continuous improvement of its security posture. Option E is correct because governance fundamentally rests on defining clear security policies and standards (such as secure coding standards, SDLC security gates, and risk acceptance criteria) that set mandatory expectations and provide the baseline against which all development and security activities are measured and audited. The remaining options do not belong: outsourcing all security tasks to third-party vendors (A) transfers execution but does not constitute governance, which remains the organization's responsibility; mandating that all developers become certified hackers (B) is neither feasible nor a recognized governance control; and discontinuing all legacy applications (C) is an operational risk decision, not a governance component, and may be impractical or unnecessary.

Answer

Outsourcing all security tasks to third-party vendors.

Answer

Mandating that all developers become certified hackers.

Answer

Discontinuing all legacy applications.

Question 7

Which standard security practice should be applied to all passwords stored in a database?

Accepted Answer

Hashing with a unique salt per user. The correct practice is to hash passwords with a unique salt per user. Hashing is a one-way function that transforms the password into a fixed-length digest, making it infeasible to reverse. A unique salt per user prevents attackers from using precomputed rainbow tables and ensures that identical passwords produce different hashes. This is a fundamental requirement in standards like NIST SP 800-63B and OWASP ASVS.

Answer

Encryption with a symmetric key

Answer

Storing in a configuration file

Answer

Base64 encoding

Question 8

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.

Question 9

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

Accepted Answer

Configure an allowlist-only proxy repository.. An allowlist-only proxy repository permits only explicitly approved packages (by name, version, and hash) to be fetched, so a malicious package with a similar name (e.g., 'reqeusts' instead of 'requests') is rejected even if a developer mistypes it. This is the most effective technical control because it removes reliance on human vigilance and blocks the attack at the dependency-resolution layer.

Answer

Rely on the developer's ability to check spelling.

Answer

Increase the frequency of penetration tests.

Answer

Enable two-factor authentication on developer accounts.

Question 10

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows

Question 11

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

Accepted Answer

Attempt to access resources associated with other users.. After discovering an IDOR, the appropriate next step in test-case design is to attempt to access resources belonging to other users (B) to confirm the vulnerability is exploitable and to determine its scope. This validates the finding, demonstrates real impact, and provides evidence for the report — all within authorized testing boundaries.

Answer

Delete the record to prove the IDOR is exploitable.

Answer

null

Answer

Report the finding immediately without further testing.

Answer

Run a full automated DAST scan against the entire application.

Question 12

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

Accepted Answer

Security requirements definition. Security requirements definition (C) is essential because the SSDLC must capture security and privacy requirements alongside functional requirements early in the lifecycle, so that controls such as authentication, encryption, and compliance obligations are designed in rather than bolted on later. Threat modeling (D) is essential because it systematically identifies potential threats, attack surfaces, and mitigations (e.g., using STRIDE or DREAD) during design, allowing architects to address risks before code is written. The other options do not belong: hardware procurement (A) is an infrastructure/logistics activity rather than a software security practice, marketing strategies (B) concern business promotion and are unrelated to secure development, and an unlimited project budget (E) is neither a security control nor a realistic or necessary SSDLC component.

Answer

Hardware procurement

Answer

Marketing strategies

Answer

Unlimited project budget

Question 13

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

Accepted Answer

Performing context-aware output encoding at the presentation layer.. Context-aware output encoding prevents browsers from interpreting user input as active content.

Answer

Using a centralized regex filter to strip HTML tags.

Answer

Encrypting all user input before storing it in the database.

Answer

Implementing a strict allow-list for all input fields.

Question 14

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

Accepted Answer

To identify which security controls and protection levels are required for specific data assets.. Data classification allows for the application of appropriate security controls based on the data's risk profile.

Answer

To identify the database engine version.

Answer

To automate the backup frequency of the database.

Answer

To determine which data needs to be deleted periodically.

Question 15

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

Accepted Answer

To define the supply chain steps, actors, and expected artifacts.. The layout file specifies the authorized steps, the actors responsible for each step, and the expected artifacts, providing the policy for verifying the supply chain.

Answer

To encrypt the source code repository.

Answer

To generate the final SBOM document.

Answer

To list all CVEs found in the dependencies.

Question 16

Which TWO of the following actions support the 'Open Design' security principle?

Accepted Answer

Publishing the system architecture for security review.. Option A is correct because the Open Design principle (Saltzer and Schroeder) holds that the security of a system should not depend on the secrecy of its design, so publishing the system architecture for security review allows scrutiny and verification by others without weakening security. Option B is correct because relying on standard, public cryptographic protocols like TLS embodies open design: the algorithms and protocols are openly specified and peer-reviewed, and security rests on the secrecy of keys rather than the obscurity of the mechanism. Option C does not belong because keeping API documentation private is a form of security through obscurity, which contradicts open design. Option D does not belong because hiding source code from developers is secrecy-based and impedes review, the opposite of openness. Option E does not belong because a proprietary, secret encryption algorithm relies on obscurity of the algorithm rather than open, vetted standards, which violates the Open Design principle.

Answer

Keeping the API endpoint documentation private.

Answer

Hiding the source code from all development team members.

Answer

Using a proprietary, secret encryption algorithm.

Question 17

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

Accepted Answer

Change the password for the database user and update the application deployment manifest.. When environment variables containing credentials are compromised, the immediate step is to rotate the exposed credentials—specifically, change the database user's password and update the application deployment manifest to use the new password. This invalidates the attacker's access and restores secure authentication. The other options do not address the credential compromise directly.

Answer

Clear the application's cache to remove any temporary sensitive data.

Answer

Increase the logging level to 'DEBUG' to track the attacker's actions.

Answer

Re-deploy the application using the same configuration to ensure a clean state.

Question 18

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Accepted Answer

Automated vulnerability scanning of stored artifacts.. Option C is correct because automated vulnerability scanning of stored artifacts detects known CVEs in container images and packages at push time, enabling the pipeline to block or quarantine compromised artifacts before they reach production. Option D is correct because immutable tags prevent an attacker or compromised build from overwriting an existing tag (e.g., re-pushing a malicious image under a trusted 'latest' or version tag), which is a common supply chain attack vector; immutability ensures a tag always resolves to the same digest. Option E is correct because granular RBAC enforces least privilege, restricting who can push, pull, or delete artifacts and preventing unauthorized modification or injection of malicious images into the registry. Option A does not belong because auto-scaling storage addresses availability and capacity, not supply chain security. Option B does not belong because translating code into multiple languages is unrelated to artifact registry security and is not a registry feature.

Answer

Auto-scaling of the registry's storage capacity.

Answer

Automatic translation of code into multiple languages.

Question 19

Which THREE configuration management practices help reduce 'Configuration Drift' in a secure software environment?

Accepted Answer

Implementing automated drift detection and remediation tools.. Option A is correct because automated drift detection and remediation tools continuously compare running configurations against a known-good baseline and automatically reapply the desired state, catching and correcting unauthorized or accidental changes before they persist. Option B is correct because immutable infrastructure replaces instances with freshly built, versioned images instead of patching live systems, so no long-lived server accumulates undocumented changes and drift cannot compound over time. Option D is correct because declarative IaC tools such as Terraform or CloudFormation define the desired end state in version-controlled code and reconcile actual resources to that state, making configuration reproducible and auditable. Option C is wrong because disabling automated deployment pipelines removes the consistent, repeatable mechanism that prevents drift and forces error-prone manual changes. Option E is wrong because allowing manual configuration changes via the SSH console is itself a primary cause of configuration drift, since out-of-band edits bypass version control and baseline enforcement.

Answer

Disabling all automated deployment pipelines.

Answer

Allowing manual configuration changes via the SSH console.

Question 20

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.