CSSLP Practice Test 2 — 25 Questions

Question 1

When designing secure software, why is 'Economy of Mechanism' important?

Accepted Answer

To minimize the attack surface by keeping the design simple.. Economy of Mechanism is a core security design principle (from Saltzer and Schroeder) that advocates for simple, minimal designs. By keeping the design as simple as possible, the number of potential vulnerabilities and entry points for attackers is reduced, directly minimizing the attack surface. This simplicity also makes the system easier to verify and secure.

Answer

To lower the cost of hardware infrastructure.

Answer

To increase the lines of code for better functionality.

Answer

To ensure that the software is faster at runtime.

Answer

To enable easier debugging for developers.

Question 2

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 3

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Accepted Answer

Non-repudiation. Digital signatures are the standard mechanism for proving authenticity and non-repudiation.

Answer

Authorization

Answer

Encryption

Answer

Availability

Answer

Confidentiality

Question 4

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

Accepted Answer

Information Disclosure.. STRIDE's Information Disclosure category covers the exposure of information to unauthorized parties, which is exactly what traffic sniffing achieves — an attacker on the network path reads data that should be confidential. Sniffing between a client and web server exposes credentials, session tokens, or sensitive payloads, so the threat being modeled is Information Disclosure. The other STRIDE categories describe different attacker goals (spoofing identity, tampering with data, etc.), not confidentiality loss.

Answer

Elevation of Privilege.

Answer

Tampering.

Answer

Spoofing.

Question 5

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

Accepted Answer

If a system error occurs during login, the system denies access by default.. If the module crashes or encounters an error, the system should default to 'deny' access rather than 'allow'.

Answer

The system automatically resets passwords if a login failure occurs.

Answer

The system permits login if the authentication server is unreachable.

Answer

All new users are granted guest access until the admin verifies them.

Question 6

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 7

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Accepted Answer

Implement centralized log aggregation with automated alerting for security events.. Option B is correct because centralized log aggregation (e.g., shipping application and server logs to a SIEM such as Splunk, ELK, or a cloud-native service) combined with automated alerting enables continuous detection of security events like brute-force attempts, privilege escalation, or anomalous access patterns during the operational lifecycle. Option C is correct because strict egress filtering — allowing outbound traffic only to known, required destinations and ports via firewall or security group rules — limits command-and-control callbacks, data exfiltration, and lateral movement if the application is compromised. Option A is wrong because publishing internal server IP addresses in public DNS records exposes the internal topology and increases the attack surface rather than securing the application. Option D is wrong because permitting all inbound traffic on port 80 (HTTP) unconditionally removes access controls and enables exploitation of web-facing vulnerabilities; availability should be achieved through redundancy, not open ports. Option E is wrong because disabling all egress traffic breaks legitimate application functionality (updates, APIs, database calls) and is an over-restrictive measure; egress should be filtered to approved destinations, as in option C.

Answer

Share all internal server IP addresses in the public DNS records.

Answer

Permit all inbound traffic on port 80 to ensure maximum availability.

Answer

Disable all egress traffic from the application servers to prevent data exfiltration.

Question 8

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 9

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case modeling deliberately thinks like an attacker, enumerating misuse scenarios and entry points that legitimate use cases overlook. It is specifically designed to surface attack surfaces such as unauthenticated endpoints, parameter tampering, and privilege escalation paths. This makes it the best elicitation technique for identifying exploitable API entry points.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 10

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

Accepted Answer

To intercept and manage network traffic to enforce mTLS and authorization policies.. A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Answer

To act as a backup for the main container if it crashes.

Answer

To provide additional CPU and memory resources to the main container.

Answer

To store persistent data for the main application.

Question 11

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 12

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 13

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 14

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). A digital signature (e.g., Authenticode on Windows, GPG on Linux) uses asymmetric cryptography to provide both integrity and origin authenticity. The vendor signs the code with its private key; you verify with the vendor's public key, confirming the code has not been tampered with and genuinely came from that vendor. This is the only mechanism in the list that proves both integrity and origin.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 15

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.

Question 16

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

Accepted Answer

Lack of security expertise within development teams.. Option B is correct because in large organizations development teams often lack dedicated application-security skills (e.g., secure coding, threat modeling, SAST/DAST interpretation), so security must be embedded via training and champions rather than assumed. Option C is correct because integrating security tooling such as SAST, DAST, SCA, and secret scanning into existing CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions) is technically complex, often slows builds, and produces false positives that must be triaged. Option D is correct because a Secure SDLC requires cultural and process change—shifting security left, adding gates, and changing developer workflows—which typically meets organizational resistance. Option A is not a standard challenge of Secure SDLC implementation; the real tension is balancing security with delivery speed, not that development itself is inherently too slow. Option E is incorrect because large organizations rarely suffer from having too much security budget; budget constraints and tool sprawl are the more common issues.

Answer

The speed of software development is too slow.

Answer

Having too much budget for security tools.

Question 17

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

Accepted Answer

Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.. Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Answer

Run 'npm audit fix' before every build process.

Answer

Add the dependency to the 'bundledDependencies' array in package.json.

Answer

Enable 'strict-ssl' in the global npm configuration.

Question 18

Which document is essential to map regulatory compliance requirements to specific software features?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A Security Requirements Traceability Matrix (SRTM) maps security and regulatory requirements to specific software features, controls, and test cases, providing bidirectional traceability from requirement to implementation and verification. It is the essential document for demonstrating that each regulatory obligation is addressed by a concrete feature or control. This traceability is critical for audits (e.g., PCI DSS, HIPAA, SOX) and for change management.

Answer

System Architecture Document

Answer

Incident Response Plan

Answer

Software Development Plan

Question 19

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Accepted Answer

Reduces the total cost of remediation. Option A is correct because addressing security requirements during early SDLC phases (such as requirements and design) allows flaws to be identified and fixed before code is written or deployed, and defects found later in production or even in testing are dramatically more expensive to remediate — this is the well-established "shift left" cost curve. Option B is correct because incorporating security requirements early ensures that security controls and architecture are designed to support the organization's business objectives, compliance obligations, and risk tolerance rather than being bolted on afterward, keeping security aligned with business requirements. Option C is incorrect because penetration testing remains a necessary validation activity regardless of when security requirements are introduced; early requirements reduce but never eliminate the need for adversarial testing. Option D is incorrect because security requirements typically increase documentation (policies, threat models, control mappings, test evidence) rather than reduce it. Option E is incorrect because security testing cannot be removed — early requirements complement, not replace, verification and validation activities such as SAST, DAST, and penetration testing.

Answer

Eliminates the need for penetration testing

Answer

Reduces the amount of documentation required

Answer

Allows for the removal of all security testing

Question 20

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline