CSSLP Practice Test 3 — 25 Questions

Question 1

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

Accepted Answer

Tampering. STRIDE categories are Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Answer

Encryption

Answer

Identification

Question 2

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Accepted Answer

Using a user-friendly mobile app push notification for authentication.. Psychological acceptability ensures that security measures are easy for users to understand and use, so they don't circumvent them.

Answer

Providing zero feedback to users during the login process.

Answer

Requiring a 64-character password changed every 24 hours.

Answer

Disabling the ability for users to reset their own passwords.

Answer

Forcing users to solve a complex CAPTCHA at every login attempt.

Question 3

Which TWO of the following are examples of how software can maintain 'Integrity'?

Accepted Answer

Using cryptographic hash functions (e.g., SHA-256) to verify file contents.. Integrity is maintained through mechanisms that ensure data is not tampered with.

Answer

Encrypting data at rest using AES.

Answer

Ensuring the server is always online.

Answer

Forcing users to change passwords regularly.

Question 4

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 5

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Accepted Answer

Encoding output to prevent XSS attacks in the browser.. Defense-in-depth uses multiple layers like input validation, authentication, and output encoding.

Answer

Relying solely on the network firewall for all security.

Answer

Allowing all traffic through the API Gateway for performance.

Question 6

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

Accepted Answer

Map the data flow of credit card information. PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Answer

Perform a network vulnerability scan

Answer

Review the application source code

Answer

Update the firewall rule set

Question 7

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 8

Your organization uses a 'Golden Image' approach for build containers. To prevent supply chain contamination of these build environments, what is the most effective security control?

Accepted Answer

Implement image signing and verification (e.g., Docker Content Trust or Cosign).. Using signed, immutable images from a private container registry ensures that build environments cannot be altered by unauthorized parties.

Answer

Disable all outbound network access from the build server.

Answer

Automatically pull the latest 'alpine' image during build time.

Answer

Rotate the build server SSH keys daily.

Question 9

When setting up operational monitoring, what is the 'Golden Signal' that specifically indicates a potential Denial of Service (DoS) attack?

Accepted Answer

A significant increase in the rate of 5xx errors and request latency.. A sudden spike in error rates or latency, combined with high request volume, is a primary indicator of a DoS attack.

Answer

An increase in the number of developers logged into the system.

Answer

A decrease in CPU utilization across all servers.

Answer

A reduction in database write operations.

Question 10

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Accepted Answer

Implement robust authentication. Disabling unused methods, authentication, and rate limiting are standard API hardening techniques.

Answer

Use cleartext headers for all communication

Answer

Expose full internal database schemas

Question 11

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 12

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

Accepted Answer

Implementing granular network segmentation to limit lateral movement.. Defense-in-depth through runtime application self-protection (RASP) and strict network segmentation provides layered security against unknown threats.

Answer

Disabling all security logging to prevent alert fatigue.

Answer

Relying solely on perimeter-based firewalls for security.

Answer

Updating the application to the latest version once per year.

Question 13

Which TWO of the following are required to successfully implement a secure logging mechanism?

Accepted Answer

Filter sensitive data before logging. Sensitive data must be filtered, and logs must be stored in a secure, tamper-evident location.

Answer

Log every single user mouse movement

Answer

Send logs to a publicly accessible bucket

Answer

Disable all logging to improve performance

Question 14

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

Accepted Answer

Adding security-focused acceptance criteria to the Definition of Done.. Incorporating security criteria into the DoD ensures that security tasks, such as static analysis or unit testing for vulnerabilities, must be completed before a story is considered finished.

Answer

Automating the deployment pipeline to run security scans only after the production release.

Answer

Performing a full threat model for every user story.

Answer

Conducting a penetration test at the end of every sprint.

Question 15

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Accepted Answer

The use of secure vaulting mechanisms for application secrets and keys.. Data encryption during transit and the management of secrets are critical for maintaining confidentiality.

Answer

The speed at which the deployment occurs.

Answer

The number of instances deployed in the auto-scaling group.

Answer

The color scheme used in the application UI.

Question 16

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Accepted Answer

Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.. Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Answer

Store all application logs in a publicly accessible S3 bucket for easy debugging.

Answer

Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

Answer

Increase the log verbosity to the maximum level in production indefinitely.

Question 17

Which THREE of the following are best practices for the secure use of third-party libraries?

Accepted Answer

Monitor for vulnerability disclosures. Monitoring for vulnerabilities, pinning versions, and auditing updates are key practices.

Answer

Automatically update to the latest version without testing

Answer

Store all third-party code in the public root folder

Question 18

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Pipeline security requires securing the build environment, scanning the artifacts, and protecting the credentials used for deployment.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 19

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows

Question 20

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest