CSSLP Practice Test 4 — 25 Questions

Question 1

Which TWO of the following actions support the 'Open Design' security principle?

Accepted Answer

Publishing the system architecture for security review.. Option A is correct because the Open Design principle (Saltzer and Schroeder) holds that the security of a system should not depend on the secrecy of its design, so publishing the system architecture for security review allows scrutiny and verification by others without weakening security. Option B is correct because relying on standard, public cryptographic protocols like TLS embodies open design: the algorithms and protocols are openly specified and peer-reviewed, and security rests on the secrecy of keys rather than the obscurity of the mechanism. Option C does not belong because keeping API documentation private is a form of security through obscurity, which contradicts open design. Option D does not belong because hiding source code from developers is secrecy-based and impedes review, the opposite of openness. Option E does not belong because a proprietary, secret encryption algorithm relies on obscurity of the algorithm rather than open, vetted standards, which violates the Open Design principle.

Answer

Keeping the API endpoint documentation private.

Answer

Hiding the source code from all development team members.

Answer

Using a proprietary, secret encryption algorithm.

Question 2

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

Accepted Answer

Change the password for the database user and update the application deployment manifest.. When environment variables containing credentials are compromised, the immediate step is to rotate the exposed credentials—specifically, change the database user's password and update the application deployment manifest to use the new password. This invalidates the attacker's access and restores secure authentication. The other options do not address the credential compromise directly.

Answer

Clear the application's cache to remove any temporary sensitive data.

Answer

Increase the logging level to 'DEBUG' to track the attacker's actions.

Answer

Re-deploy the application using the same configuration to ensure a clean state.

Question 3

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Accepted Answer

Automated vulnerability scanning of stored artifacts.. Option C is correct because automated vulnerability scanning of stored artifacts detects known CVEs in container images and packages at push time, enabling the pipeline to block or quarantine compromised artifacts before they reach production. Option D is correct because immutable tags prevent an attacker or compromised build from overwriting an existing tag (e.g., re-pushing a malicious image under a trusted 'latest' or version tag), which is a common supply chain attack vector; immutability ensures a tag always resolves to the same digest. Option E is correct because granular RBAC enforces least privilege, restricting who can push, pull, or delete artifacts and preventing unauthorized modification or injection of malicious images into the registry. Option A does not belong because auto-scaling storage addresses availability and capacity, not supply chain security. Option B does not belong because translating code into multiple languages is unrelated to artifact registry security and is not a registry feature.

Answer

Auto-scaling of the registry's storage capacity.

Answer

Automatic translation of code into multiple languages.

Question 4

Which THREE configuration management practices help reduce 'Configuration Drift' in a secure software environment?

Accepted Answer

Implementing automated drift detection and remediation tools.. Option A is correct because automated drift detection and remediation tools continuously compare running configurations against a known-good baseline and automatically reapply the desired state, catching and correcting unauthorized or accidental changes before they persist. Option B is correct because immutable infrastructure replaces instances with freshly built, versioned images instead of patching live systems, so no long-lived server accumulates undocumented changes and drift cannot compound over time. Option D is correct because declarative IaC tools such as Terraform or CloudFormation define the desired end state in version-controlled code and reconcile actual resources to that state, making configuration reproducible and auditable. Option C is wrong because disabling automated deployment pipelines removes the consistent, repeatable mechanism that prevents drift and forces error-prone manual changes. Option E is wrong because allowing manual configuration changes via the SSH console is itself a primary cause of configuration drift, since out-of-band edits bypass version control and baseline enforcement.

Answer

Disabling all automated deployment pipelines.

Answer

Allowing manual configuration changes via the SSH console.

Question 5

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.

Question 6

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

Accepted Answer

SQL Injection. Parameterized queries (prepared statements) separate SQL code from data by sending the query structure to the database first and binding user input as parameters, so input is never interpreted as SQL syntax. This structurally prevents SQL injection, the top web vulnerability class, regardless of what characters the attacker supplies.

Answer

Session Hijacking

Answer

Insecure Deserialization

Answer

Directory Traversal

Question 7

Which TWO actions should be taken when preparing a software build for a secure production deployment?

Accepted Answer

Perform a Software Composition Analysis (SCA) to identify vulnerable dependencies.. Option C is correct because performing a Software Composition Analysis (SCA) scans third-party and open-source dependencies for known CVEs and license issues, which is essential before shipping a build to production. Option D is correct because signing the final build artifact with a secure private key (e.g., via GPG or sigstore/cosign) provides integrity and provenance, allowing production systems to verify the artifact has not been tampered with. Option A is wrong because hardcoded credentials in build artifacts leak secrets and violate secure secret-management practices such as using a vault or environment-injected secrets. Option B is wrong because bypassing unit tests removes a key quality gate and increases the risk of shipping defective or vulnerable code. Option E is wrong because compiling with debugging symbols in production exposes internal details and increases attack surface; symbols should be stripped or kept in a separate symbol store.

Answer

Embed hardcoded credentials for the database in the build artifact to ensure connectivity.

Answer

Bypass unit tests to speed up the deployment pipeline.

Answer

Compile the code with debugging symbols enabled for easier production troubleshooting.

Question 8

Which THREE factors should be considered when prioritizing findings from a DAST scan?

Accepted Answer

The ease of exploitability and availability of exploits.. Option C is correct because the ease of exploitability and the existence of public exploits (e.g., weaponized PoCs in Exploit-DB or Metasploit modules) directly raise the real-world risk of a DAST finding, making it a primary prioritization factor. Option D is correct because the sensitivity of the data handled by the vulnerable endpoint (e.g., PII, credentials, or PCI data) determines the potential business impact if the finding is exploited, which is essential for risk-based triage. Option E is correct because the CVSS base score provides a standardized, vendor-neutral severity metric (combining exploitability and impact sub-scores) that is widely used to rank DAST findings objectively. Option A does not belong because the time of day a scan ran has no bearing on the vulnerability's severity or exploitability. Option B does not belong because lines of code is a static code metric, not a DAST finding attribute, and does not indicate exploitability or impact.

Answer

The time of day the scan was performed.

Answer

The number of lines of code in the component.

Question 9

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

Accepted Answer

A list of critical fourth-party service providers (sub-processors).. Option A is correct because identifying critical fourth-party service providers (sub-processors) is essential to map the extended supply chain and assess concentration, geographic, and jurisdictional risks that could disrupt the SaaS service. Option D is correct because an SBOM enumerates the software components and dependencies in the application, enabling verification of known vulnerabilities, license risks, and provenance of third-party libraries. Option E is correct because evidence of automated CI/CD dependency vulnerability scanning demonstrates continuous detection of vulnerable or malicious dependencies before deployment, directly strengthening supply chain resilience. Option B is not relevant because an employee handbook addresses HR policies and conduct, not supply chain risk. Option C is not relevant because an annual financial report reflects the vendor's fiscal health, not the resilience of its software and service supply chain.

Answer

The vendor's employee handbook.

Answer

The vendor's annual financial report.

Question 10

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

Accepted Answer

Digital signatures on the message payload.. Digital signatures on the message payload provide integrity and authenticity: the sender signs the message with a private key, and the receiver verifies with the public key, detecting any tampering. This directly addresses the requirement that messages between services are not altered in transit.

Answer

Logging all messages to a central server.

Answer

Encryption of the message payload.

Answer

Using a private network for all communication.

Question 11

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

Accepted Answer

Software Security Policy (SSP).. A Software Security Policy (SSP) establishes the enterprise-wide standards, expectations, and mandatory controls for all software lifecycles.

Answer

System Architecture Diagram.

Answer

Individual Sprint Backlog.

Answer

Developer Coding Standards.

Question 12

When designing a secure API, which THREE of the following practices align with the principle of 'Defense-in-Depth'?

Accepted Answer

Encoding output to prevent XSS attacks in the browser.. Defense-in-Depth means layering multiple independent controls so that no single failure exposes the system. Option A is correct because encoding output before it reaches the browser neutralizes injected script and mitigates XSS even if an earlier filter is bypassed, adding a presentation-layer control. Option D is correct because validating input inside the application business logic layer enforces the domain's own rules and catches malicious or malformed data that slips past perimeter checks, providing an application-layer safeguard. Option E is correct because validating all incoming requests at the API Gateway level rejects bad traffic early at the perimeter, forming an outer defensive layer that complements the inner application validation. Option B is incorrect because relying solely on a network firewall is a single point of failure, the opposite of layered defense. Option C is incorrect because allowing all traffic through the API Gateway removes a key inspection and filtering layer, weakening rather than strengthening defense-in-depth.

Answer

Relying solely on the network firewall for all security.

Answer

Allowing all traffic through the API Gateway for performance.

Question 13

Which THREE of the following are best practices for the secure use of third-party libraries?

Accepted Answer

Monitor for vulnerability disclosures. Option B is correct because continuously monitoring for vulnerability disclosures (e.g., via CVE feeds, NVD, or dependency-scanning tools like OWASP Dependency-Check or Snyk) lets teams learn about and remediate known flaws in third-party libraries before attackers exploit them. Option C is correct because performing security audits on third-party code — reviewing the library's source, license, and security posture (e.g., static analysis, SBOM review) — verifies that the dependency does not introduce vulnerabilities or malicious code into the application. Option E is correct because pinning library versions (e.g., exact versions in package.json, requirements.txt, or lock files) prevents unexpected changes or supply-chain attacks from silently pulling in a compromised or incompatible newer release. Option A is not a best practice because automatically updating to the latest version without testing can introduce breaking changes or newly disclosed vulnerabilities and bypasses change control. Option D is not a best practice because storing third-party code in the public root folder exposes it to direct web access, potentially leaking source code or enabling exploitation of unauthenticated endpoints.

Answer

Automatically update to the latest version without testing

Answer

Store all third-party code in the public root folder

Question 14

When updating requirements for a legacy system to improve its security posture, which THREE actions should the CSSLP prioritize?

Accepted Answer

Replacing deprecated cryptographic libraries. Option B is correct because deprecated cryptographic libraries (e.g., MD5, SHA-1, RC4, or outdated TLS stacks) contain known weaknesses and unpatched CVEs, so replacing them with current, supported algorithms and libraries directly reduces exploitable cryptographic risk in a legacy system. Option C is correct because implementing modern multi-factor authentication (e.g., TOTP, FIDO2/WebAuthn, or hardware tokens) strengthens identity assurance and mitigates credential-based attacks such as password reuse, phishing, and brute force, which are common weaknesses in legacy authentication schemes. Option E is correct because hardening against known injection attacks (SQL injection, command injection, LDAP injection, XSS) addresses the most prevalent and dangerous vulnerability classes in legacy code, typically via parameterized queries, input validation, and output encoding. Option A does not belong because changing internal team structure is an organizational/HR matter that does not directly improve the technical security posture of the system. Option D does not belong because increasing application server memory is a performance/scalability change with no direct security benefit.

Answer

Changing the internal team structure

Answer

Increasing the memory of the application servers

Question 15

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

Accepted Answer

The build platform must be hardened and provenance must be authenticated.. SLSA Level 3 requires the build platform to be 'hardened' and 'non-falsifiable', meaning the build integrity is protected and the provenance is cryptographically signed.

Answer

The code must be written in a memory-safe language.

Answer

The project must have 100% open-source components.

Answer

All developers must use a Linux-based OS.

Question 16

Which THREE of the following practices contribute to secure configuration of a web server?

Accepted Answer

Remove default files and pages. Option A is correct because removing default files and pages (e.g., Apache's /var/www/html/index.html, IIS's iisstart.htm, or sample scripts like phpinfo.php) eliminates well-known entry points and information-disclosure vectors that attackers routinely probe. Option D is correct because disabling directory listing (Apache's Options -Indexes or nginx's autoindex off) prevents the server from exposing file and folder names that could reveal sensitive resources or aid reconnaissance. Option E is correct because enforcing HTTPS with TLS (e.g., via HSTS and redirecting port 80 to 443) protects credentials and session data from interception and man-in-the-middle attacks, which is a core secure-configuration requirement. Option B is wrong because allowing all HTTP methods such as TRACE and OPTIONS enables cross-site tracing and method enumeration; these should be restricted to only those required (typically GET, POST, HEAD). Option C is wrong because verbose error reporting leaks stack traces, file paths, and server versions that assist attackers; production servers should return generic error messages and log details server-side instead.

Answer

Allow all HTTP methods (TRACE, OPTIONS)

Answer

Enable verbose error reporting

Question 17

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Accepted Answer

Providing secure coding training to developers.. Option B is correct because secure coding training equips developers to recognize and avoid vulnerabilities such as SQL injection, XSS, and buffer overflows, which is a foundational Secure Software Lifecycle Management (SSLM) practice for building security in from the start. Option C is correct because periodic risk assessments identify, prioritize, and track application threats and weaknesses throughout the lifecycle, enabling risk-based decisions on controls and remediation. Option E is correct because defining audit logging and monitoring requirements ensures security-relevant events are captured, retained, and reviewed, supporting detection, incident response, and compliance within the SSLM plan. Option A does not belong because mandating a single programming language is an architectural or standardization choice, not a security lifecycle control, and it does not inherently reduce risk. Option D does not belong because purchasing cyber insurance is a risk-transfer business decision, not a Secure Software Lifecycle Management activity, and it does not prevent or remediate software vulnerabilities.

Answer

Requiring developers to use only one specific programming language.

Answer

Buying insurance for all cyber incidents.

Question 18

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

Accepted Answer

Using random, non-predictable UUIDs for resource identifiers.. Option C is correct because using random, non-predictable UUIDs (e.g., UUIDv4) for resource identifiers makes it impractical for an attacker to guess or enumerate other users' object IDs, removing the easy ID-guessing vector that BOLA exploits. Option E is correct because BOLA fundamentally occurs when an API endpoint accepts an object ID and returns/modifies it without checking that the authenticated session user actually owns or is authorized for that object; explicitly verifying that the session's user ID matches the owner of the requested resource ID enforces object-level authorization on every request. Option A is wrong because sequentially incrementing IDs are trivially enumerable, making it easy to probe other users' objects. Option B is wrong because hiding objects in the frontend provides no security—attackers can call the API directly, bypassing any UI concealment. Option D is wrong because base64 is an encoding, not encryption or randomization; base64-encoded IDs are reversible and predictable, so they do not prevent enumeration or unauthorized access.

Answer

Using sequentially incrementing IDs (e.g., 1, 2, 3) for all resources.

Answer

Relying on the frontend to hide sensitive objects.

Answer

Using base64 encoded strings for all database IDs.

Question 19

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. In EJS, the <%= %> tag performs HTML entity escaping on the output, converting characters like <, >, &, and quotes into safe entities so injected markup cannot execute in the browser. This directly neutralizes the most common XSS vector — reflected or stored script tags in user-supplied data. Using escaped output is the canonical secure-coding practice for rendering untrusted content in EJS templates.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 20

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

Accepted Answer

Maintaining an updated contact list and clear incident escalation paths.. Option A is correct because an updated contact list and clearly defined escalation paths ensure the right responders are notified quickly and incidents are routed to the appropriate teams, which is foundational to any Incident Response (IR) plan. Option D is correct because a post-mortem analysis identifies root causes and lessons learned, enabling corrective actions and continuous improvement of security controls and IR procedures. Option E is correct because isolating affected systems (for example, network segmentation or host containment) limits lateral movement and prevents the attack from spreading to other assets. Option B is not appropriate because deliberately allowing a threat actor to continue accessing systems risks further compromise and data loss; observation should only occur under controlled, authorized threat-hunting or deception operations, not as a general IR action. Option C is wrong because deleting production logs destroys forensic evidence, violates audit and legal retention requirements, and undermines the ability to investigate and remediate the incident.

Answer

Allowing the threat actor to continue accessing the system to observe their tactics.

Answer

Immediately deleting all production logs to hide the incident from auditors.