CSSLP Practice Test 5 — 25 Questions

Question 1

You are using 'in-toto' to secure your software supply chain. What is the primary purpose of a 'layout' file in this framework?

Accepted Answer

To define the supply chain steps, actors, and expected artifacts.. The layout file specifies the authorized steps, the actors responsible for each step, and the expected artifacts, providing the policy for verifying the supply chain.

Answer

To encrypt the source code repository.

Answer

To generate the final SBOM document.

Answer

To list all CVEs found in the dependencies.

Question 2

When setting up a penetration testing lab for a web application, which THREE network configurations are recommended?

Accepted Answer

Enable full logging and monitoring on the testing infrastructure.. Security labs must be isolated to prevent accidental impact on production while maintaining necessary access for testing tools.

Answer

Configure the lab to use the main corporate production database.

Answer

Air-gap the testing network from the internet.

Question 3

Which THREE categories are typically used to classify security requirements?

Accepted Answer

Confidentiality. Security requirements are generally grouped by confidentiality, integrity, and availability (the CIA triad).

Answer

Project Profitability

Answer

Marketing Appeal

Question 4

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

Accepted Answer

Requirement for an SBOM for all delivered software.. A secure supply chain policy must start with a requirement for software transparency, typically in the form of an SBOM for all delivered software.

Answer

Requirement for 100% code coverage in unit tests.

Answer

Requirement to use proprietary code only.

Answer

Requirement for the supplier to perform a full system wipe.

Question 5

Which TWO of the following represent common output formats for security testing reports?

Accepted Answer

PDF.. Industry standard formats for reporting include PDF for documentation and JSON for pipeline automation integration.

Answer

PNG.

Answer

MP3.

Answer

BIOS.

Question 6

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

Accepted Answer

The third-party DLL is not configured as a source project or included in the scan scope.. Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Answer

The vulnerability is a logic error that static analysis cannot find.

Answer

The .NET framework version is set incorrectly in the project settings.

Answer

The scan engine is set to 'Quick Scan' mode.

Answer

null

Question 7

Which TWO of the following are common challenges when implementing IAST?

Accepted Answer

Inability to find vulnerabilities in unreachable code.. IAST implementation challenges typically revolve around performance overhead and compatibility with the application stack.

Answer

Requirement for full source code access.

Answer

Lack of false positives.

Answer

Difficulty in installing agents on client machines.

Question 8

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 9

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Accepted Answer

Testing the password recovery/reset workflow.. Authentication bypass tests focus on session manipulation, password reset flows, and credential brute forcing.

Answer

Changing the application's CSS file.

Answer

Testing the application's color scheme.

Question 10

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Accepted Answer

Review of third-party audit reports (e.g., SOC 2, ISO 27001).. Effective programs combine standardized assessment questionnaires with a review of objective evidence, such as third-party audit reports (SOC 2).

Answer

Physical inspection of the vendor's data center.

Answer

Mandatory integration of your internal tools with the vendor.

Answer

Requiring the vendor to use your internal developers.

Question 11

You are integrating Snyk into a CI pipeline. The scan is failing the build even when no new vulnerabilities are introduced. What is the cause?

Accepted Answer

An expired 'ignore' policy in the .snyk file.. Snyk's 'policy' or '.snyk' file can be configured with 'ignore' rules that expire, or thresholds that trigger build breaks if policy is violated.

Answer

null

Answer

The Snyk token has expired.

Answer

The scan speed is set to 'High'.

Answer

The dependencies are already updated.

Question 12

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

Accepted Answer

Mutation-based fuzzing.. Mutation-based fuzzing takes valid inputs and alters them, which is highly effective for finding edge cases in protocol parsers.

Answer

Unit testing with hardcoded values.

Answer

Static code analysis.

Answer

null

Answer

DAST scanning with default payloads.

Question 13

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

Accepted Answer

Providing the 'Authentication' credentials in the 'Web Applications' section.. Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Answer

Disabling the 'Plugin' set for OS detection.

Answer

Enabling 'Safe Checks' in the policy settings.

Answer

Configuring the 'Port Scanner' to only scan port 80.

Answer

null

Question 14

When designing a test case for secure API authentication, which THREE elements should be included?

Accepted Answer

Validating that error messages do not disclose account existence.. Authentication testing must verify token handling, error messaging, and session management.

Answer

Automating the password recovery workflow.

Answer

Testing the speed of the API response.

Question 15

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.

Question 16

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

Accepted Answer

Postman.. Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Answer

SQLmap.

Answer

null

Answer

Nmap.

Answer

Wireshark.

Question 17

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.

Question 18

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Accepted Answer

Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.. The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Answer

null

Answer

Set the analysis mode to 'Incremental' only.

Answer

Increase the heap memory allocation for the JVM running the scanner.

Answer

Configure the 'Exclude' patterns to include all library dependencies.

Question 19

When performing automated security testing, which of the following is considered a 'false positive'?

Accepted Answer

The scanner reports a vulnerability that is not present in the application.. A false positive is a report of a vulnerability that does not actually exist in the target application.

Answer

The scanner misses an existing vulnerability.

Answer

The scanner causes the application to crash.

Answer

The scanner reports a vulnerability that is already fixed.

Answer

null

Question 20

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

Accepted Answer

Extract and re-inject unique anti-CSRF tokens for each request.. CSRF tokens are unique per session; the scanner must be able to extract the token from the response and include it in the subsequent request.

Answer

Attempt to brute force the user's password.

Answer

null

Answer

Scan the client-side JavaScript code for vulnerabilities.

Answer

Bypass the need for authentication.