CSSLP Practice Test 2 — 30 Questions

Question 1

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 2

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Accepted Answer

Implement centralized log aggregation with automated alerting for security events.. Option B is correct because centralized log aggregation (e.g., shipping application and server logs to a SIEM such as Splunk, ELK, or a cloud-native service) combined with automated alerting enables continuous detection of security events like brute-force attempts, privilege escalation, or anomalous access patterns during the operational lifecycle. Option C is correct because strict egress filtering — allowing outbound traffic only to known, required destinations and ports via firewall or security group rules — limits command-and-control callbacks, data exfiltration, and lateral movement if the application is compromised. Option A is wrong because publishing internal server IP addresses in public DNS records exposes the internal topology and increases the attack surface rather than securing the application. Option D is wrong because permitting all inbound traffic on port 80 (HTTP) unconditionally removes access controls and enables exploitation of web-facing vulnerabilities; availability should be achieved through redundancy, not open ports. Option E is wrong because disabling all egress traffic breaks legitimate application functionality (updates, APIs, database calls) and is an over-restrictive measure; egress should be filtered to approved destinations, as in option C.

Answer

Share all internal server IP addresses in the public DNS records.

Answer

Permit all inbound traffic on port 80 to ensure maximum availability.

Answer

Disable all egress traffic from the application servers to prevent data exfiltration.

Question 3

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 4

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case modeling deliberately thinks like an attacker, enumerating misuse scenarios and entry points that legitimate use cases overlook. It is specifically designed to surface attack surfaces such as unauthenticated endpoints, parameter tampering, and privilege escalation paths. This makes it the best elicitation technique for identifying exploitable API entry points.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 5

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

Accepted Answer

To intercept and manage network traffic to enforce mTLS and authorization policies.. A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Answer

To act as a backup for the main container if it crashes.

Answer

To provide additional CPU and memory resources to the main container.

Answer

To store persistent data for the main application.

Question 6

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 7

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 8

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 9

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). A digital signature (e.g., Authenticode on Windows, GPG on Linux) uses asymmetric cryptography to provide both integrity and origin authenticity. The vendor signs the code with its private key; you verify with the vendor's public key, confirming the code has not been tampered with and genuinely came from that vendor. This is the only mechanism in the list that proves both integrity and origin.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 10

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.

Question 11

Which THREE of the following are common challenges when implementing a Secure SDLC in a large organization?

Accepted Answer

Lack of security expertise within development teams.. Option B is correct because in large organizations development teams often lack dedicated application-security skills (e.g., secure coding, threat modeling, SAST/DAST interpretation), so security must be embedded via training and champions rather than assumed. Option C is correct because integrating security tooling such as SAST, DAST, SCA, and secret scanning into existing CI/CD pipelines (Jenkins, GitLab CI, GitHub Actions) is technically complex, often slows builds, and produces false positives that must be triaged. Option D is correct because a Secure SDLC requires cultural and process change—shifting security left, adding gates, and changing developer workflows—which typically meets organizational resistance. Option A is not a standard challenge of Secure SDLC implementation; the real tension is balancing security with delivery speed, not that development itself is inherently too slow. Option E is incorrect because large organizations rarely suffer from having too much security budget; budget constraints and tool sprawl are the more common issues.

Answer

The speed of software development is too slow.

Answer

Having too much budget for security tools.

Question 12

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

Accepted Answer

Set the registry URL in the .npmrc file to point specifically to your internal Artifactory or Nexus scope.. Scoped registries in .npmrc ensure that packages within a specific scope are always fetched from the designated private registry, preventing the resolution of malicious public packages with the same name.

Answer

Run 'npm audit fix' before every build process.

Answer

Add the dependency to the 'bundledDependencies' array in package.json.

Answer

Enable 'strict-ssl' in the global npm configuration.

Question 13

Which document is essential to map regulatory compliance requirements to specific software features?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). A Security Requirements Traceability Matrix (SRTM) maps security and regulatory requirements to specific software features, controls, and test cases, providing bidirectional traceability from requirement to implementation and verification. It is the essential document for demonstrating that each regulatory obligation is addressed by a concrete feature or control. This traceability is critical for audits (e.g., PCI DSS, HIPAA, SOX) and for change management.

Answer

System Architecture Document

Answer

Incident Response Plan

Answer

Software Development Plan

Question 14

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Accepted Answer

Reduces the total cost of remediation. Option A is correct because addressing security requirements during early SDLC phases (such as requirements and design) allows flaws to be identified and fixed before code is written or deployed, and defects found later in production or even in testing are dramatically more expensive to remediate — this is the well-established "shift left" cost curve. Option B is correct because incorporating security requirements early ensures that security controls and architecture are designed to support the organization's business objectives, compliance obligations, and risk tolerance rather than being bolted on afterward, keeping security aligned with business requirements. Option C is incorrect because penetration testing remains a necessary validation activity regardless of when security requirements are introduced; early requirements reduce but never eliminate the need for adversarial testing. Option D is incorrect because security requirements typically increase documentation (policies, threat models, control mappings, test evidence) rather than reduce it. Option E is incorrect because security testing cannot be removed — early requirements complement, not replace, verification and validation activities such as SAST, DAST, and penetration testing.

Answer

Eliminates the need for penetration testing

Answer

Reduces the amount of documentation required

Answer

Allows for the removal of all security testing

Question 15

Which of the following describes the purpose of 'misuse case' modeling?

Accepted Answer

To describe scenarios where the system is used to cause harm. Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Answer

To ensure user interface guidelines are followed

Answer

To identify all potential bugs in the code

Answer

To document the project timeline

Question 16

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

Accepted Answer

To restrict access to the minimum necessary for a task.. PoLP ensures that entities are granted only the minimum level of access required to perform their functions.

Answer

To simplify administrative tasks by giving everyone full access.

Answer

To ensure that security controls are invisible to users.

Answer

To provide all users with the same set of permissions.

Answer

To automatically grant permissions based on time of day.

Question 17

Which TWO of the following are examples of how software can maintain 'Integrity'?

Accepted Answer

Using cryptographic hash functions (e.g., SHA-256) to verify file contents.. Integrity means ensuring data is not altered in an unauthorized or undetected way, and option C supports this directly: cryptographic hash functions such as SHA-256 produce a fixed-length digest of file contents, so recomputing the hash and comparing it to a trusted value detects any modification to the data. Option D also supports integrity because strong access control lists (ACLs) restrict who may write to or modify a resource, preventing unauthorized changes at the source. By contrast, option A (AES encryption at rest) primarily provides confidentiality, option B (server always online) addresses availability, and option E (forcing regular password changes) is an authentication/credential-hygiene control, none of which by themselves guarantee that data remains unaltered.

Answer

Encrypting data at rest using AES.

Answer

Ensuring the server is always online.

Answer

Forcing users to change passwords regularly.

Question 18

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) is the recommended mechanism for gRPC service-to-service authentication because gRPC is built on HTTP/2 over TLS, and mTLS provides bidirectional certificate-based authentication of both client and server. Each service presents a certificate, so the caller verifies the callee's identity and vice versa, and the channel is encrypted end-to-end. This aligns with zero-trust principles and is natively supported by gRPC's channel credentials without application-layer token handling.

Answer

HTTP Basic Auth

Answer

IP allow-listing

Answer

Shared API keys in headers

Question 19

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 20

Which phase of the secure software lifecycle is the most cost-effective for identifying and correcting security requirements?

Accepted Answer

Requirements phase. The earlier a requirement gap is identified, the cheaper it is to fix (before design or coding begins).

Answer

Maintenance phase

Answer

Deployment phase

Answer

Testing phase