CSSLP Practice Test 4 — 10 Questions

Question 1

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 2

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Accepted Answer

Implement centralized log aggregation with automated alerting for security events.. Option B is correct because centralized log aggregation (e.g., shipping application and server logs to a SIEM such as Splunk, ELK, or a cloud-native service) combined with automated alerting enables continuous detection of security events like brute-force attempts, privilege escalation, or anomalous access patterns during the operational lifecycle. Option C is correct because strict egress filtering — allowing outbound traffic only to known, required destinations and ports via firewall or security group rules — limits command-and-control callbacks, data exfiltration, and lateral movement if the application is compromised. Option A is wrong because publishing internal server IP addresses in public DNS records exposes the internal topology and increases the attack surface rather than securing the application. Option D is wrong because permitting all inbound traffic on port 80 (HTTP) unconditionally removes access controls and enables exploitation of web-facing vulnerabilities; availability should be achieved through redundancy, not open ports. Option E is wrong because disabling all egress traffic breaks legitimate application functionality (updates, APIs, database calls) and is an over-restrictive measure; egress should be filtered to approved destinations, as in option C.

Answer

Share all internal server IP addresses in the public DNS records.

Answer

Permit all inbound traffic on port 80 to ensure maximum availability.

Answer

Disable all egress traffic from the application servers to prevent data exfiltration.

Question 3

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

Accepted Answer

Security Architect.. The Security Architect is responsible for ensuring security principles are designed into the system architecture from the start.

Answer

Project Manager.

Answer

Software Tester.

Answer

Database Administrator.

Question 4

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

Accepted Answer

Abuse Case Modeling. Abuse case modeling deliberately thinks like an attacker, enumerating misuse scenarios and entry points that legitimate use cases overlook. It is specifically designed to surface attack surfaces such as unauthenticated endpoints, parameter tampering, and privilege escalation paths. This makes it the best elicitation technique for identifying exploitable API entry points.

Answer

User Story Mapping

Answer

Compliance Gap Analysis

Answer

Cost-Benefit Analysis

Question 5

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

Accepted Answer

To intercept and manage network traffic to enforce mTLS and authorization policies.. A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Answer

To act as a backup for the main container if it crashes.

Answer

To provide additional CPU and memory resources to the main container.

Answer

To store persistent data for the main application.

Question 6

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

Accepted Answer

Mean Time to Remediate (MTTR) for vulnerabilities.. Mean Time to Remediate (MTTR) for vulnerabilities is the most useful metric because it directly measures how quickly an organization responds to and fixes security issues identified in the SDLC. A decreasing MTTR over time indicates an effective secure SDLC program that integrates security early and remediates efficiently. It is a outcome-based metric tied to risk reduction.

Answer

Total number of lines of code written.

Answer

Number of developers on the team.

Answer

Budget allocated to security tools.

Question 7

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 8

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 9

During a vendor security assessment, you require a supplier to provide proof that their software is signed. Which mechanism should you verify to ensure the code's integrity and origin authenticity?

Accepted Answer

Digital Signature (e.g., Authenticode or GPG). A digital signature (e.g., Authenticode on Windows, GPG on Linux) uses asymmetric cryptography to provide both integrity and origin authenticity. The vendor signs the code with its private key; you verify with the vendor's public key, confirming the code has not been tampered with and genuinely came from that vendor. This is the only mechanism in the list that proves both integrity and origin.

Answer

Software License Agreement (SLA)

Answer

SHA-256 checksum published on a text file

Answer

Vendor SOC 2 Type II report

Question 10

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.