CSSLP Practice Questions 1 — 50 Questions

Question 1

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 2

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 3

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 4

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Option A is correct because a secure credential vault (e.g., HashiCorp Vault, AWS Secrets Manager, or Jenkins Credentials Binding) injects secrets at runtime so they are never hardcoded or persisted in source control or build logs. Option B is correct because SAST tools (e.g., SonarQube, Checkmarx, Semgrep) analyze source code for vulnerabilities such as injection flaws and insecure deserialization before artifacts are built, shifting security left in the pipeline. Option D is correct because isolating build runners in a restricted network segment limits lateral movement and blast radius if a build agent is compromised, enforcing least-privilege network access to only required dependencies and registries. Option C is wrong because granting Admin privileges to all developers violates least privilege and enables unauthorized pipeline, credential, and configuration changes. Option E is wrong because storing secrets in plain text within a Jenkinsfile exposes them to anyone with repository read access and to build log leakage, rather than using masked, runtime-injected credentials.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 5

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Accepted Answer

Spoofing. STRIDE is Microsoft's threat modeling framework, and the 'S' stands for Spoofing, which is the threat of an attacker impersonating a legitimate user, system, or process. Spoofing violates authentication and is typically mitigated with strong authentication mechanisms such as MFA or certificates.

Answer

Software integrity

Answer

Service availability

Answer

System hardening

Answer

Secure architecture

Question 6

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Accepted Answer

Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.. Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Answer

Store all application logs in a publicly accessible S3 bucket for easy debugging.

Answer

Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

Answer

Increase the log verbosity to the maximum level in production indefinitely.

Question 7

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Option A (System functional requirements) is correct because abuse cases are derived by systematically negating and misusing each legitimate function the system is specified to perform, so the functional requirements define the attack surface and the intended behaviors that must be subverted. Option D (Known threat intelligence and past incident history) is correct because real-world attacker tactics, techniques, and procedures (TTPs) and prior incidents reveal which abuses are realistic and likely, grounding the abuse cases in evidence rather than speculation. The annual maintenance budget (B) is a financial planning input that does not describe attacker behavior or system functionality, so it cannot drive abuse-case content. Developer performance metrics (C) measure productivity or code quality and are irrelevant to modeling adversarial misuse. The internal office floor plan (E) is a physical-security artifact and, while tangentially related to facility security, is not a primary input for developing abuse cases about system behavior.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 8

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 9

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Accepted Answer

Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.. Integrating the Snyk Security plugin into the Jenkins build step scans the container image at build time, before promotion, enabling fail-fast remediation. This shifts security left and blocks vulnerable images from reaching production. It is the most effective because scanning occurs in the pipeline stage where the image is created.

Answer

Configure a post-deployment notification to Slack using a webhook.

Answer

Manually verify image signatures using Docker Content Trust after deployment.

Answer

Enable Jenkins 'Build periodically' to scan images in the registry.

Question 10

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

Accepted Answer

Digitally sign the message payload with the sender's private key and have the receiver verify the signature using the sender's public key.. Digital signatures bind the message content to the sender's private key, so any modification invalidates the signature. Unlike transport-layer protections, a signature remains verifiable after the message leaves the TLS tunnel and is stored in a queue. This provides end-to-end integrity and authenticity, which is critical for payment messages that may traverse multiple services.

Answer

Enable TLS mutual authentication (mTLS) between the sender and the message queue and between the queue and the receiver.

Answer

Encrypt the message payload with a symmetric key shared between the sender and receiver before placing it on the queue.

Answer

Use a message authentication code (MAC) with a key shared between all services that interact with the queue.

Question 11

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Accepted Answer

Analyzing the implementation of HttpOnly and Secure flags on session cookies.. Session management is best reviewed by analyzing the cookie attributes and token handling flows.

Answer

Checking for SQL injection in login forms.

Answer

Reviewing the database schema for password hashing algorithms.

Answer

Verifying the presence of a Web Application Firewall (WAF).

Question 12

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 13

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Accepted Answer

Testing the password recovery/reset workflow.. Option A is correct because the password recovery/reset workflow is a classic authentication bypass vector: testers must check for predictable or leaked reset tokens, token reuse, missing expiry, host-header injection in reset links, and whether the reset endpoint verifies the user's identity before allowing a password change. Option C is correct because manipulating session cookies (e.g., tampering with session IDs, forging JWTs, altering role/identity claims, or replaying stolen cookies) directly tests whether the application properly validates session state and can be tricked into granting authenticated access without valid credentials. Option E is correct because brute forcing account credentials tests authentication strength controls such as account lockout thresholds, rate limiting, CAPTCHA enforcement, and password complexity, all of which are core to assessing whether authentication can be bypassed through weak credential policies. Options B and D are incorrect because changing the CSS file or the application's color scheme are purely cosmetic presentation changes that have no bearing on authentication logic, session handling, or access control.

Answer

Changing the application's CSS file.

Answer

Testing the application's color scheme.

Question 14

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

Accepted Answer

Enforcing mutual TLS (mTLS) for authentication.. Option A is correct because enforcing mutual TLS (mTLS) authenticates both the client and the server at the transport layer, adding a strong cryptographic identity check that complements higher-layer controls in a defense-in-depth strategy. Option B is correct because rate limiting at the API gateway mitigates abuse, brute-force attempts, and denial-of-service by throttling excessive requests, providing an independent protective layer even if other controls fail. Option E is correct because input validation for all parameters prevents injection attacks (such as SQLi and XSS) and malformed data from reaching backend logic, forming a critical application-layer defense. Option C is not appropriate because hardcoding API keys in source code exposes secrets to anyone with repository access and prevents rotation, weakening security rather than adding a layer. Option D is not appropriate because relying solely on a WAF creates a single point of failure and ignores other layers like authentication, input validation, and rate limiting that defense in depth requires.

Answer

Hardcoding API keys in the code for efficiency.

Answer

Relying solely on the WAF for security.

Question 15

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Accepted Answer

Repudiation.. Digital signatures provide non-repudiation because the signer's private key uniquely binds them to the message, so they cannot later deny having signed it, which directly mitigates Repudiation (A). Digital signatures also detect any modification of the signed data through cryptographic hash verification, so any alteration invalidates the signature and mitigates Tampering (E). Elevation of Privilege (B) is mitigated by authorization controls and least-privilege design, not by signatures. Information Disclosure (C) is addressed by encryption such as TLS or AES, not by signing. Denial of Service (D) is mitigated by availability controls like rate limiting and redundancy, which signatures do not provide.

Answer

Elevation of Privilege.

Answer

Information Disclosure.

Answer

Denial of Service.

Question 16

When designing a test case for secure API authentication, which THREE elements should be included?

Accepted Answer

Validating that error messages do not disclose account existence.. Option A is correct because secure API authentication must prevent username/account enumeration: error responses for invalid usernames and invalid passwords should be indistinguishable (same generic message and status code, e.g., 401 with a generic body), so validating that error messages do not disclose account existence is a core security test. Option B is correct because insecure token storage is a common authentication weakness: tests should verify that tokens (JWT, OAuth 2.0 access/refresh tokens, session IDs) are not stored in insecure locations such as localStorage, unencrypted files, or logs, and are protected in transit and at rest. Option C is correct because token lifecycle controls are essential: tests must confirm that tokens expire after their defined lifetime (e.g., JWT 'exp' claim), that refresh tokens can be revoked, and that revoked or expired tokens are rejected by the API. Option D is not a secure authentication test element; automating the password recovery workflow is a functional/process automation concern, not a security validation of authentication mechanisms. Option E is not a security test element; measuring API response speed is a performance test and does not validate authentication security properties.

Answer

Automating the password recovery workflow.

Answer

Testing the speed of the API response.

Question 17

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

Accepted Answer

API Gateway pattern acting as an identity provider proxy.. The API Gateway pattern acting as an identity provider proxy centralizes authentication at the gateway, which validates tokens/credentials and forwards authenticated requests to microservices. This decouples authentication from individual services, allowing them to focus on business logic while the gateway enforces identity consistently.

Answer

Centralized database user management.

Answer

Service Mesh with mutual TLS enabled.

Answer

Sidecar pattern using a local proxy for mTLS.

Question 18

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

Accepted Answer

Using parameterized queries. Option B (parameterized queries) is correct because parameterized queries (prepared statements) separate SQL code from user-supplied data, so the database engine treats input strictly as data rather than executable SQL, which neutralizes injection payloads. Option D (applying the principle of least privilege to the database user) is correct because limiting the application's database account to only the permissions it truly needs (e.g., no DROP, no xp_cmdshell, no unnecessary table access) reduces the blast radius if an injection flaw is ever exploited. Option E (strict input validation based on allow-lists) is correct because allow-list validation rejects any input that does not match an expected, tightly defined pattern, preventing malicious characters or payloads from ever reaching the SQL layer. Option A is not correct because stored procedures that internally build dynamic SQL strings via concatenation remain vulnerable to injection; stored procedures are only safe when they themselves use parameterization. Option C is not correct because client-side validation can be trivially bypassed by an attacker using a proxy or direct HTTP requests, so it must never be the sole defense against SQL injection.

Answer

Using stored procedures with dynamic SQL

Answer

Relying solely on client-side validation

Question 19

When designing an API, which approach best supports the 'Complete Mediation' principle?

Accepted Answer

Verifying authorization on every single API request.. Complete mediation requires that every access to every object be checked for authority.

Answer

Relying on the frontend to filter out unauthorized menu items.

Answer

Checking authorization only once at the beginning of the user session.

Answer

Allowing public access to all GET methods in the API.

Question 20

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Accepted Answer

The type of action performed.. Option B is correct because audit logs must record the type of action performed (e.g., login, file access, privilege change, configuration modification) so that reviewers can reconstruct what occurred and determine whether the activity was authorized. Option D is correct because capturing the user identity or service account identifier establishes accountability, tying each event to a specific principal so that actions cannot be repudiated and can be traced back to an individual or automated account. Option E is correct because the timestamp provides the chronological ordering needed for forensic reconstruction and correlation across systems, while the success/failure status distinguishes completed actions from attempted ones, which is essential for detecting brute-force attempts, unauthorized access, and policy violations. Option A is not appropriate because logging full passwords would expose credentials to anyone with log access and violates security best practices; passwords should never be stored in plaintext logs. Option C is not appropriate because a home address and phone number are personally identifiable information that are not relevant to the security event and would create unnecessary privacy and compliance risk.

Answer

The full password of the user involved in the event.

Answer

The user's home address and phone number.