CSSLP Practice Questions 2 — 50 Questions

Question 1

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

Accepted Answer

Using a dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager) to inject secrets at runtime.. Retrieving secrets dynamically from a dedicated secret manager at runtime prevents hard-coding and exposure in configuration files.

Answer

Storing secrets in a configuration file within the deployment container.

Answer

Requesting secrets from the user at application startup.

Answer

Hard-coding secrets in the source code as encrypted strings.

Question 2

What is the primary security benefit of using a hardened container base image for microservices?

Accepted Answer

It reduces the attack surface. A hardened container base image removes unnecessary packages, services, shells, and default credentials, reducing the number of potential vulnerabilities and entry points an attacker can exploit. This directly shrinks the attack surface, which is the primary security benefit. Hardening does not inherently improve speed, encrypt logs, or remove the need for patching.

Answer

It increases execution speed

Answer

It automatically encrypts application logs

Answer

It eliminates the need for patching

Question 3

When gathering security requirements, what is the primary challenge when dealing with 'shadow IT' within a large enterprise?

Accepted Answer

Lack of visibility and consistent security enforcement. Shadow IT systems operate outside of managed security requirements, making it difficult to ensure they meet corporate compliance or security standards.

Answer

Slow deployment speeds

Answer

High infrastructure costs

Answer

Excessive user training

Question 4

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 5

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 6

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Accepted Answer

The tag is mutable, allowing an attacker to inject a malicious image.. The ':latest' tag is a mutable pointer, not a fixed version identifier. When a build server pulls 'image:latest', it retrieves whatever image the registry currently associates with that tag, which may differ from the image previously tested or approved. An attacker who compromises the upstream repository or registry account can push a malicious image under ':latest', and the next build will silently consume it — a classic software supply chain attack.

Answer

The tag prevents container layer caching.

Answer

The registry will throttle downloads of the ':latest' tag.

Answer

The tag is deprecated in favor of ':stable'.

Question 7

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

Accepted Answer

Design phase.. The Design phase allows for architectural security reviews and threat modeling before any code is written, ensuring security is integrated early.

Answer

Verification phase.

Answer

Implementation phase.

Answer

Requirements phase.

Question 8

An application requires multi-factor authentication (MFA) for administrative access. During requirements gathering, the security team determines that SMS-based MFA is insufficient for high-risk accounts. What documentation artifact should reflect this specific requirement?

Accepted Answer

Security Requirements Traceability Matrix (SRTM). The Security Requirements Traceability Matrix (SRTM) is the documentation artifact that maps each security requirement to its source, design, implementation, and test evidence. Since the security team has determined that SMS-based MFA is insufficient for high-risk administrative accounts, this specific requirement must be captured and traced through the SDLC. The SRTM ensures the requirement is not lost and can be verified during testing and audit.

Answer

Threat Intelligence Feed

Answer

Change Request Log

Answer

Project Charter

Question 9

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Accepted Answer

To update the SDLC to prevent similar future vulnerabilities.. Lessons learned help update the security lifecycle process to prevent similar future incidents, fostering continuous improvement.

Answer

To calculate the financial loss of the incident.

Answer

To satisfy external auditors' compliance requirements.

Answer

To assign blame to the developer who wrote the code.

Question 10

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Accepted Answer

Assume breach. In a Zero Trust architecture, 'Assume breach' (A) is fundamental because the model presumes no implicit safety and designs for containment, segmentation, and rapid detection/response as if an attacker is already inside. 'Use least privilege access' (C) is correct because every identity and workload should receive only the minimum permissions needed, enforced with just-in-time and just-enough-access controls to limit lateral movement. 'Verify explicitly' (E) is correct because every access request must be authenticated and authorized using all available signals—identity, device health, location, and behavior—before granting resource access. 'Trust but verify' (B) is not a Zero Trust principle; it reflects a perimeter-based mindset where trust is initially granted, which contradicts Zero Trust's 'never trust, always verify' stance. 'Trust all internal network traffic' (D) is the opposite of Zero Trust, since internal networks are treated as untrusted and traffic must be inspected and authorized regardless of origin.

Answer

Trust but verify

Answer

Trust all internal network traffic

Question 11

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Accepted Answer

Disabling all unused services and ports in the production container image.. Secure by default means security controls are enabled without user intervention, such as disabling unnecessary features.

Answer

Allowing administrative access to all users by default.

Answer

Using self-signed certificates in the development environment only.

Answer

Providing a configuration wizard to enable SSL after deployment.

Question 12

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Accepted Answer

Confidentiality. Hardcoded keys violate confidentiality because the keys are exposed to anyone with access to the source code.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Answer

Accounting

Question 13

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

Accepted Answer

To maintain transparency of components and manage dependency risks.. The goal of an SBOM is to provide transparency into the software components and dependencies that make up an application, enabling organizations to identify, assess, and manage dependency-related risks such as vulnerable or unlicensed components. It is a visibility and risk-management artifact, not an automation or training replacement. This transparency is foundational to software supply chain security.

Answer

To increase the speed of software compilation.

Answer

To automatically patch vulnerabilities in code.

Answer

To replace the need for secure coding training.

Question 14

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Accepted Answer

Use a secret management service. A dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores secrets encrypted, controls access via identity and policy, supports rotation and auditing, and keeps secrets out of source code entirely. This is the correct control because it addresses the root cause — secrets embedded in code — rather than masking the symptom. It also enables centralized revocation and rotation when a key is compromised.

Answer

Store it in a public environment variable

Answer

Add it to the .gitignore file

Answer

Obfuscate the key in the code

Question 15

You are reviewing the requirements for a legacy system integration. The system currently transmits credentials over plaintext protocols. What is the priority for the security requirements phase?

Accepted Answer

Mandate the migration to an encrypted transport layer in the SRS. The security requirements phase is where security controls are formally specified in the Software Requirements Specification (SRS). Since the legacy system transmits credentials in plaintext, the priority is to mandate a secure replacement—encrypted transport (e.g., TLS/SSL, SSH, or IPsec)—as a requirement in the SRS. This ensures the security need is captured, tracked, and implemented, rather than deferred or mitigated only at the network level. Documenting technical debt or requesting a waiver does not fix the vulnerability; it merely acknowledges it.

Answer

Request a waiver for the legacy system

Answer

Suggest the use of a VPN for the entire network

Answer

Document the legacy protocol as a technical debt item

Question 16

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Accepted Answer

Establishing and tracking security performance metrics.. Option D is correct because a robust Software Security Governance framework requires measurable oversight: establishing and tracking security performance metrics (e.g., mean time to remediate vulnerabilities, percentage of code scanned, open critical findings) enables an organization to monitor compliance, demonstrate accountability, and drive continuous improvement of its security posture. Option E is correct because governance fundamentally rests on defining clear security policies and standards (such as secure coding standards, SDLC security gates, and risk acceptance criteria) that set mandatory expectations and provide the baseline against which all development and security activities are measured and audited. The remaining options do not belong: outsourcing all security tasks to third-party vendors (A) transfers execution but does not constitute governance, which remains the organization's responsibility; mandating that all developers become certified hackers (B) is neither feasible nor a recognized governance control; and discontinuing all legacy applications (C) is an operational risk decision, not a governance component, and may be impractical or unnecessary.

Answer

Outsourcing all security tasks to third-party vendors.

Answer

Mandating that all developers become certified hackers.

Answer

Discontinuing all legacy applications.

Question 17

Which standard security practice should be applied to all passwords stored in a database?

Accepted Answer

Hashing with a unique salt per user. The correct practice is to hash passwords with a unique salt per user. Hashing is a one-way function that transforms the password into a fixed-length digest, making it infeasible to reverse. A unique salt per user prevents attackers from using precomputed rainbow tables and ensures that identical passwords produce different hashes. This is a fundamental requirement in standards like NIST SP 800-63B and OWASP ASVS.

Answer

Encryption with a symmetric key

Answer

Storing in a configuration file

Answer

Base64 encoding

Question 18

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.

Question 19

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

Accepted Answer

Configure an allowlist-only proxy repository.. An allowlist-only proxy repository permits only explicitly approved packages (by name, version, and hash) to be fetched, so a malicious package with a similar name (e.g., 'reqeusts' instead of 'requests') is rejected even if a developer mistypes it. This is the most effective technical control because it removes reliance on human vigilance and blocks the attack at the dependency-resolution layer.

Answer

Rely on the developer's ability to check spelling.

Answer

Increase the frequency of penetration tests.

Answer

Enable two-factor authentication on developer accounts.

Question 20

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows