CSSLP Timed Hard Questions — 25 Difficult Questions

Question 1

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 2

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Option A is correct because a secure credential vault (e.g., HashiCorp Vault, AWS Secrets Manager, or Jenkins Credentials Binding) injects secrets at runtime so they are never hardcoded or persisted in source control or build logs. Option B is correct because SAST tools (e.g., SonarQube, Checkmarx, Semgrep) analyze source code for vulnerabilities such as injection flaws and insecure deserialization before artifacts are built, shifting security left in the pipeline. Option D is correct because isolating build runners in a restricted network segment limits lateral movement and blast radius if a build agent is compromised, enforcing least-privilege network access to only required dependencies and registries. Option C is wrong because granting Admin privileges to all developers violates least privilege and enables unauthorized pipeline, credential, and configuration changes. Option E is wrong because storing secrets in plain text within a Jenkinsfile exposes them to anyone with repository read access and to build log leakage, rather than using masked, runtime-injected credentials.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 3

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 4

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

Accepted Answer

Digitally sign the message payload with the sender's private key and have the receiver verify the signature using the sender's public key.. Digital signatures bind the message content to the sender's private key, so any modification invalidates the signature. Unlike transport-layer protections, a signature remains verifiable after the message leaves the TLS tunnel and is stored in a queue. This provides end-to-end integrity and authenticity, which is critical for payment messages that may traverse multiple services.

Answer

Enable TLS mutual authentication (mTLS) between the sender and the message queue and between the queue and the receiver.

Answer

Encrypt the message payload with a symmetric key shared between the sender and receiver before placing it on the queue.

Answer

Use a message authentication code (MAC) with a key shared between all services that interact with the queue.

Question 5

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 6

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Accepted Answer

Repudiation.. Digital signatures provide non-repudiation because the signer's private key uniquely binds them to the message, so they cannot later deny having signed it, which directly mitigates Repudiation (A). Digital signatures also detect any modification of the signed data through cryptographic hash verification, so any alteration invalidates the signature and mitigates Tampering (E). Elevation of Privilege (B) is mitigated by authorization controls and least-privilege design, not by signatures. Information Disclosure (C) is addressed by encryption such as TLS or AES, not by signing. Denial of Service (D) is mitigated by availability controls like rate limiting and redundancy, which signatures do not provide.

Answer

Elevation of Privilege.

Answer

Information Disclosure.

Answer

Denial of Service.

Question 7

When designing a test case for secure API authentication, which THREE elements should be included?

Accepted Answer

Validating that error messages do not disclose account existence.. Option A is correct because secure API authentication must prevent username/account enumeration: error responses for invalid usernames and invalid passwords should be indistinguishable (same generic message and status code, e.g., 401 with a generic body), so validating that error messages do not disclose account existence is a core security test. Option B is correct because insecure token storage is a common authentication weakness: tests should verify that tokens (JWT, OAuth 2.0 access/refresh tokens, session IDs) are not stored in insecure locations such as localStorage, unencrypted files, or logs, and are protected in transit and at rest. Option C is correct because token lifecycle controls are essential: tests must confirm that tokens expire after their defined lifetime (e.g., JWT 'exp' claim), that refresh tokens can be revoked, and that revoked or expired tokens are rejected by the API. Option D is not a secure authentication test element; automating the password recovery workflow is a functional/process automation concern, not a security validation of authentication mechanisms. Option E is not a security test element; measuring API response speed is a performance test and does not validate authentication security properties.

Answer

Automating the password recovery workflow.

Answer

Testing the speed of the API response.

Question 8

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

Accepted Answer

API Gateway pattern acting as an identity provider proxy.. The API Gateway pattern acting as an identity provider proxy centralizes authentication at the gateway, which validates tokens/credentials and forwards authenticated requests to microservices. This decouples authentication from individual services, allowing them to focus on business logic while the gateway enforces identity consistently.

Answer

Centralized database user management.

Answer

Service Mesh with mutual TLS enabled.

Answer

Sidecar pattern using a local proxy for mTLS.

Question 9

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Accepted Answer

The type of action performed.. Option B is correct because audit logs must record the type of action performed (e.g., login, file access, privilege change, configuration modification) so that reviewers can reconstruct what occurred and determine whether the activity was authorized. Option D is correct because capturing the user identity or service account identifier establishes accountability, tying each event to a specific principal so that actions cannot be repudiated and can be traced back to an individual or automated account. Option E is correct because the timestamp provides the chronological ordering needed for forensic reconstruction and correlation across systems, while the success/failure status distinguishes completed actions from attempted ones, which is essential for detecting brute-force attempts, unauthorized access, and policy violations. Option A is not appropriate because logging full passwords would expose credentials to anyone with log access and violates security best practices; passwords should never be stored in plaintext logs. Option C is not appropriate because a home address and phone number are personally identifiable information that are not relevant to the security event and would create unnecessary privacy and compliance risk.

Answer

The full password of the user involved in the event.

Answer

The user's home address and phone number.

Question 10

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 11

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

Accepted Answer

Non-functional security requirement. Encryption of service-to-service traffic is a quality attribute describing how the system behaves, not a specific function it performs, so it is a non-functional security requirement. It constrains the architecture (e.g., mTLS, TLS 1.3) rather than describing a user-visible behavior. CSSLP categorizes such constraints as non-functional requirements that shape design and verification.

Answer

Functional requirement

Answer

Business rule

Answer

Use case description

Question 12

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.

Question 13

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

Accepted Answer

Transformation Procedures (TPs). Clark-Wilson uses Transformation Procedures (TPs) to move system state from one consistent state to another, strictly controlling access.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Security Labels

Question 14

You are integrating Snyk into a CI pipeline. The scan is failing the build even when no new vulnerabilities are introduced. What is the cause?

Accepted Answer

An expired 'ignore' policy in the .snyk file.. Snyk's 'policy' or '.snyk' file can be configured with 'ignore' rules that expire, or thresholds that trigger build breaks if policy is violated.

Answer

null

Answer

The Snyk token has expired.

Answer

The scan speed is set to 'High'.

Answer

The dependencies are already updated.

Question 15

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

Accepted Answer

Providing the 'Authentication' credentials in the 'Web Applications' section.. Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Answer

Disabling the 'Plugin' set for OS detection.

Answer

Enabling 'Safe Checks' in the policy settings.

Answer

Configuring the 'Port Scanner' to only scan port 80.

Answer

null

Question 16

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

Accepted Answer

Ensure all cryptographic modules are FIPS-validated. FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Answer

Implement multi-party authorization

Answer

Develop custom encryption algorithms

Answer

Encrypt all databases at rest

Question 17

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

Accepted Answer

Using a dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager) to inject secrets at runtime.. Retrieving secrets dynamically from a dedicated secret manager at runtime prevents hard-coding and exposure in configuration files.

Answer

Storing secrets in a configuration file within the deployment container.

Answer

Requesting secrets from the user at application startup.

Answer

Hard-coding secrets in the source code as encrypted strings.

Question 18

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

Accepted Answer

The vendor maintains an inventory of their critical fourth-party service providers.. A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Answer

The vendor provides a generic privacy policy.

Answer

The vendor only uses software developed internally.

Answer

The vendor uses a public cloud provider.

Question 19

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 20

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

Accepted Answer

The agent is not correctly configured to recognize the application's specific data access abstraction layer.. IAST agents instrument the runtime and observe actual data flows, so they must understand how the application accesses data. When the app uses an ORM, custom DAO, or stored procedures, the agent may not recognize the abstraction as a SQL sink and misclassifies safe parameterized calls as vulnerable, producing false positives. Tuning the agent's sink definitions and framework support resolves this.

Answer

null

Answer

The DAST scanner is conflicting with the IAST agent.

Answer

The source code repository is not accessible to the agent.

Answer

The build server lacks sufficient CPU cores for runtime instrumentation.