CSSLP Secure Software Architecture And Design — 30 Questions

Question 1

During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?

Accepted Answer

Implement Mutual TLS (mTLS) for all inter-service communications.. TLS is the standard design pattern for ensuring confidentiality and integrity in transit.

Answer

Implement OAuth 2.0 scopes on the API gateway.

Answer

Use a Hardware Security Module (HSM) to store API keys.

Answer

Enable request rate limiting on the gateway.

Question 2

You are designing a web application and need to ensure the Principle of Least Privilege is applied to database access. Which approach best satisfies this requirement?

Accepted Answer

Use a dedicated service account restricted to execute-only permissions on specific stored procedures.. Using a service account with scoped permissions to specific tables and stored procedures adheres to least privilege.

Answer

Configure the web application to run as the database administrator account.

Answer

Grant the web application service account DBOwner rights on the production database.

Answer

Enable integrated Windows authentication for all database connections.

Question 3

When designing an application that stores sensitive PII, which cryptographic design choice is the most secure?

Accepted Answer

Using established, peer-reviewed cryptographic libraries like libsodium or Tink.. Using established, industry-standard cryptographic libraries is critical to avoid implementation flaws.

Answer

Developing a custom symmetric encryption algorithm for maximum secrecy.

Answer

Storing the encryption key in the same database table as the data.

Answer

D

Answer

Using base64 encoding to 'obscure' the data.

Question 4

Which design principle is exemplified by implementing a Web Application Firewall (WAF) to inspect incoming traffic before it hits the application logic?

Accepted Answer

Defense in depth.. Defense in depth uses multiple layers of security to protect assets, ensuring that one failure does not lead to a total compromise.

Answer

Fail-safe defaults.

Answer

Complete mediation.

Answer

Economy of mechanism.

Question 5

A design team is creating a web form. Which security control should be included in the design to mitigate CSRF (Cross-Site Request Forgery)?

Accepted Answer

Implementing SameSite cookie attributes (e.g., 'Strict' or 'Lax').. Anti-CSRF tokens verify that the request originated from the legitimate application, not an attacker's site.

Answer

Implementing an allow-list for file uploads.

Answer

Encrypting the HTML source code of the form.

Answer

Using a strong password policy for all users.

Question 6

A healthcare organization is designing a new patient portal that will be hosted in a public cloud. The security architect must select a cryptographic key management design that ensures the organization retains exclusive control over encryption keys, even from the cloud provider. The design must also support automatic key rotation and detailed audit logs of all key usage. Which design best meets these requirements?

Accepted Answer

Use a cloud provider's key management service (KMS) with customer-managed keys, where the organization controls key policies and rotation schedules, and all key usage is logged in the provider's audit service.. Customer-managed keys in a cloud KMS provide the necessary balance of control, automation, and auditability. The organization defines policies and rotation, and the provider's audit service logs all key operations. This design ensures exclusive control over key usage decisions without the operational overhead of external key managers, and it meets the requirements for automatic rotation and detailed audit logs.

Answer

Use a hardware security module (HSM) hosted on-premises to generate and store keys, and expose a key management API to the cloud application.

Answer

Use a cloud provider's hold your own key (HYOK) feature, where keys are stored in an external key manager and the cloud provider never has access to the key material.

Answer

Use a cloud provider's bring your own key (BYOK) feature, where the organization generates keys externally and imports them into the cloud provider's key management service (KMS).

Question 7

A financial services company is designing a new online banking application. The security team wants to ensure that if an attacker compromises one user's session, they cannot escalate privileges to access other users' accounts or administrative functions. The design must enforce least privilege and prevent horizontal and vertical privilege escalation. Which design approach best achieves this?

Accepted Answer

Implement attribute-based access control (ABAC) with policies that evaluate user attributes, resource attributes, and environmental conditions, and enforce authorization checks at the data access layer.. Attribute-based access control with data-layer enforcement provides the granularity and depth needed to prevent privilege escalation. By evaluating user, resource, and environmental attributes at the point of data access, the system ensures that every operation is authorized based on the specific context, preventing an attacker from accessing other users' data or administrative functions even if a session is compromised.

Answer

Implement discretionary access control (DAC) where resource owners set permissions, and enforce authorization checks at the API gateway.

Answer

Implement role-based access control (RBAC) with roles assigned based on job functions, and enforce authorization checks at the controller layer of the application.

Answer

Implement mandatory access control (MAC) with security labels assigned to users and resources, and enforce access decisions based on label comparisons at the presentation layer.

Question 8

You are designing an input validation strategy. Which technique provides the best defense against Cross-Site Scripting (XSS)?

Accepted Answer

Performing context-aware output encoding at the presentation layer.. Context-aware output encoding prevents browsers from interpreting user input as active content.

Answer

Using a centralized regex filter to strip HTML tags.

Answer

Encrypting all user input before storing it in the database.

Answer

Implementing a strict allow-list for all input fields.

Question 9

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

Accepted Answer

API Gateway pattern acting as an identity provider proxy.. The API Gateway pattern acting as an identity provider proxy centralizes authentication at the gateway, which validates tokens/credentials and forwards authenticated requests to microservices. This decouples authentication from individual services, allowing them to focus on business logic while the gateway enforces identity consistently.

Answer

Centralized database user management.

Answer

Service Mesh with mutual TLS enabled.

Answer

Sidecar pattern using a local proxy for mTLS.

Question 10

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Accepted Answer

Analyzing the implementation of HttpOnly and Secure flags on session cookies.. Session management is best reviewed by analyzing the cookie attributes and token handling flows.

Answer

Checking for SQL injection in login forms.

Answer

Reviewing the database schema for password hashing algorithms.

Answer

Verifying the presence of a Web Application Firewall (WAF).

Question 11

During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?

Accepted Answer

To identify which security controls and protection levels are required for specific data assets.. Data classification allows for the application of appropriate security controls based on the data's risk profile.

Answer

To identify the database engine version.

Answer

To automate the backup frequency of the database.

Answer

To determine which data needs to be deleted periodically.

Question 12

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

Accepted Answer

Enforcing read-only root filesystems for containers.. Containers should be designed to be immutable and run with minimal privileges, reducing the blast radius.

Answer

Storing secret keys as environment variables in the container spec.

Answer

Running the application process as the root user.

Answer

Using a single large image for all microservices.

Question 13

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Accepted Answer

Disabling all unused services and ports in the production container image.. Secure by default means security controls are enabled without user intervention, such as disabling unnecessary features.

Answer

Allowing administrative access to all users by default.

Answer

Using self-signed certificates in the development environment only.

Answer

Providing a configuration wizard to enable SSL after deployment.

Question 14

In the context of secure design, what does 'Fail-safe defaults' mean when designing an authentication module?

Accepted Answer

If a system error occurs during login, the system denies access by default.. If the module crashes or encounters an error, the system should default to 'deny' access rather than 'allow'.

Answer

The system automatically resets passwords if a login failure occurs.

Answer

The system permits login if the authentication server is unreachable.

Answer

All new users are granted guest access until the admin verifies them.

Question 15

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 16

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

Accepted Answer

Using a dedicated Secret Management service (e.g., HashiCorp Vault, AWS Secrets Manager) to inject secrets at runtime.. Retrieving secrets dynamically from a dedicated secret manager at runtime prevents hard-coding and exposure in configuration files.

Answer

Storing secrets in a configuration file within the deployment container.

Answer

Requesting secrets from the user at application startup.

Answer

Hard-coding secrets in the source code as encrypted strings.

Question 17

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

Accepted Answer

Enforcing centralized, server-side authorization checks for every request.. Policy-based access control (RBAC or ABAC) ensures users only access resources they are authorized to.

Answer

Using HTTPS for all communications.

Answer

Implementing a strong password policy.

Answer

Relying on client-side hidden fields to identify user roles.

Question 18

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 19

Which design principle suggests that developers should keep the security mechanisms simple to understand and implement?

Accepted Answer

Economy of mechanism.. Economy of mechanism ensures that small, simple security designs are easier to verify and less prone to vulnerabilities.

Answer

Open design.

Answer

Complete mediation.

Answer

Defense in depth.

Question 20

When designing an API, which approach best supports the 'Complete Mediation' principle?

Accepted Answer

Verifying authorization on every single API request.. Complete mediation requires that every access to every object be checked for authority.

Answer

Relying on the frontend to filter out unauthorized menu items.

Answer

Checking authorization only once at the beginning of the user session.

Answer

Allowing public access to all GET methods in the API.