CSSLP Secure Software Concepts — Timed 25 Questions

Question 1

You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?

Accepted Answer

The write is denied because the *-property prohibits writing to a higher security level.. The *-property (star-property) of Bell-LaPadula prevents 'write-down', meaning a subject cannot write to a lower level, but also enforces no-read-up/no-write-down rules.

Answer

The write is permitted.

Answer

The write is denied due to the no-write-down rule.

Answer

The system allows the write only if encryption is used.

Question 2

When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?

Accepted Answer

Read-down. The Biba Integrity Model is the inverse of Bell-LaPadula and focuses on preserving integrity. It prohibits reading down (a subject at a higher integrity level reading a lower-integrity object) because that would allow less trustworthy data to contaminate higher-integrity data. The rule 'no read down' is the core restriction that maintains integrity of higher-level objects.

Answer

Read-up

Answer

Write-up

Answer

Execute-down

Answer

Append-down

Question 3

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

Accepted Answer

Transformation Procedures (TPs). Clark-Wilson uses Transformation Procedures (TPs) to move system state from one consistent state to another, strictly controlling access.

Answer

Role-Based Access Control (RBAC)

Answer

Attribute-Based Access Control (ABAC)

Answer

Discretionary Access Control (DAC)

Answer

Security Labels

Question 4

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

Accepted Answer

Using a dedicated service account with granular permissions for database access.. Using a dedicated service account with granular permissions for database access embodies least privilege by granting only the necessary permissions to perform specific tasks. This minimizes the attack surface and limits potential damage from compromised credentials. The other options either grant excessive permissions or violate least privilege by allowing broad access.

Answer

Granting the application access to all system environment variables.

Answer

Enabling 'Everyone' write access to application configuration files.

Answer

Running the application process as 'root' or 'administrator'.

Question 5

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

Accepted Answer

Confidentiality. Hardcoded keys violate confidentiality because the keys are exposed to anyone with access to the source code.

Answer

Availability

Answer

Non-repudiation

Answer

Integrity

Answer

Accounting

Question 6

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

Accepted Answer

Authentication. Requiring the client_secret during the token exchange authenticates the client to the authorization server, ensuring that only the legitimate registered client can redeem the authorization code. This is fundamentally an authentication control — it verifies the identity of the client application — which is why D is correct.

Answer

Availability

Answer

Non-repudiation

Answer

Confidentiality

Answer

Integrity

Question 7

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Accepted Answer

Spoofing. STRIDE is Microsoft's threat modeling framework, and the 'S' stands for Spoofing, which is the threat of an attacker impersonating a legitimate user, system, or process. Spoofing violates authentication and is typically mitigated with strong authentication mechanisms such as MFA or certificates.

Answer

Software integrity

Answer

Service availability

Answer

System hardening

Answer

Secure architecture

Question 8

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

Accepted Answer

Non-repudiation. Digital signatures are the standard mechanism for proving authenticity and non-repudiation.

Answer

Authorization

Answer

Encryption

Answer

Availability

Answer

Confidentiality

Question 9

A software architect is designing a system where data must remain accessible even if the primary database server fails. They implement a synchronous database replication strategy. Which core security concept is being prioritized?

Accepted Answer

Availability. Availability is prioritized by ensuring data access despite server failure through replication.

Answer

Non-repudiation

Answer

Integrity

Answer

Confidentiality

Question 10

Which of the following is an example of defense-in-depth in a web application architecture?

Accepted Answer

Implementing input validation, parameterized queries, and a Web Application Firewall (WAF).. Defense-in-depth layers multiple independent controls so that a failure or bypass of one does not compromise the whole system. Option C combines three distinct layers: input validation at the application code layer, parameterized queries at the data-access layer to prevent SQL injection, and a WAF at the network/edge layer to filter malicious HTTP traffic. Together they address the same threat class (injection) through different mechanisms, which is the textbook definition of layered defense.

Answer

Disabling all firewall rules for testing purposes.

Answer

Storing all application data in a single encrypted volume.

Answer

Removing all logs to prevent unauthorized access to audit trails.

Answer

Using a single strong password for all database accounts.

Question 11

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

Accepted Answer

To restrict access to the minimum necessary for a task.. PoLP ensures that entities are granted only the minimum level of access required to perform their functions.

Answer

To simplify administrative tasks by giving everyone full access.

Answer

To ensure that security controls are invisible to users.

Answer

To provide all users with the same set of permissions.

Answer

To automatically grant permissions based on time of day.

Question 12

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

Accepted Answer

If the authorization check fails, explicitly deny the request.. Fail-safe defaults mean that if an error or crash occurs, the system defaults to the most secure state (e.g., access denied).

Answer

If the authentication service is down, allow access to all users.

Answer

If the firewall fails, allow all traffic to pass through.

Answer

Default all new user accounts to 'Administrator' role.

Answer

If the load balancer times out, bypass the application logic.

Question 13

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

Accepted Answer

One developer commits code, and a separate user with deployment permissions triggers the release.. Separation of Duties (SoD) requires that no single individual controls all phases of a critical process. In a CI/CD pipeline, having one developer commit code and a different user with deployment permissions trigger the release enforces a check-and-balance so that the author cannot unilaterally push code to production. This is the canonical SoD implementation.

Answer

The same developer writes, reviews, and deploys the code.

Answer

The QA team is allowed to modify production database records.

Answer

The build server automatically deploys code without human verification.

Answer

All developers have access to the production environment credentials.

Question 14

When designing secure software, why is 'Economy of Mechanism' important?

Accepted Answer

To minimize the attack surface by keeping the design simple.. Economy of Mechanism is a core security design principle (from Saltzer and Schroeder) that advocates for simple, minimal designs. By keeping the design as simple as possible, the number of potential vulnerabilities and entry points for attackers is reduced, directly minimizing the attack surface. This simplicity also makes the system easier to verify and secure.

Answer

To lower the cost of hardware infrastructure.

Answer

To increase the lines of code for better functionality.

Answer

To ensure that the software is faster at runtime.

Answer

To enable easier debugging for developers.

Question 15

Which concept describes the ability of a system to provide services to authorized users even during a heavy load or denial of service attack?

Accepted Answer

Availability. Availability specifically refers to the system's ability to remain operational and accessible.

Answer

Non-repudiation

Answer

Integrity

Answer

Authentication

Answer

Confidentiality

Question 16

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

Accepted Answer

Checking authorization for every access request.. The Complete Mediation principle requires that every access request to a resource be checked for authorization, not just at login or at certain times. This ensures that no access is granted without a current authorization decision, preventing bypasses due to cached permissions or session hijacking. It is a core principle of secure design, ensuring that each access is validated against the security policy.

Answer

Granting permanent access to all authenticated users.

Answer

Checking authorization only at login.

Answer

Relying on the user to request access when needed.

Answer

Caching permissions to reduce latency.

Question 17

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Accepted Answer

Using a user-friendly mobile app push notification for authentication.. Psychological acceptability ensures that security measures are easy for users to understand and use, so they don't circumvent them.

Answer

Providing zero feedback to users during the login process.

Answer

Requiring a 64-character password changed every 24 hours.

Answer

Disabling the ability for users to reset their own passwords.

Answer

Forcing users to solve a complex CAPTCHA at every login attempt.

Question 18

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Accepted Answer

Assume breach. In a Zero Trust architecture, 'Assume breach' (A) is fundamental because the model presumes no implicit safety and designs for containment, segmentation, and rapid detection/response as if an attacker is already inside. 'Use least privilege access' (C) is correct because every identity and workload should receive only the minimum permissions needed, enforced with just-in-time and just-enough-access controls to limit lateral movement. 'Verify explicitly' (E) is correct because every access request must be authenticated and authorized using all available signals—identity, device health, location, and behavior—before granting resource access. 'Trust but verify' (B) is not a Zero Trust principle; it reflects a perimeter-based mindset where trust is initially granted, which contradicts Zero Trust's 'never trust, always verify' stance. 'Trust all internal network traffic' (D) is the opposite of Zero Trust, since internal networks are treated as untrusted and traffic must be inspected and authorized regardless of origin.

Answer

Trust but verify

Answer

Trust all internal network traffic

Question 19

Which TWO of the following are examples of how software can maintain 'Integrity'?

Accepted Answer

Using cryptographic hash functions (e.g., SHA-256) to verify file contents.. Integrity means ensuring data is not altered in an unauthorized or undetected way, and option C supports this directly: cryptographic hash functions such as SHA-256 produce a fixed-length digest of file contents, so recomputing the hash and comparing it to a trusted value detects any modification to the data. Option D also supports integrity because strong access control lists (ACLs) restrict who may write to or modify a resource, preventing unauthorized changes at the source. By contrast, option A (AES encryption at rest) primarily provides confidentiality, option B (server always online) addresses availability, and option E (forcing regular password changes) is an authentication/credential-hygiene control, none of which by themselves guarantee that data remains unaltered.

Answer

Encrypting data at rest using AES.

Answer

Ensuring the server is always online.

Answer

Forcing users to change passwords regularly.

Question 20

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

Accepted Answer

Integrity. Option C (Integrity) is correct because the CIA triad explicitly consists of Confidentiality, Integrity, and Availability, where integrity ensures data is accurate, complete, and unaltered by unauthorized parties. Option D (Confidentiality) is correct because it is the core element of the triad that ensures information is accessible only to authorized individuals, typically enforced through encryption and access controls. The unmarked options do not belong: Non-repudiation (A) is a separate security property proving a party cannot deny an action, Accounting (B) relates to auditing and tracking user activity, and Authentication (E) is the process of verifying identity, all of which support but are not components of the CIA triad itself.

Answer

Non-repudiation

Answer

Accounting

Answer

Authentication