CSSLP Secure Software Deployment Operations And Management Practice Test 1 — 15 Questions

Question 1

You are troubleshooting a production incident where a legacy application is performing insecure cryptographic operations. Which feature of a Web Application Firewall (WAF) can best help mitigate the risk while a code fix is being developed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a custom WAF rule to block requests containing anomalous cryptographic parameters.. A WAF can inspect incoming requests and apply custom rules to detect and block patterns indicative of insecure cryptographic operations, such as weak algorithms, short keys, or malformed parameters. By deploying a custom rule, you can virtually patch the legacy application without modifying its code, providing immediate risk mitigation while a proper code fix is developed. This aligns with the CSSLP principle of compensating controls during incident response.

Answer

Upgrade the SSL/TLS certificate to a higher bit-length.

Answer

Enable HTTP/2 protocol enforcement on the WAF load balancer.

Answer

Disable the WAF's logging feature to improve response time during the incident.

Question 2

You are deploying a web application to AWS using Elastic Beanstalk. To ensure secure configuration management, you decide to store sensitive database credentials. Which approach is the most secure according to AWS best practices?

Accepted Answer

Use AWS Secrets Manager to inject secrets as environment variables during instance bootstrap.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets, and integrates with Elastic Beanstalk to inject secrets as environment variables during instance bootstrap. This keeps credentials out of source code, config files, and the console, and supports automatic rotation via Lambda. It aligns with AWS Well-Architected security best practices for secret management.

Answer

Hardcode the credentials in the application code and use AWS KMS to encrypt the binary at rest.

Answer

Use the Elastic Beanstalk Console to set plain-text environment properties.

Answer

Store credentials in the .ebextensions/environment.config file with read-only permissions.

Question 3

You are implementing 'Blue-Green' deployment. What is the most critical security step to perform during the cut-over process?

Accepted Answer

Run automated security integration tests on the Green environment while it is behind the load balancer.. Running automated security integration tests on the Green environment while it is behind the load balancer is the most critical security step because it validates the security posture of the new environment before it receives production traffic. This ensures that vulnerabilities are identified and addressed prior to cut-over, reducing the risk of exposing sensitive data or services. It aligns with the principle of testing in a production-like environment without impacting users.

Answer

Immediately shut down the Blue environment to save costs.

Answer

Update the load balancer configuration to point to both environments simultaneously.

Answer

Ensure both environments use the same shared database instance.

Question 4

When setting up operational monitoring, what is the 'Golden Signal' that specifically indicates a potential Denial of Service (DoS) attack?

Accepted Answer

A significant increase in the rate of 5xx errors and request latency.. A sudden spike in error rates or latency, combined with high request volume, is a primary indicator of a DoS attack.

Answer

An increase in the number of developers logged into the system.

Answer

A decrease in CPU utilization across all servers.

Answer

A reduction in database write operations.

Question 5

You are managing secure deployment for a Java application. You need to ensure that the application runtime does not have excessive permissions. Which runtime security practice is most effective?

Accepted Answer

Configure a custom Java Security Manager policy file to restrict access to sensitive system resources.. A custom Java Security Manager policy file enforces fine-grained runtime permissions, restricting the application's access to files, sockets, system properties, and other sensitive resources according to least privilege. This directly addresses the requirement that the runtime not have excessive permissions, limiting damage if the app is compromised.

Answer

Run the Java application as the root user to ensure all permissions are available.

Answer

Disable the Java Virtual Machine's garbage collection to prevent memory-based attacks.

Answer

Assign a public IP address to the application server to facilitate remote debugging.

Question 6

A DevOps team is preparing a rollback strategy for a high-traffic e-commerce application that uses a relational database with schema migrations. The team must ensure that a failed deployment can be reversed safely without data loss. Which two practices best support a secure and reliable rollback? (Choose two.)

Accepted Answer

Design database migrations to be backward compatible so the previous application version can still read and write the schema after a rollback.. Backward-compatible schema migrations let the previous application version keep functioning against the database, and feature flags allow new behavior to be disabled instantly without redeploying. Together they enable fast, safe reversal with minimal data risk, which is essential for a high-traffic e-commerce application where downtime and data loss are unacceptable.

Answer

Apply all schema migrations and application changes in a single atomic deployment step so the state is never partially updated.

Answer

Take a full database backup immediately before every deployment and restore it if the release fails.

Answer

Schedule rollbacks only during the nightly maintenance window to avoid impacting live customer sessions.

Question 7

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

Accepted Answer

Change the password for the database user and update the application deployment manifest.. When environment variables containing credentials are compromised, the immediate step is to rotate the exposed credentials—specifically, change the database user's password and update the application deployment manifest to use the new password. This invalidates the attacker's access and restores secure authentication. The other options do not address the credential compromise directly.

Answer

Clear the application's cache to remove any temporary sensitive data.

Answer

Increase the logging level to 'DEBUG' to track the attacker's actions.

Answer

Re-deploy the application using the same configuration to ensure a clean state.

Question 8

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

Accepted Answer

Verify the digital signature using a trusted public key from your organization's key store.. Cryptographic signing (such as GPG or Cosign for containers) creates a verifiable link between the source code and the binary.

Answer

Check the file timestamp using the operating system's file system metadata.

Answer

Upload the artifact to a public VirusTotal scan before deploying.

Answer

Compare the file size of the artifact with the size listed in the manifest file.

Question 9

A security analyst notices anomalous outbound traffic from a containerized microservice that was recently deployed. Which Kubernetes feature should be used to restrict this traffic to only known authorized endpoints?

Accepted Answer

Apply a NetworkPolicy object that defines specific egress rules for the application namespace.. A NetworkPolicy object with specific egress rules is correct because Kubernetes NetworkPolicy provides pod-level, namespace-scoped control over ingress and egress traffic. By defining egress rules that allow only known authorized endpoints (IP blocks, ports, or namespace selectors), the analyst can restrict the microservice's outbound traffic. This directly addresses anomalous outbound connections at the network layer.

Answer

Enable the Kubernetes Audit Log and monitor for kubectl exec commands.

Answer

Configure PodSecurityPolicies to restrict the containers to non-root users.

Answer

Install a Service Mesh like Istio to enforce mTLS.

Question 10

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

Accepted Answer

Maintaining a consistent and hardened state across all environments.. Secure Configuration Management ensures systems are deployed and maintained in a known, hardened, consistent state across development, test, and production — removing default accounts, disabling unnecessary services, applying CIS benchmarks, and detecting drift. Consistency across environments prevents 'it works in dev but is insecure in prod' gaps and supports reproducible audits.

Answer

Reducing the total cost of ownership of the cloud infrastructure.

Answer

Ensuring that developers have administrative access to production databases.

Answer

Maximizing the number of features delivered in each release.

Question 11

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Accepted Answer

Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.. Integrating the Snyk Security plugin into the Jenkins build step scans the container image at build time, before promotion, enabling fail-fast remediation. This shifts security left and blocks vulnerable images from reaching production. It is the most effective because scanning occurs in the pipeline stage where the image is created.

Answer

Configure a post-deployment notification to Slack using a webhook.

Answer

Manually verify image signatures using Docker Content Trust after deployment.

Answer

Enable Jenkins 'Build periodically' to scan images in the registry.

Question 12

When managing infrastructure as code (IaC) using Terraform, which practice is the most critical for secure configuration management of state files?

Accepted Answer

Use a remote backend like S3 with server-side encryption enabled and restricted IAM policies.. Terraform state files contain sensitive data such as resource IDs, IP addresses, and sometimes plaintext secrets. Storing them in a remote backend like Amazon S3 with server-side encryption (SSE) and tightly scoped IAM policies ensures that the state is encrypted at rest, access is audited and controlled, and the file is not exposed on local disks or in version control. This practice aligns with the principle of least privilege and defense in depth for infrastructure secrets.

Answer

Rename the state file to 'secret.tfstate' to hide it from attackers.

Answer

Store state files in a version-controlled Git repository for change tracking.

Answer

Manually delete the state file after every Terraform apply command.

Question 13

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

Accepted Answer

Define specific versions for all dependencies in a lock file and use a private repository with scoped registries.. Dependency confusion attacks exploit misconfigured package managers that check public registries for packages not found internally. Option B directly mitigates this by using a lock file to pin exact versions (preventing automatic pulling of newer malicious versions) and a private repository with scoped registries (ensuring that internal packages are only fetched from trusted sources, not public ones). This combination prevents the attacker from registering a public package with the same name as an internal one and having it pulled during build.

Answer

Run all build processes in an isolated network segment without internet access.

Answer

Use only open-source software libraries.

Answer

Regularly scan the public registries for malicious packages.

Question 14

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?

Accepted Answer

To intercept and manage network traffic to enforce mTLS and authorization policies.. A sidecar container in a service mesh (e.g., Istio's Envoy proxy) runs alongside the application container in the same pod and transparently intercepts all inbound and outbound network traffic. It enforces mutual TLS between services, applies authorization policies, collects telemetry, and performs traffic routing — all without modifying application code. This is the defining function of the sidecar pattern in a service mesh: it externalizes cross-cutting network security concerns from the application.

Answer

To act as a backup for the main container if it crashes.

Answer

To provide additional CPU and memory resources to the main container.

Answer

To store persistent data for the main application.

Question 15

Which of the following is a key component of a 'Secure Software Deployment' plan?

Accepted Answer

A rollback procedure that allows returning to a known good state.. A secure software deployment plan must include a tested rollback procedure so that if a release introduces a vulnerability, breaks functionality, or is exploited, the team can rapidly return to a known good state. Rollback is a core deployment safety control because it bounds the blast radius and downtime of a failed or compromised release. Without it, recovery from a bad deployment depends on ad-hoc fixes under pressure, which is exactly when security mistakes happen.

Answer

A list of all developers who worked on the release.

Answer

A plan for decommissioning all previous versions of the software.

Answer

An automated script that changes the administrator password on every server.