CSSLP Secure Software Implementation — 10 Questions

Question 1

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Accepted Answer

Using AES-256 encryption. AES-256 is a symmetric block cipher approved by NIST (FIPS 197) and is the standard recommendation for encrypting data at rest in databases, offering strong confidentiality with acceptable performance. It is used in modes like GCM or CBC with proper key management (e.g., KMS, HSM) to protect sensitive fields, tablespaces, or full-disk volumes.

Answer

Using cleartext with database permissions

Answer

Using MD5 hashing

Answer

Storing data in base64 encoding

Question 2

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. In EJS, the <%= %> tag performs HTML entity escaping on the output, converting characters like <, >, &, and quotes into safe entities so injected markup cannot execute in the browser. This directly neutralizes the most common XSS vector — reflected or stored script tags in user-supplied data. Using escaped output is the canonical secure-coding practice for rendering untrusted content in EJS templates.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 3

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 4

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 5

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 6

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Accepted Answer

Buffer overflow. Buffer overflow is a memory safety vulnerability that arises from improper bounds checking on arrays or pointer arithmetic, leading to out-of-bounds writes. Static analysis tools like Fortify and Coverity use data flow analysis and taint tracking to identify such patterns by examining array indices, pointer dereferences, and memory copy operations. They can flag potential overflows without executing the code, making it a prime target for static analysis in C++ applications.

Answer

Database connection timeout

Answer

Business logic flaws

Answer

Zero-day authentication bypass

Question 7

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 8

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 9

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks. The 'state' parameter in OAuth2 is an opaque value generated by the client and returned unchanged by the authorization server in the redirect. The client verifies that the returned state matches the value it sent, which binds the authorization response to the user's session and prevents cross-site request forgery (CSRF) attacks where an attacker tricks a victim into submitting an attacker's authorization code.

Answer

To store the user's password

Answer

To track the user's location

Answer

To encrypt the access token

Question 10

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Accepted Answer

To provide a complete inventory of software components. An SBOM provides a machine-readable, complete inventory of all software components and their dependencies, which is essential for identifying and responding to vulnerabilities in third-party libraries. Without this inventory, an organization cannot know whether it is affected by a newly disclosed CVE in a transitive dependency. This transparency is the foundation of software supply chain risk management.

Answer

To encrypt source code

Answer

To speed up build times

Answer

To replace the need for unit testing