CSSLP Secure Software Implementation — 20 Questions

Question 1

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Accepted Answer

Using AES-256 encryption. AES-256 is the industry standard for symmetric encryption of data at rest.

Answer

Using cleartext with database permissions

Answer

Using MD5 hashing

Answer

Storing data in base64 encoding

Question 2

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. Escaping output is the primary defense against XSS; EJS uses the <%= %> tag for escaped output, which handles special characters.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 3

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. Spring Security enables CSRF protection by default, which validates tokens for non-GET requests; disabling it (csrf().disable()) is the primary cause of vulnerability.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 4

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when input fields are mapped directly to database objects; using Data Transfer Objects (DTOs) allows explicit control over allowed fields.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 5

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. The --suppression flag allows developers to provide an XML file that defines rules to ignore specific CVEs or false positives in the dependency scan report.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 6

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Accepted Answer

Buffer overflow. Static analysis tools are highly effective at identifying buffer overflows, which are common in C++ due to manual memory management.

Answer

Database connection timeout

Answer

Business logic flaws

Answer

Zero-day authentication bypass

Question 7

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive dictates valid sources for executable scripts, preventing malicious code injection from untrusted domains.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 8

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 9

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks. The state parameter is used to prevent CSRF in OAuth flows by ensuring the redirect matches the original request.

Answer

To store the user's password

Answer

To track the user's location

Answer

To encrypt the access token

Question 10

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Accepted Answer

To provide a complete inventory of software components. An SBOM provides a comprehensive list of all components, making it possible to identify if a newly disclosed vulnerability affects your application.

Answer

To encrypt source code

Answer

To speed up build times

Answer

To replace the need for unit testing

Question 11

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

Accepted Answer

SQL Injection. Parameterized queries ensure that user input is treated as data, not executable code, effectively preventing SQL Injection.

Answer

Session Hijacking

Answer

Insecure Deserialization

Answer

Directory Traversal

Question 12

What is the primary security benefit of using a hardened container base image for microservices?

Accepted Answer

It reduces the attack surface. Hardened images remove unnecessary binaries and shells, reducing the attack surface for potential exploits.

Answer

It increases execution speed

Answer

It automatically encrypts application logs

Answer

It eliminates the need for patching

Question 13

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Accepted Answer

Use a secret management service. Secret management services like HashiCorp Vault or AWS Secrets Manager allow externalizing and rotating secrets without code changes.

Answer

Store it in a public environment variable

Answer

Add it to the .gitignore file

Answer

Obfuscate the key in the code

Question 14

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 15

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows

Question 16

Which standard security practice should be applied to all passwords stored in a database?

Accepted Answer

Hashing with a unique salt per user. Salting and hashing with a strong, slow algorithm (like Argon2 or bcrypt) is required to protect passwords.

Answer

Encryption with a symmetric key

Answer

Storing in a configuration file

Answer

Base64 encoding

Question 17

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

Accepted Answer

Security requirements definition. Threat modeling and security requirements are foundational to the SSDLC process.

Answer

Hardware procurement

Answer

Marketing strategies

Answer

Unlimited project budget

Question 18

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Accepted Answer

The use of native object serialization. Deserialization of untrusted data in languages like Java (ObjectInputStream) or Python (pickle) can allow code execution.

Answer

The use of internal logging

Answer

The use of JSON.parse()

Answer

The use of static typing

Question 19

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) ensures both the client and server verify each other's certificates, providing strong authentication.

Answer

HTTP Basic Auth

Answer

IP allow-listing

Answer

Shared API keys in headers

Question 20

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Accepted Answer

Using a Content Security Policy (CSP). Context-aware encoding and CSP are the most effective defenses against XSS.

Answer

Relying on antivirus software

Answer

Disabling cookies

Answer

Using insecure HTML comments