CSSLP Secure Software Implementation — All Questions With Answers

Question 1

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Accepted Answer

Using AES-256 encryption. AES-256 is a symmetric block cipher approved by NIST (FIPS 197) and is the standard recommendation for encrypting data at rest in databases, offering strong confidentiality with acceptable performance. It is used in modes like GCM or CBC with proper key management (e.g., KMS, HSM) to protect sensitive fields, tablespaces, or full-disk volumes.

Answer

Using cleartext with database permissions

Answer

Using MD5 hashing

Answer

Storing data in base64 encoding

Question 2

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. In EJS, the <%= %> tag performs HTML entity escaping on the output, converting characters like <, >, &, and quotes into safe entities so injected markup cannot execute in the browser. This directly neutralizes the most common XSS vector — reflected or stored script tags in user-supplied data. Using escaped output is the canonical secure-coding practice for rendering untrusted content in EJS templates.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 3

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 4

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 5

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 6

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Accepted Answer

Buffer overflow. Buffer overflow is a memory safety vulnerability that arises from improper bounds checking on arrays or pointer arithmetic, leading to out-of-bounds writes. Static analysis tools like Fortify and Coverity use data flow analysis and taint tracking to identify such patterns by examining array indices, pointer dereferences, and memory copy operations. They can flag potential overflows without executing the code, making it a prime target for static analysis in C++ applications.

Answer

Database connection timeout

Answer

Business logic flaws

Answer

Zero-day authentication bypass

Question 7

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 8

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 9

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks. The 'state' parameter in OAuth2 is an opaque value generated by the client and returned unchanged by the authorization server in the redirect. The client verifies that the returned state matches the value it sent, which binds the authorization response to the user's session and prevents cross-site request forgery (CSRF) attacks where an attacker tricks a victim into submitting an attacker's authorization code.

Answer

To store the user's password

Answer

To track the user's location

Answer

To encrypt the access token

Question 10

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Accepted Answer

To provide a complete inventory of software components. An SBOM provides a machine-readable, complete inventory of all software components and their dependencies, which is essential for identifying and responding to vulnerabilities in third-party libraries. Without this inventory, an organization cannot know whether it is affected by a newly disclosed CVE in a transitive dependency. This transparency is the foundation of software supply chain risk management.

Answer

To encrypt source code

Answer

To speed up build times

Answer

To replace the need for unit testing

Question 11

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

Accepted Answer

SQL Injection. Parameterized queries (prepared statements) separate SQL code from data by sending the query structure to the database first and binding user input as parameters, so input is never interpreted as SQL syntax. This structurally prevents SQL injection, the top web vulnerability class, regardless of what characters the attacker supplies.

Answer

Session Hijacking

Answer

Insecure Deserialization

Answer

Directory Traversal

Question 12

What is the primary security benefit of using a hardened container base image for microservices?

Accepted Answer

It reduces the attack surface. A hardened container base image removes unnecessary packages, services, shells, and default credentials, reducing the number of potential vulnerabilities and entry points an attacker can exploit. This directly shrinks the attack surface, which is the primary security benefit. Hardening does not inherently improve speed, encrypt logs, or remove the need for patching.

Answer

It increases execution speed

Answer

It automatically encrypts application logs

Answer

It eliminates the need for patching

Question 13

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Accepted Answer

Use a secret management service. A dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores secrets encrypted, controls access via identity and policy, supports rotation and auditing, and keeps secrets out of source code entirely. This is the correct control because it addresses the root cause — secrets embedded in code — rather than masking the symptom. It also enables centralized revocation and rotation when a key is compromised.

Answer

Store it in a public environment variable

Answer

Add it to the .gitignore file

Answer

Obfuscate the key in the code

Question 14

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 15

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows

Question 16

Which standard security practice should be applied to all passwords stored in a database?

Accepted Answer

Hashing with a unique salt per user. The correct practice is to hash passwords with a unique salt per user. Hashing is a one-way function that transforms the password into a fixed-length digest, making it infeasible to reverse. A unique salt per user prevents attackers from using precomputed rainbow tables and ensures that identical passwords produce different hashes. This is a fundamental requirement in standards like NIST SP 800-63B and OWASP ASVS.

Answer

Encryption with a symmetric key

Answer

Storing in a configuration file

Answer

Base64 encoding

Question 17

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

Accepted Answer

Security requirements definition. Security requirements definition (C) is essential because the SSDLC must capture security and privacy requirements alongside functional requirements early in the lifecycle, so that controls such as authentication, encryption, and compliance obligations are designed in rather than bolted on later. Threat modeling (D) is essential because it systematically identifies potential threats, attack surfaces, and mitigations (e.g., using STRIDE or DREAD) during design, allowing architects to address risks before code is written. The other options do not belong: hardware procurement (A) is an infrastructure/logistics activity rather than a software security practice, marketing strategies (B) concern business promotion and are unrelated to secure development, and an unlimited project budget (E) is neither a security control nor a realistic or necessary SSDLC component.

Answer

Hardware procurement

Answer

Marketing strategies

Answer

Unlimited project budget

Question 18

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Accepted Answer

The use of native object serialization. Native object serialization features (e.g., Java's ObjectInputStream, PHP's unserialize(), Python's pickle, .NET's BinaryFormatter) reconstruct objects from attacker-controlled byte streams, and if the classpath contains gadget chains, this leads directly to remote code execution. JSON.parse() only produces plain data structures (objects, arrays, primitives) with no code execution or object instantiation semantics, so it is not the classic source of insecure deserialization. The vulnerability arises because deserialization trusts the serialized data to define object state and type, which the attacker fully controls.

Answer

The use of internal logging

Answer

The use of JSON.parse()

Answer

The use of static typing

Question 19

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) is the recommended mechanism for gRPC service-to-service authentication because gRPC is built on HTTP/2 over TLS, and mTLS provides bidirectional certificate-based authentication of both client and server. Each service presents a certificate, so the caller verifies the callee's identity and vice versa, and the channel is encrypted end-to-end. This aligns with zero-trust principles and is natively supported by gRPC's channel credentials without application-layer token handling.

Answer

HTTP Basic Auth

Answer

IP allow-listing

Answer

Shared API keys in headers

Question 20

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Accepted Answer

Using a Content Security Policy (CSP). Option D, using a Content Security Policy (CSP), is correct because CSP is an HTTP response header (e.g., Content-Security-Policy: default-src 'self') that restricts which sources of scripts, styles, and other resources the browser may load, thereby blocking inline script execution and mitigating reflected and stored XSS even if an injection occurs. Option E, context-aware output encoding, is correct because encoding untrusted data according to its output context (HTML entity encoding for HTML body, JavaScript escaping for script blocks, attribute encoding for HTML attributes, URL encoding for URLs) ensures injected characters are rendered as inert text rather than executable markup or script, which is the primary defense against XSS. Option A, relying on antivirus software, is not appropriate because antivirus operates on the client endpoint and cannot reliably detect or block browser-executed script injections delivered through web applications. Option B, disabling cookies, does not prevent XSS; it only removes one target of session theft and may break application functionality, while the injected script still executes in the victim's browser. Option C, using insecure HTML comments, is not a security control at all and can even worsen exposure by leaving sensitive data or code in page source.

Answer

Relying on antivirus software

Answer

Disabling cookies

Answer

Using insecure HTML comments

CSSLP Secure Software Implementation — All Questions With Answers

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

In an OAuth2 flow, what is the purpose of the 'state' parameter?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

What is the primary security benefit of using a hardened container base image for microservices?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Which standard security practice should be applied to all passwords stored in a database?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

Which THREE of the following practices contribute to secure configuration of a web server?

Which THREE of the following are best practices for the secure use of third-party libraries?

Which TWO of the following are required to successfully implement a secure logging mechanism?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Which TWO of the following are crucial when performing a manual code review for security?

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?

CSSLP Secure Software Implementation — All Questions With Answers

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

In an OAuth2 flow, what is the purpose of the 'state' parameter?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

What is the primary security benefit of using a hardened container base image for microservices?

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Which standard security practice should be applied to all passwords stored in a database?

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

Which THREE of the following practices contribute to secure configuration of a web server?

Which THREE of the following are best practices for the secure use of third-party libraries?

Which TWO of the following are required to successfully implement a secure logging mechanism?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Which TWO of the following are crucial when performing a manual code review for security?

A development team is implementing input validation for a web application. They want to ensure that all user-supplied data is properly sanitized to prevent injection attacks. Which TWO of the following are effective techniques for input validation? (Choose two.)

A developer is writing code that handles sensitive cryptographic keys. The keys must be protected from unauthorized access. Which practice is most appropriate for securing cryptographic keys in the application?