CSSLP Secure Software Implementation Practice Test 1 — 15 Questions

Question 1

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

Accepted Answer

Using AES-256 encryption. AES-256 is a symmetric block cipher approved by NIST (FIPS 197) and is the standard recommendation for encrypting data at rest in databases, offering strong confidentiality with acceptable performance. It is used in modes like GCM or CBC with proper key management (e.g., KMS, HSM) to protect sensitive fields, tablespaces, or full-disk volumes.

Answer

Using cleartext with database permissions

Answer

Using MD5 hashing

Answer

Storing data in base64 encoding

Question 2

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Accepted Answer

Using <%= %> tags for user data. In EJS, the <%= %> tag performs HTML entity escaping on the output, converting characters like <, >, &, and quotes into safe entities so injected markup cannot execute in the browser. This directly neutralizes the most common XSS vector — reflected or stored script tags in user-supplied data. Using escaped output is the canonical secure-coding practice for rendering untrusted content in EJS templates.

Answer

Using <%- %> tags for all variables

Answer

Disabling the template engine

Answer

Implementing a global regex filter

Question 3

In a Java Spring Boot application, which configuration prevents Cross-Site Request Forgery (CSRF) for state-changing HTTP requests?

Accepted Answer

Configure the HttpSecurity object to require CSRF tokens. In Spring Security, CSRF protection is enabled by default and is configured through the HttpSecurity object; explicitly requiring CSRF tokens (via csrf() configuration with a CsrfTokenRepository) ensures state-changing requests (POST/PUT/DELETE) must present a valid token tied to the user's session. This prevents an attacker's forged cross-site request from succeeding because the attacker cannot read the victim's token.

Answer

Set the Content-Type header to application/json

Answer

Use a stateless session strategy with no tokens

Answer

Enable csrf().disable() in the SecurityFilterChain

Question 4

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

Accepted Answer

Use Data Transfer Objects (DTOs) to restrict input. Mass assignment occurs when an attacker submits extra fields (e.g., isAdmin=true) that the framework blindly binds to the model. Using Data Transfer Objects (DTOs) restricts binding to only the fields the API intends to accept, so unexpected properties are ignored. This enforces an explicit allow-list at the model-binding layer, which is the recommended defense in frameworks like Spring, Rails, and ASP.NET.

Answer

Disable SSL on the API endpoint

Answer

Increase the request timeout

Answer

Store user passwords in plaintext

Question 5

A developer is using OWASP Dependency-Check to scan a Java application. Which configuration parameter should be utilized to ignore specific false-positive vulnerabilities identified in a third-party library?

Accepted Answer

--suppression. OWASP Dependency-Check supports a suppression mechanism via XML suppression files that tell the scanner to ignore specific false-positive CVEs for identified dependencies. The --suppression <file> parameter points the tool at that XML file, allowing teams to document and exclude known false positives without disabling scanning entirely. This preserves coverage while reducing noise in CI/CD pipelines.

Answer

--ignore-cve

Answer

--exclude-all

Answer

--skip-analysis

Question 6

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Accepted Answer

Buffer overflow. Buffer overflow is a memory safety vulnerability that arises from improper bounds checking on arrays or pointer arithmetic, leading to out-of-bounds writes. Static analysis tools like Fortify and Coverity use data flow analysis and taint tracking to identify such patterns by examining array indices, pointer dereferences, and memory copy operations. They can flag potential overflows without executing the code, making it a prime target for static analysis in C++ applications.

Answer

Database connection timeout

Answer

Business logic flaws

Answer

Zero-day authentication bypass

Question 7

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 8

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

Accepted Answer

Taint analysis. Data flow analysis (or taint analysis) is required to track whether sensitive data reaches an insecure sink like a log file.

Answer

Syntax checking

Answer

Unit testing

Answer

Dead code detection

Question 9

In an OAuth2 flow, what is the purpose of the 'state' parameter?

Accepted Answer

To prevent CSRF attacks. The 'state' parameter in OAuth2 is an opaque value generated by the client and returned unchanged by the authorization server in the redirect. The client verifies that the returned state matches the value it sent, which binds the authorization response to the user's session and prevents cross-site request forgery (CSRF) attacks where an attacker tricks a victim into submitting an attacker's authorization code.

Answer

To store the user's password

Answer

To track the user's location

Answer

To encrypt the access token

Question 10

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

Accepted Answer

To provide a complete inventory of software components. An SBOM provides a machine-readable, complete inventory of all software components and their dependencies, which is essential for identifying and responding to vulnerabilities in third-party libraries. Without this inventory, an organization cannot know whether it is affected by a newly disclosed CVE in a transitive dependency. This transparency is the foundation of software supply chain risk management.

Answer

To encrypt source code

Answer

To speed up build times

Answer

To replace the need for unit testing

Question 11

A developer is using parameterized queries in C#. Which vulnerability is primarily prevented by this implementation?

Accepted Answer

SQL Injection. Parameterized queries (prepared statements) separate SQL code from data by sending the query structure to the database first and binding user input as parameters, so input is never interpreted as SQL syntax. This structurally prevents SQL injection, the top web vulnerability class, regardless of what characters the attacker supplies.

Answer

Session Hijacking

Answer

Insecure Deserialization

Answer

Directory Traversal

Question 12

What is the primary security benefit of using a hardened container base image for microservices?

Accepted Answer

It reduces the attack surface. A hardened container base image removes unnecessary packages, services, shells, and default credentials, reducing the number of potential vulnerabilities and entry points an attacker can exploit. This directly shrinks the attack surface, which is the primary security benefit. Hardening does not inherently improve speed, encrypt logs, or remove the need for patching.

Answer

It increases execution speed

Answer

It automatically encrypts application logs

Answer

It eliminates the need for patching

Question 13

You are reviewing code and find a hardcoded API key. Which security control should be implemented to securely manage this secret?

Accepted Answer

Use a secret management service. A dedicated secret management service (e.g., HashiCorp Vault, AWS Secrets Manager, Azure Key Vault) stores secrets encrypted, controls access via identity and policy, supports rotation and auditing, and keeps secrets out of source code entirely. This is the correct control because it addresses the root cause — secrets embedded in code — rather than masking the symptom. It also enables centralized revocation and rotation when a key is compromised.

Answer

Store it in a public environment variable

Answer

Add it to the .gitignore file

Answer

Obfuscate the key in the code

Question 14

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

Accepted Answer

Storing files outside the web root and renaming them. Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Answer

Checking the file size

Answer

Validating the file extension only

Answer

Enabling execution permissions on the upload folder

Question 15

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

Accepted Answer

SQL Injection through unsafe raw queries. Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Answer

Cross-Site Scripting

Answer

Brute force attacks

Answer

Buffer overflows