CSSLP Secure Software Implementation Practice Test 2 — 15 Questions

Question 1

Which standard security practice should be applied to all passwords stored in a database?

Accepted Answer

Hashing with a unique salt per user. The correct practice is to hash passwords with a unique salt per user. Hashing is a one-way function that transforms the password into a fixed-length digest, making it infeasible to reverse. A unique salt per user prevents attackers from using precomputed rainbow tables and ensures that identical passwords produce different hashes. This is a fundamental requirement in standards like NIST SP 800-63B and OWASP ASVS.

Answer

Encryption with a symmetric key

Answer

Storing in a configuration file

Answer

Base64 encoding

Question 2

Which TWO of the following are essential components of a Secure Software Development Lifecycle (SSDLC)?

Accepted Answer

Security requirements definition. Security requirements definition (C) is essential because the SSDLC must capture security and privacy requirements alongside functional requirements early in the lifecycle, so that controls such as authentication, encryption, and compliance obligations are designed in rather than bolted on later. Threat modeling (D) is essential because it systematically identifies potential threats, attack surfaces, and mitigations (e.g., using STRIDE or DREAD) during design, allowing architects to address risks before code is written. The other options do not belong: hardware procurement (A) is an infrastructure/logistics activity rather than a software security practice, marketing strategies (B) concern business promotion and are unrelated to secure development, and an unlimited project budget (E) is neither a security control nor a realistic or necessary SSDLC component.

Answer

Hardware procurement

Answer

Marketing strategies

Answer

Unlimited project budget

Question 3

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Accepted Answer

The use of native object serialization. Native object serialization features (e.g., Java's ObjectInputStream, PHP's unserialize(), Python's pickle, .NET's BinaryFormatter) reconstruct objects from attacker-controlled byte streams, and if the classpath contains gadget chains, this leads directly to remote code execution. JSON.parse() only produces plain data structures (objects, arrays, primitives) with no code execution or object instantiation semantics, so it is not the classic source of insecure deserialization. The vulnerability arises because deserialization trusts the serialized data to define object state and type, which the attacker fully controls.

Answer

The use of internal logging

Answer

The use of JSON.parse()

Answer

The use of static typing

Question 4

When developing a microservice using gRPC, which mechanism is recommended for authenticating service-to-service communication?

Accepted Answer

Mutual TLS (mTLS). Mutual TLS (mTLS) is the recommended mechanism for gRPC service-to-service authentication because gRPC is built on HTTP/2 over TLS, and mTLS provides bidirectional certificate-based authentication of both client and server. Each service presents a certificate, so the caller verifies the callee's identity and vice versa, and the channel is encrypted end-to-end. This aligns with zero-trust principles and is natively supported by gRPC's channel credentials without application-layer token handling.

Answer

HTTP Basic Auth

Answer

IP allow-listing

Answer

Shared API keys in headers

Question 5

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Accepted Answer

Using a Content Security Policy (CSP). Option D, using a Content Security Policy (CSP), is correct because CSP is an HTTP response header (e.g., Content-Security-Policy: default-src 'self') that restricts which sources of scripts, styles, and other resources the browser may load, thereby blocking inline script execution and mitigating reflected and stored XSS even if an injection occurs. Option E, context-aware output encoding, is correct because encoding untrusted data according to its output context (HTML entity encoding for HTML body, JavaScript escaping for script blocks, attribute encoding for HTML attributes, URL encoding for URLs) ensures injected characters are rendered as inert text rather than executable markup or script, which is the primary defense against XSS. Option A, relying on antivirus software, is not appropriate because antivirus operates on the client endpoint and cannot reliably detect or block browser-executed script injections delivered through web applications. Option B, disabling cookies, does not prevent XSS; it only removes one target of session theft and may break application functionality, while the injected script still executes in the victim's browser. Option C, using insecure HTML comments, is not a security control at all and can even worsen exposure by leaving sensitive data or code in page source.

Answer

Relying on antivirus software

Answer

Disabling cookies

Answer

Using insecure HTML comments

Question 6

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

Accepted Answer

Using parameterized queries. Option B (parameterized queries) is correct because parameterized queries (prepared statements) separate SQL code from user-supplied data, so the database engine treats input strictly as data rather than executable SQL, which neutralizes injection payloads. Option D (applying the principle of least privilege to the database user) is correct because limiting the application's database account to only the permissions it truly needs (e.g., no DROP, no xp_cmdshell, no unnecessary table access) reduces the blast radius if an injection flaw is ever exploited. Option E (strict input validation based on allow-lists) is correct because allow-list validation rejects any input that does not match an expected, tightly defined pattern, preventing malicious characters or payloads from ever reaching the SQL layer. Option A is not correct because stored procedures that internally build dynamic SQL strings via concatenation remain vulnerable to injection; stored procedures are only safe when they themselves use parameterization. Option C is not correct because client-side validation can be trivially bypassed by an attacker using a proxy or direct HTTP requests, so it must never be the sole defense against SQL injection.

Answer

Using stored procedures with dynamic SQL

Answer

Relying solely on client-side validation

Question 7

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

Accepted Answer

Pin dependencies to specific versions and verify hashes. Pinning dependencies to specific versions and verifying hashes ensures that the exact, known-good version of a library is used in every build, preventing unexpected updates that could introduce vulnerabilities or break functionality. Hash verification (e.g., via SHA-256 checksums) confirms the integrity of the downloaded package, guarding against tampering or supply chain attacks. This approach aligns with CSSLP principles of secure build processes and supply chain risk management.

Answer

Trust all repositories by default

Answer

Download libraries from the developer's website

Answer

Always use the 'latest' version

Question 8

During a peer code review, you find a function that constructs an OS command using user input. What is the most secure way to handle this?

Accepted Answer

Use built-in language APIs instead of shell commands. The most secure way to handle user input that would otherwise be used to construct an OS command is to avoid shell invocation entirely and use built-in language APIs that perform the desired operation (e.g., file I/O, process spawning with argument arrays). This eliminates the shell interpreter and the possibility of command injection, because user input is passed as data, not parsed as shell syntax. Sanitization and escaping are fallback mitigations that are error-prone and shell-specific.

Answer

Run the command as a root user

Answer

Sanitize the input with a blacklist

Answer

Escape the input with shell-specific characters

Question 9

Which THREE of the following practices contribute to secure configuration of a web server?

Accepted Answer

Remove default files and pages. Option A is correct because removing default files and pages (e.g., Apache's /var/www/html/index.html, IIS's iisstart.htm, or sample scripts like phpinfo.php) eliminates well-known entry points and information-disclosure vectors that attackers routinely probe. Option D is correct because disabling directory listing (Apache's Options -Indexes or nginx's autoindex off) prevents the server from exposing file and folder names that could reveal sensitive resources or aid reconnaissance. Option E is correct because enforcing HTTPS with TLS (e.g., via HSTS and redirecting port 80 to 443) protects credentials and session data from interception and man-in-the-middle attacks, which is a core secure-configuration requirement. Option B is wrong because allowing all HTTP methods such as TRACE and OPTIONS enables cross-site tracing and method enumeration; these should be restricted to only those required (typically GET, POST, HEAD). Option C is wrong because verbose error reporting leaks stack traces, file paths, and server versions that assist attackers; production servers should return generic error messages and log details server-side instead.

Answer

Allow all HTTP methods (TRACE, OPTIONS)

Answer

Enable verbose error reporting

Question 10

Which THREE of the following are best practices for the secure use of third-party libraries?

Accepted Answer

Monitor for vulnerability disclosures. Option B is correct because continuously monitoring for vulnerability disclosures (e.g., via CVE feeds, NVD, or dependency-scanning tools like OWASP Dependency-Check or Snyk) lets teams learn about and remediate known flaws in third-party libraries before attackers exploit them. Option C is correct because performing security audits on third-party code — reviewing the library's source, license, and security posture (e.g., static analysis, SBOM review) — verifies that the dependency does not introduce vulnerabilities or malicious code into the application. Option E is correct because pinning library versions (e.g., exact versions in package.json, requirements.txt, or lock files) prevents unexpected changes or supply-chain attacks from silently pulling in a compromised or incompatible newer release. Option A is not a best practice because automatically updating to the latest version without testing can introduce breaking changes or newly disclosed vulnerabilities and bypasses change control. Option D is not a best practice because storing third-party code in the public root folder exposes it to direct web access, potentially leaking source code or enabling exploitation of unauthenticated endpoints.

Answer

Automatically update to the latest version without testing

Answer

Store all third-party code in the public root folder

Question 11

Which TWO of the following are required to successfully implement a secure logging mechanism?

Accepted Answer

Filter sensitive data before logging. Option C is correct because filtering sensitive data (e.g., passwords, PII, tokens, credit-card numbers) before it is written to logs prevents confidential information from being exposed in log files, which is a core requirement of a secure logging mechanism and aligns with standards like PCI DSS and GDPR. Option D is correct because storing logs in a tamper-evident system (e.g., append-only storage, write-once buckets, cryptographic hashing/chaining, or a SIEM with integrity controls) ensures that attackers cannot alter or delete records to hide their activity, preserving the logs' evidentiary value for auditing and incident response. Option A is not required and would generate excessive noise and storage costs while providing little security value. Option B is wrong because sending logs to a publicly accessible bucket exposes potentially sensitive data to unauthorized parties. Option E is wrong because disabling logging removes the very visibility needed for detection, investigation, and compliance.

Answer

Log every single user mouse movement

Answer

Send logs to a publicly accessible bucket

Answer

Disable all logging to improve performance

Question 12

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

Accepted Answer

Implement robust authentication. Option A (Implement robust authentication) is correct because requiring strong, verified identity via mechanisms such as OAuth 2.0, API keys, or mTLS prevents unauthenticated or spoofed clients from reaching API endpoints, directly shrinking the set of reachable, exploitable entry points. Option C (Implement rate limiting) is correct because throttling requests per client/IP (e.g., HTTP 429 responses, token buckets) reduces the exposure window for brute-force, credential-stuffing, and abuse-based attacks, which is a core attack-surface reduction technique. Option E (Disable unused HTTP methods) is correct because turning off methods like PUT, DELETE, TRACE, or OPTIONS that the API does not need removes unnecessary verbs and handlers that attackers could otherwise probe or exploit. Option B (Use cleartext headers for all communication) is not correct because transmitting headers in cleartext exposes credentials and tokens to interception, increasing rather than minimizing the attack surface. Option D (Expose full internal database schemas) is not correct because revealing internal schema details gives attackers structural intelligence that aids injection and enumeration attacks, which expands the attack surface instead of reducing it.

Answer

Use cleartext headers for all communication

Answer

Expose full internal database schemas

Question 13

Which TWO of the following are crucial when performing a manual code review for security?

Accepted Answer

Identifying data flow sources and sinks. Option A is correct because identifying data flow sources and sinks is essential in manual security code review: you trace where untrusted input enters (sources such as HTTP parameters, headers, or file uploads) and where it reaches sensitive operations (sinks such as SQL queries, OS commands, or HTML output), which is how you spot injection, XSS, and similar flaws. Option D is correct because verifying that authorization checks are enforced ensures each sensitive function or resource access validates the caller's permissions server-side, preventing broken access control (e.g., IDOR or privilege escalation) that automated tools often miss. Option B is not appropriate because UI design elements are cosmetic and unrelated to security vulnerabilities. Option C is not appropriate because rewriting the entire application is a remediation/development activity, not part of reviewing code for security. Option E is not appropriate because code indentation consistency is a style concern with no direct security impact.

Answer

Focusing only on UI design elements

Answer

Rewriting the entire application

Answer

Checking code indentation consistency

Question 14

A security architect is reviewing the design of a new web application. The application must ensure that session identifiers are unpredictable and resistant to guessing attacks. The development team proposes using a random number generator. Which approach should the architect recommend to meet this requirement?

Accepted Answer

Use a cryptographically secure pseudo-random number generator (CSPRNG) seeded with a high-entropy source, such as the operating system's entropy pool.. Session identifiers must be generated using a cryptographically secure pseudo-random number generator (CSPRNG) seeded with high entropy to ensure unpredictability. This prevents attackers from guessing or predicting valid session IDs. Other methods, such as standard random generators or predictable data hashing, lack the necessary security properties and can lead to session hijacking.

Answer

Use a sequential counter combined with a secret salt, and store the counter in a client-side cookie.

Answer

Generate session identifiers by hashing the current timestamp and the user's IP address using MD5.

Answer

Use the language's standard random number generator, such as java.util.Random or rand() in C, because it is fast and sufficient for generating session IDs.

Question 15

A developer is implementing a file upload feature in a web application. The application must allow users to upload images but prevent the execution of malicious scripts. The developer decides to validate the file extension and MIME type. Which additional security control is most effective to prevent stored cross-site scripting (XSS) via uploaded files?

Accepted Answer

Store uploaded files outside the web root and serve them through a handler that sets the Content-Disposition header to attachment and a safe Content-Type.. The most effective control is to store uploaded files outside the web root and serve them with headers that prevent inline rendering. This ensures that even if a malicious file is uploaded, it cannot be executed in the browser as part of the application's origin. Extension and MIME type validation alone can be bypassed, so additional measures like safe storage and serving are critical.

Answer

Rename all uploaded files to a random string with a .png extension and store them in a directory within the web root.

Answer

Scan all uploaded files with an antivirus engine and reject any that contain suspicious patterns.

Answer

Use a client-side JavaScript validation to check the file's magic bytes before upload.