CSSLP Secure Software Testing — 10 Questions

Question 1

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

Accepted Answer

The third-party DLL is not configured as a source project or included in the scan scope.. Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Answer

The vulnerability is a logic error that static analysis cannot find.

Answer

The .NET framework version is set incorrectly in the project settings.

Answer

The scan engine is set to 'Quick Scan' mode.

Answer

null

Question 2

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

Accepted Answer

Postman.. Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Answer

SQLmap.

Answer

null

Answer

Nmap.

Answer

Wireshark.

Question 3

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

Accepted Answer

The agent is not correctly configured to recognize the application's specific data access abstraction layer.. IAST instruments the runtime environment; if the code uses an abstraction layer or ORM that the IAST agent does not map to database sinks, it may misinterpret harmless data transformations as vulnerabilities.

Answer

null

Answer

The DAST scanner is conflicting with the IAST agent.

Answer

The source code repository is not accessible to the agent.

Answer

The build server lacks sufficient CPU cores for runtime instrumentation.

Question 4

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 5

When using Burp Suite Professional to perform DAST against a web application with a complex multi-step form, what is the most effective way to ensure the scanner completes the workflow?

Accepted Answer

Use the 'Macros' feature in Project Options to record and replay the sequence of authentication steps.. Burp Suite's Macro functionality allows the recorder to automate sessions and handle stateful transitions during scanning.

Answer

Decrease the number of concurrent scan threads.

Answer

null

Answer

Enable 'Live Passive Crawling'.

Answer

Set the 'Scan Speed' to 'Thorough'.

Question 6

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

Accepted Answer

Mutation-based fuzzing.. Mutation-based fuzzing takes valid inputs and alters them, which is highly effective for finding edge cases in protocol parsers.

Answer

Unit testing with hardcoded values.

Answer

Static code analysis.

Answer

null

Answer

DAST scanning with default payloads.

Question 7

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

Accepted Answer

Session Management configuration in the Context settings.. ZAP's Session Management settings allow the user to define how the application tracks sessions, such as via specific cookies or headers.

Answer

The 'Forced User' mode in the site tree.

Answer

The 'Spider' tab's login configuration.

Answer

The 'Ajax Spider' timeout configuration.

Answer

null

Question 8

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Accepted Answer

Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.. The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Answer

null

Answer

Set the analysis mode to 'Incremental' only.

Answer

Increase the heap memory allocation for the JVM running the scanner.

Answer

Configure the 'Exclude' patterns to include all library dependencies.

Question 9

Which of the following is the primary purpose of a DAST scan in a DevSecOps environment?

Accepted Answer

Identify vulnerabilities in the running application from the outside in.. DAST tests the application in its running state, identifying vulnerabilities that are exposed through the interface, unlike SAST which looks at source.

Answer

Instrument code to monitor data flow at runtime.

Answer

null

Answer

Analyze source code for insecure coding patterns.

Answer

Perform unit testing on individual functions.

Question 10

A security engineer is analyzing a report from a SAST tool (e.g., Fortify). A finding is marked as 'Low Confidence'. What does this imply?

Accepted Answer

The finding is likely a false positive and requires manual validation.. Low confidence findings are often heuristics-based and carry a high probability of being false positives, requiring manual verification.

Answer

The vulnerability is not exploitable.

Answer

null

Answer

The vulnerability is critical but rare.

Answer

The tool failed to scan the file.