CSSLP Secure Software Testing — 20 Questions

Question 1

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

Accepted Answer

The third-party DLL is not configured as a source project or included in the scan scope.. Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Answer

The vulnerability is a logic error that static analysis cannot find.

Answer

The .NET framework version is set incorrectly in the project settings.

Answer

The scan engine is set to 'Quick Scan' mode.

Answer

null

Question 2

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

Accepted Answer

Postman.. Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Answer

SQLmap.

Answer

null

Answer

Nmap.

Answer

Wireshark.

Question 3

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

Accepted Answer

The agent is not correctly configured to recognize the application's specific data access abstraction layer.. IAST instruments the runtime environment; if the code uses an abstraction layer or ORM that the IAST agent does not map to database sinks, it may misinterpret harmless data transformations as vulnerabilities.

Answer

null

Answer

The DAST scanner is conflicting with the IAST agent.

Answer

The source code repository is not accessible to the agent.

Answer

The build server lacks sufficient CPU cores for runtime instrumentation.

Question 4

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 5

When using Burp Suite Professional to perform DAST against a web application with a complex multi-step form, what is the most effective way to ensure the scanner completes the workflow?

Accepted Answer

Use the 'Macros' feature in Project Options to record and replay the sequence of authentication steps.. Burp Suite's Macro functionality allows the recorder to automate sessions and handle stateful transitions during scanning.

Answer

Decrease the number of concurrent scan threads.

Answer

null

Answer

Enable 'Live Passive Crawling'.

Answer

Set the 'Scan Speed' to 'Thorough'.

Question 6

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

Accepted Answer

Mutation-based fuzzing.. Mutation-based fuzzing takes valid inputs and alters them, which is highly effective for finding edge cases in protocol parsers.

Answer

Unit testing with hardcoded values.

Answer

Static code analysis.

Answer

null

Answer

DAST scanning with default payloads.

Question 7

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

Accepted Answer

Session Management configuration in the Context settings.. ZAP's Session Management settings allow the user to define how the application tracks sessions, such as via specific cookies or headers.

Answer

The 'Forced User' mode in the site tree.

Answer

The 'Spider' tab's login configuration.

Answer

The 'Ajax Spider' timeout configuration.

Answer

null

Question 8

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Accepted Answer

Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.. The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Answer

null

Answer

Set the analysis mode to 'Incremental' only.

Answer

Increase the heap memory allocation for the JVM running the scanner.

Answer

Configure the 'Exclude' patterns to include all library dependencies.

Question 9

Which of the following is the primary purpose of a DAST scan in a DevSecOps environment?

Accepted Answer

Identify vulnerabilities in the running application from the outside in.. DAST tests the application in its running state, identifying vulnerabilities that are exposed through the interface, unlike SAST which looks at source.

Answer

Instrument code to monitor data flow at runtime.

Answer

null

Answer

Analyze source code for insecure coding patterns.

Answer

Perform unit testing on individual functions.

Question 10

A security engineer is analyzing a report from a SAST tool (e.g., Fortify). A finding is marked as 'Low Confidence'. What does this imply?

Accepted Answer

The finding is likely a false positive and requires manual validation.. Low confidence findings are often heuristics-based and carry a high probability of being false positives, requiring manual verification.

Answer

The vulnerability is not exploitable.

Answer

null

Answer

The vulnerability is critical but rare.

Answer

The tool failed to scan the file.

Question 11

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

Accepted Answer

Attempt to access resources associated with other users.. Once IDOR is found, the tester should attempt to access resources belonging to different users to confirm the vulnerability's scope.

Answer

Delete the record to prove the IDOR is exploitable.

Answer

null

Answer

Report the finding immediately without further testing.

Answer

Run a full automated DAST scan against the entire application.

Question 12

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

Accepted Answer

Providing the 'Authentication' credentials in the 'Web Applications' section.. Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Answer

Disabling the 'Plugin' set for OS detection.

Answer

Enabling 'Safe Checks' in the policy settings.

Answer

Configuring the 'Port Scanner' to only scan port 80.

Answer

null

Question 13

You are integrating Snyk into a CI pipeline. The scan is failing the build even when no new vulnerabilities are introduced. What is the cause?

Accepted Answer

An expired 'ignore' policy in the .snyk file.. Snyk's 'policy' or '.snyk' file can be configured with 'ignore' rules that expire, or thresholds that trigger build breaks if policy is violated.

Answer

null

Answer

The Snyk token has expired.

Answer

The scan speed is set to 'High'.

Answer

The dependencies are already updated.

Question 14

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.

Question 15

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.

Question 16

When performing automated security testing, which of the following is considered a 'false positive'?

Accepted Answer

The scanner reports a vulnerability that is not present in the application.. A false positive is a report of a vulnerability that does not actually exist in the target application.

Answer

The scanner misses an existing vulnerability.

Answer

The scanner causes the application to crash.

Answer

The scanner reports a vulnerability that is already fixed.

Answer

null

Question 17

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

Accepted Answer

Extract and re-inject unique anti-CSRF tokens for each request.. CSRF tokens are unique per session; the scanner must be able to extract the token from the response and include it in the subsequent request.

Answer

Attempt to brute force the user's password.

Answer

null

Answer

Scan the client-side JavaScript code for vulnerabilities.

Answer

Bypass the need for authentication.

Question 18

A company is implementing a Secure SDLC. Which phase is the most appropriate to start defining security test cases?

Accepted Answer

Requirements and Design.. Security test cases should be derived during the Requirements and Design phases to ensure that security features are verified as they are built.

Answer

Testing.

Answer

Maintenance.

Answer

null

Answer

Implementation.

Question 19

You are auditing a SAST tool's findings for a Java application. The tool flags a potential XSS in a JSP file, but the output is encoded using a library. How should you classify this finding?

Accepted Answer

Mitigated / False Positive.. If the application uses proper context-aware encoding, the vulnerability is mitigated; the SAST tool likely flagged the use of a sink without verifying the preceding encoding.

Answer

Informational.

Answer

null

Answer

Confirmed Vulnerability.

Answer

Critical.

Question 20

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Accepted Answer

Immediate feedback on secure coding patterns.. SAST early in the SDLC reduces the cost of remediation and improves developer awareness of secure coding practices.

Answer

Reduced developer education.

Answer

Elimination of all false positives.

Answer

Automation of penetration testing.