CSSLP Secure Software Testing Practice Test 2 — 15 Questions

Question 1

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 2

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Accepted Answer

Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.. The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Answer

null

Answer

Set the analysis mode to 'Incremental' only.

Answer

Increase the heap memory allocation for the JVM running the scanner.

Answer

Configure the 'Exclude' patterns to include all library dependencies.

Question 3

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

Accepted Answer

Attempt to access resources associated with other users.. After discovering an IDOR, the appropriate next step in test-case design is to attempt to access resources belonging to other users (B) to confirm the vulnerability is exploitable and to determine its scope. This validates the finding, demonstrates real impact, and provides evidence for the report — all within authorized testing boundaries.

Answer

Delete the record to prove the IDOR is exploitable.

Answer

null

Answer

Report the finding immediately without further testing.

Answer

Run a full automated DAST scan against the entire application.

Question 4

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.

Question 5

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.

Question 6

When performing automated security testing, which of the following is considered a 'false positive'?

Accepted Answer

The scanner reports a vulnerability that is not present in the application.. A false positive is a report of a vulnerability that does not actually exist in the target application.

Answer

The scanner misses an existing vulnerability.

Answer

The scanner causes the application to crash.

Answer

The scanner reports a vulnerability that is already fixed.

Answer

null

Question 7

When configuring a DAST scanner to test for Cross-Site Request Forgery (CSRF), what must the scanner be able to do?

Accepted Answer

Extract and re-inject unique anti-CSRF tokens for each request.. CSRF tokens are unique per session; the scanner must be able to extract the token from the response and include it in the subsequent request.

Answer

Attempt to brute force the user's password.

Answer

null

Answer

Scan the client-side JavaScript code for vulnerabilities.

Answer

Bypass the need for authentication.

Question 8

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Accepted Answer

Immediate feedback on secure coding patterns.. Option B is correct because integrating SAST into early SDLC stages (e.g., IDE plugins or pre-commit hooks) gives developers immediate feedback on secure coding patterns while code is being written, enabling them to fix issues before they propagate. Option C is correct because SAST analyzes source code statically without executing it, allowing vulnerabilities such as SQL injection, XSS, or hardcoded credentials to be identified early in development when remediation is cheapest and least disruptive. Option A is incorrect because SAST does not reduce developer education; it typically requires security training so developers can interpret findings and apply secure coding practices. Option D is incorrect because SAST tools inherently produce false positives due to limitations in static analysis, and no tool eliminates all of them. Option E is incorrect because SAST is not penetration testing; pen testing involves dynamic exploitation of running applications, whereas SAST is a static code review technique and does not automate pen testing.

Answer

Reduced developer education.

Answer

Elimination of all false positives.

Answer

Automation of penetration testing.

Question 9

When designing a test case for secure API authentication, which THREE elements should be included?

Accepted Answer

Validating that error messages do not disclose account existence.. Option A is correct because secure API authentication must prevent username/account enumeration: error responses for invalid usernames and invalid passwords should be indistinguishable (same generic message and status code, e.g., 401 with a generic body), so validating that error messages do not disclose account existence is a core security test. Option B is correct because insecure token storage is a common authentication weakness: tests should verify that tokens (JWT, OAuth 2.0 access/refresh tokens, session IDs) are not stored in insecure locations such as localStorage, unencrypted files, or logs, and are protected in transit and at rest. Option C is correct because token lifecycle controls are essential: tests must confirm that tokens expire after their defined lifetime (e.g., JWT 'exp' claim), that refresh tokens can be revoked, and that revoked or expired tokens are rejected by the API. Option D is not a secure authentication test element; automating the password recovery workflow is a functional/process automation concern, not a security validation of authentication mechanisms. Option E is not a security test element; measuring API response speed is a performance test and does not validate authentication security properties.

Answer

Automating the password recovery workflow.

Answer

Testing the speed of the API response.

Question 10

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

Accepted Answer

Isolate the fuzzing environment from production data.. Option C is correct because fuzz testing deliberately sends malformed, unexpected, and potentially destructive inputs, so the fuzzing environment must be isolated from production data to prevent corruption, data leakage, or service disruption. Option E is correct because monitoring application logs for crash signals, exceptions, stack traces, and error codes is essential to detect the faults fuzzing is designed to uncover and to reproduce and triage them. Option A is wrong because disabling logging removes the very evidence needed to identify crashes and exceptions, undermining the purpose of fuzzing. Option B is wrong because manual input does not scale and defeats the automation that makes fuzzing effective at generating large volumes of varied test cases. Option D is wrong because using a production environment risks real data and availability, whereas fuzzing should run in an isolated, non-production environment.

Answer

Disable all logging to improve fuzzing speed.

Answer

Manually input all test cases.

Answer

Use a production environment for maximum realism.

Question 11

Which THREE factors should be considered when prioritizing findings from a DAST scan?

Accepted Answer

The ease of exploitability and availability of exploits.. Option C is correct because the ease of exploitability and the existence of public exploits (e.g., weaponized PoCs in Exploit-DB or Metasploit modules) directly raise the real-world risk of a DAST finding, making it a primary prioritization factor. Option D is correct because the sensitivity of the data handled by the vulnerable endpoint (e.g., PII, credentials, or PCI data) determines the potential business impact if the finding is exploited, which is essential for risk-based triage. Option E is correct because the CVSS base score provides a standardized, vendor-neutral severity metric (combining exploitability and impact sub-scores) that is widely used to rank DAST findings objectively. Option A does not belong because the time of day a scan ran has no bearing on the vulnerability's severity or exploitability. Option B does not belong because lines of code is a static code metric, not a DAST finding attribute, and does not indicate exploitability or impact.

Answer

The time of day the scan was performed.

Answer

The number of lines of code in the component.

Question 12

Which TWO of the following are common challenges when implementing IAST?

Accepted Answer

Inability to find vulnerabilities in unreachable code.. Option B is correct because IAST instruments the running application and observes execution paths, so code that is never reached during testing (unreachable or dormant code paths) cannot be exercised and therefore its vulnerabilities go undetected. Option E is correct because IAST agents hook into runtime execution and add instrumentation overhead, which can degrade application performance and throughput, making performance impact a well-known implementation challenge. Option A is not a defining IAST challenge since IAST relies on runtime instrumentation rather than requiring full source code access, unlike SAST. Option C is incorrect because IAST typically still produces false positives, so a 'lack of false positives' is not a challenge. Option D is incorrect because IAST agents are deployed on the application server or runtime environment, not on client machines.

Answer

Requirement for full source code access.

Answer

Lack of false positives.

Answer

Difficulty in installing agents on client machines.

Question 13

Which TWO of the following represent common output formats for security testing reports?

Accepted Answer

PDF.. Option B (PDF) is correct because PDF is a standard, widely used format for delivering polished security testing reports, preserving layout, tables, and charts for stakeholders and clients. Option E (JSON) is correct because JSON is a common machine-readable format used to export structured findings from scanners and testing tools, enabling automation, parsing, and integration with other systems. Option A (PNG) is an image format, suitable for screenshots or diagrams but not a typical full report output format. Option C (MP3) is an audio format and is irrelevant to security report deliverables. Option D (BIOS) is firmware, not a report format at all.

Answer

PNG.

Answer

MP3.

Answer

BIOS.

Question 14

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Accepted Answer

Testing the password recovery/reset workflow.. Option A is correct because the password recovery/reset workflow is a classic authentication bypass vector: testers must check for predictable or leaked reset tokens, token reuse, missing expiry, host-header injection in reset links, and whether the reset endpoint verifies the user's identity before allowing a password change. Option C is correct because manipulating session cookies (e.g., tampering with session IDs, forging JWTs, altering role/identity claims, or replaying stolen cookies) directly tests whether the application properly validates session state and can be tricked into granting authenticated access without valid credentials. Option E is correct because brute forcing account credentials tests authentication strength controls such as account lockout thresholds, rate limiting, CAPTCHA enforcement, and password complexity, all of which are core to assessing whether authentication can be bypassed through weak credential policies. Options B and D are incorrect because changing the CSS file or the application's color scheme are purely cosmetic presentation changes that have no bearing on authentication logic, session handling, or access control.

Answer

Changing the application's CSS file.

Answer

Testing the application's color scheme.

Question 15

A security analyst is reviewing the results of a dynamic application security testing (DAST) scan against a REST API. The scan report includes several findings, but the analyst must prioritize remediation. Which two factors are most important to consider when triaging DAST findings for an API? (Choose two.)

Accepted Answer

The potential impact on confidentiality, integrity, and availability of the API's data.. Triage of DAST findings should focus on risk, which is a function of impact and likelihood. The potential impact on confidentiality, integrity, and availability determines the consequences of exploitation, while ease of exploitation indicates likelihood. Together, these factors allow the analyst to prioritize vulnerabilities that pose the greatest threat to the API and its data.

Answer

The HTTP status code returned by the API endpoint when the vulnerability is triggered.

Answer

The number of times the vulnerability appears in the scan report.

Answer

The scanner's confidence level as reported in the tool's output.