CSSLP Secure Software Testing — Timed 20 Questions

Question 1

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

Accepted Answer

The third-party DLL is not configured as a source project or included in the scan scope.. Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Answer

The vulnerability is a logic error that static analysis cannot find.

Answer

The .NET framework version is set incorrectly in the project settings.

Answer

The scan engine is set to 'Quick Scan' mode.

Answer

null

Question 2

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

Accepted Answer

Postman.. Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Answer

SQLmap.

Answer

null

Answer

Nmap.

Answer

Wireshark.

Question 3

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

Accepted Answer

The agent is not correctly configured to recognize the application's specific data access abstraction layer.. IAST agents instrument the runtime and observe actual data flows, so they must understand how the application accesses data. When the app uses an ORM, custom DAO, or stored procedures, the agent may not recognize the abstraction as a SQL sink and misclassifies safe parameterized calls as vulnerable, producing false positives. Tuning the agent's sink definitions and framework support resolves this.

Answer

null

Answer

The DAST scanner is conflicting with the IAST agent.

Answer

The source code repository is not accessible to the agent.

Answer

The build server lacks sufficient CPU cores for runtime instrumentation.

Question 4

When using Burp Suite Professional to perform DAST against a web application with a complex multi-step form, what is the most effective way to ensure the scanner completes the workflow?

Accepted Answer

Use the 'Macros' feature in Project Options to record and replay the sequence of authentication steps.. Burp Suite's Macros feature (Project Options > Sessions > Macros) allows you to record a sequence of HTTP requests that represent a multi-step workflow, such as a login or form submission process. When configured with Session Handling Rules, Burp can automatically replay these macros to maintain session state or complete prerequisite steps before scanning. This ensures the scanner can reach and test deeper parts of the application that require a specific sequence of actions, which would otherwise be missed. Thus, Macros are the most effective way to guarantee the scanner completes complex workflows.

Answer

Decrease the number of concurrent scan threads.

Answer

null

Answer

Enable 'Live Passive Crawling'.

Answer

Set the 'Scan Speed' to 'Thorough'.

Question 5

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

Accepted Answer

Mutation-based fuzzing.. Mutation-based fuzzing takes valid inputs and alters them, which is highly effective for finding edge cases in protocol parsers.

Answer

Unit testing with hardcoded values.

Answer

Static code analysis.

Answer

null

Answer

DAST scanning with default payloads.

Question 6

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

Accepted Answer

Session Management configuration in the Context settings.. ZAP's Session Management settings allow the user to define how the application tracks sessions, such as via specific cookies or headers.

Answer

The 'Forced User' mode in the site tree.

Answer

The 'Spider' tab's login configuration.

Answer

The 'Ajax Spider' timeout configuration.

Answer

null

Question 7

Which of the following is the primary purpose of a DAST scan in a DevSecOps environment?

Accepted Answer

Identify vulnerabilities in the running application from the outside in.. DAST (Dynamic Application Security Testing) tests a running application from the outside by exercising it as an attacker would, sending crafted requests and analyzing responses to identify vulnerabilities such as injection, authentication flaws, and misconfigurations. Its defining characteristic is black-box, runtime testing of the deployed application rather than inspecting source code.

Answer

Instrument code to monitor data flow at runtime.

Answer

null

Answer

Analyze source code for insecure coding patterns.

Answer

Perform unit testing on individual functions.

Question 8

A security engineer is analyzing a report from a SAST tool (e.g., Fortify). A finding is marked as 'Low Confidence'. What does this imply?

Accepted Answer

The finding is likely a false positive and requires manual validation.. Low confidence findings are often heuristics-based and carry a high probability of being false positives, requiring manual verification.

Answer

The vulnerability is not exploitable.

Answer

null

Answer

The vulnerability is critical but rare.

Answer

The tool failed to scan the file.

Question 9

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

Accepted Answer

Providing the 'Authentication' credentials in the 'Web Applications' section.. Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Answer

Disabling the 'Plugin' set for OS detection.

Answer

Enabling 'Safe Checks' in the policy settings.

Answer

Configuring the 'Port Scanner' to only scan port 80.

Answer

null

Question 10

You are integrating Snyk into a CI pipeline. The scan is failing the build even when no new vulnerabilities are introduced. What is the cause?

Accepted Answer

An expired 'ignore' policy in the .snyk file.. Snyk's 'policy' or '.snyk' file can be configured with 'ignore' rules that expire, or thresholds that trigger build breaks if policy is violated.

Answer

null

Answer

The Snyk token has expired.

Answer

The scan speed is set to 'High'.

Answer

The dependencies are already updated.

Question 11

A company is implementing a Secure SDLC. Which phase is the most appropriate to start defining security test cases?

Accepted Answer

Requirements and Design.. Security test cases should be derived during the Requirements and Design phases to ensure that security features are verified as they are built.

Answer

Testing.

Answer

Maintenance.

Answer

null

Answer

Implementation.

Question 12

You are auditing a SAST tool's findings for a Java application. The tool flags a potential XSS in a JSP file, but the output is encoded using a library. How should you classify this finding?

Accepted Answer

Mitigated / False Positive.. The finding should be classified as Mitigated / False Positive because the output is encoded using a library, which neutralizes the XSS vulnerability. SAST tools often flag potential XSS without context of output encoding, leading to false positives. Since the encoding is properly applied, the risk is mitigated, and the finding is not a confirmed vulnerability.

Answer

Informational.

Answer

null

Answer

Confirmed Vulnerability.

Answer

Critical.

Question 13

Which testing methodology provides the best visibility into the internal logic of an application while it is running?

Accepted Answer

IAST.. IAST (Interactive Application Security Testing) combines the benefits of SAST (visibility into code) and DAST (runtime analysis).

Answer

Penetration testing.

Answer

DAST.

Answer

SAST.

Answer

null

Question 14

When setting up a penetration testing lab for a web application, which THREE network configurations are recommended?

Accepted Answer

Enable full logging and monitoring on the testing infrastructure.. Security labs must be isolated to prevent accidental impact on production while maintaining necessary access for testing tools.

Answer

Configure the lab to use the main corporate production database.

Answer

Air-gap the testing network from the internet.

Question 15

A security team is planning to integrate static application security testing (SAST) into a CI/CD pipeline for a large C# codebase. The build process uses incremental compilation to reduce build times. The team wants SAST to run on every pull request without introducing excessive false negatives. Which approach best balances coverage and performance?

Accepted Answer

Run a full SAST scan on the entire codebase on every pull request, using a distributed build farm to parallelize.. A full SAST scan on the entire codebase ensures all interprocedural data flows are analyzed, which is essential for detecting vulnerabilities that cross file boundaries. Incremental or changed-file-only scans can miss such flows, leading to false negatives. Using a distributed build farm addresses performance concerns by parallelizing the scan, making full scans feasible on every pull request.

Answer

Configure the SAST tool to analyze only the compiled binaries rather than source code to improve speed.

Answer

Run SAST only on the files changed in the pull request and rely on the tool's incremental analysis.

Answer

Run SAST only during nightly builds and allow pull requests to merge if no critical findings are reported.

Question 16

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 17

A security engineer is configuring SonarQube for a Java project. Which configuration step ensures that the SAST scan accurately identifies injection vulnerabilities by analyzing data flow paths?

Accepted Answer

Enable the 'Security Hotspots' and 'Taint Analysis' rule categories in the active Quality Profile.. The analysis of data flow paths requires the enablement of security hotspots and taint analysis rules in the Quality Profile.

Answer

null

Answer

Set the analysis mode to 'Incremental' only.

Answer

Increase the heap memory allocation for the JVM running the scanner.

Answer

Configure the 'Exclude' patterns to include all library dependencies.

Question 18

During a manual penetration test, you discover an insecure direct object reference (IDOR). What is the most appropriate next step in the test case design for this finding?

Accepted Answer

Attempt to access resources associated with other users.. After discovering an IDOR, the appropriate next step in test-case design is to attempt to access resources belonging to other users (B) to confirm the vulnerability is exploitable and to determine its scope. This validates the finding, demonstrates real impact, and provides evidence for the report — all within authorized testing boundaries.

Answer

Delete the record to prove the IDOR is exploitable.

Answer

null

Answer

Report the finding immediately without further testing.

Answer

Run a full automated DAST scan against the entire application.

Question 19

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Accepted Answer

Injecting characters like single quotes (') and comments (--) into input fields.. Testing for SQL injection involves sending input that contains special characters (like quotes) to see if the database engine returns an error or executes the injected command.

Answer

null

Answer

Changing the user agent header to a random string.

Answer

Uploading a large file to test buffer overflow.

Answer

Adding a long string to an email field.

Question 20

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

Accepted Answer

Configure the fuzzer to inject a fresh, valid JWT in the Authorization header before each request.. The fuzzer must be configured to refresh the JWT periodically or use a script to inject a valid token into the Authorization header for every request.

Answer

null

Answer

Use the same JWT throughout the entire fuzzing duration.

Answer

Exclude the Authorization header from the fuzzing target.

Answer

Disable authentication for the entire API during the test.