CSSLP Timed Practice Test 2 — 10 Questions

Question 1

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Accepted Answer

Analyzing the implementation of HttpOnly and Secure flags on session cookies.. Session management is best reviewed by analyzing the cookie attributes and token handling flows.

Answer

Checking for SQL injection in login forms.

Answer

Reviewing the database schema for password hashing algorithms.

Answer

Verifying the presence of a Web Application Firewall (WAF).

Question 2

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 3

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Accepted Answer

Testing the password recovery/reset workflow.. Option A is correct because the password recovery/reset workflow is a classic authentication bypass vector: testers must check for predictable or leaked reset tokens, token reuse, missing expiry, host-header injection in reset links, and whether the reset endpoint verifies the user's identity before allowing a password change. Option C is correct because manipulating session cookies (e.g., tampering with session IDs, forging JWTs, altering role/identity claims, or replaying stolen cookies) directly tests whether the application properly validates session state and can be tricked into granting authenticated access without valid credentials. Option E is correct because brute forcing account credentials tests authentication strength controls such as account lockout thresholds, rate limiting, CAPTCHA enforcement, and password complexity, all of which are core to assessing whether authentication can be bypassed through weak credential policies. Options B and D are incorrect because changing the CSS file or the application's color scheme are purely cosmetic presentation changes that have no bearing on authentication logic, session handling, or access control.

Answer

Changing the application's CSS file.

Answer

Testing the application's color scheme.

Question 4

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

Accepted Answer

Enforcing mutual TLS (mTLS) for authentication.. Option A is correct because enforcing mutual TLS (mTLS) authenticates both the client and the server at the transport layer, adding a strong cryptographic identity check that complements higher-layer controls in a defense-in-depth strategy. Option B is correct because rate limiting at the API gateway mitigates abuse, brute-force attempts, and denial-of-service by throttling excessive requests, providing an independent protective layer even if other controls fail. Option E is correct because input validation for all parameters prevents injection attacks (such as SQLi and XSS) and malformed data from reaching backend logic, forming a critical application-layer defense. Option C is not appropriate because hardcoding API keys in source code exposes secrets to anyone with repository access and prevents rotation, weakening security rather than adding a layer. Option D is not appropriate because relying solely on a WAF creates a single point of failure and ignores other layers like authentication, input validation, and rate limiting that defense in depth requires.

Answer

Hardcoding API keys in the code for efficiency.

Answer

Relying solely on the WAF for security.

Question 5

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Accepted Answer

Repudiation.. Digital signatures provide non-repudiation because the signer's private key uniquely binds them to the message, so they cannot later deny having signed it, which directly mitigates Repudiation (A). Digital signatures also detect any modification of the signed data through cryptographic hash verification, so any alteration invalidates the signature and mitigates Tampering (E). Elevation of Privilege (B) is mitigated by authorization controls and least-privilege design, not by signatures. Information Disclosure (C) is addressed by encryption such as TLS or AES, not by signing. Denial of Service (D) is mitigated by availability controls like rate limiting and redundancy, which signatures do not provide.

Answer

Elevation of Privilege.

Answer

Information Disclosure.

Answer

Denial of Service.

Question 6

When designing a test case for secure API authentication, which THREE elements should be included?

Accepted Answer

Validating that error messages do not disclose account existence.. Option A is correct because secure API authentication must prevent username/account enumeration: error responses for invalid usernames and invalid passwords should be indistinguishable (same generic message and status code, e.g., 401 with a generic body), so validating that error messages do not disclose account existence is a core security test. Option B is correct because insecure token storage is a common authentication weakness: tests should verify that tokens (JWT, OAuth 2.0 access/refresh tokens, session IDs) are not stored in insecure locations such as localStorage, unencrypted files, or logs, and are protected in transit and at rest. Option C is correct because token lifecycle controls are essential: tests must confirm that tokens expire after their defined lifetime (e.g., JWT 'exp' claim), that refresh tokens can be revoked, and that revoked or expired tokens are rejected by the API. Option D is not a secure authentication test element; automating the password recovery workflow is a functional/process automation concern, not a security validation of authentication mechanisms. Option E is not a security test element; measuring API response speed is a performance test and does not validate authentication security properties.

Answer

Automating the password recovery workflow.

Answer

Testing the speed of the API response.

Question 7

An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling it from individual microservices?

Accepted Answer

API Gateway pattern acting as an identity provider proxy.. The API Gateway pattern acting as an identity provider proxy centralizes authentication at the gateway, which validates tokens/credentials and forwards authenticated requests to microservices. This decouples authentication from individual services, allowing them to focus on business logic while the gateway enforces identity consistently.

Answer

Centralized database user management.

Answer

Service Mesh with mutual TLS enabled.

Answer

Sidecar pattern using a local proxy for mTLS.

Question 8

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

Accepted Answer

Using parameterized queries. Option B (parameterized queries) is correct because parameterized queries (prepared statements) separate SQL code from user-supplied data, so the database engine treats input strictly as data rather than executable SQL, which neutralizes injection payloads. Option D (applying the principle of least privilege to the database user) is correct because limiting the application's database account to only the permissions it truly needs (e.g., no DROP, no xp_cmdshell, no unnecessary table access) reduces the blast radius if an injection flaw is ever exploited. Option E (strict input validation based on allow-lists) is correct because allow-list validation rejects any input that does not match an expected, tightly defined pattern, preventing malicious characters or payloads from ever reaching the SQL layer. Option A is not correct because stored procedures that internally build dynamic SQL strings via concatenation remain vulnerable to injection; stored procedures are only safe when they themselves use parameterization. Option C is not correct because client-side validation can be trivially bypassed by an attacker using a proxy or direct HTTP requests, so it must never be the sole defense against SQL injection.

Answer

Using stored procedures with dynamic SQL

Answer

Relying solely on client-side validation

Question 9

When designing an API, which approach best supports the 'Complete Mediation' principle?

Accepted Answer

Verifying authorization on every single API request.. Complete mediation requires that every access to every object be checked for authority.

Answer

Relying on the frontend to filter out unauthorized menu items.

Answer

Checking authorization only once at the beginning of the user session.

Answer

Allowing public access to all GET methods in the API.

Question 10

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Accepted Answer

The type of action performed.. Option B is correct because audit logs must record the type of action performed (e.g., login, file access, privilege change, configuration modification) so that reviewers can reconstruct what occurred and determine whether the activity was authorized. Option D is correct because capturing the user identity or service account identifier establishes accountability, tying each event to a specific principal so that actions cannot be repudiated and can be traced back to an individual or automated account. Option E is correct because the timestamp provides the chronological ordering needed for forensic reconstruction and correlation across systems, while the success/failure status distinguishes completed actions from attempted ones, which is essential for detecting brute-force attempts, unauthorized access, and policy violations. Option A is not appropriate because logging full passwords would expose credentials to anyone with log access and violates security best practices; passwords should never be stored in plaintext logs. Option C is not appropriate because a home address and phone number are personally identifiable information that are not relevant to the security event and would create unnecessary privacy and compliance risk.

Answer

The full password of the user involved in the event.

Answer

The user's home address and phone number.