(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) (CSSLP) — Questions 1–75

Broken access control arises when authorisation decisions rely on client-side checks or per-endpoint logic that can be bypassed. Centralised server-side enforcement validates every request against policy, satisfying the design mitigation requirement by removing client trust and inconsistent per-route checks.

A Software Security Policy establishes organisation-wide security expectations, making it the correct governance instrument. Unlike standards or procedures, which specify mandatory controls or step-by-step instructions, the SSP operates at a strategic level and applies across every development project, directly satisfying the stem's requirement for high-level expectations spanning all software work.

This approach directly implements least privilege by granting only the permissions required for a user's role and periodically validating that those permissions remain appropriate. It limits the blast radius of compromised accounts and reduces the risk of privilege abuse. Regular reviews ensure that permissions do not accumulate over time, which is a common failure mode in role-based access control systems.

Least privilege requires granting only the permissions needed for a task. A dedicated service account with granular database permissions avoids shared, over-privileged credentials, limiting blast radius if compromised and satisfying the constraint that database access be scoped to exactly what the application requires.

AES-256-GCM provides strong confidentiality and integrity, and using a unique key per record limits the impact of a key compromise. Storing keys in an HSM protects them from extraction and ensures secure key management. This approach aligns with HIPAA's encryption requirements and best practices for protecting ePHI at rest, as it combines robust encryption with secure key storage.

Taint analysis tracks untrusted data flows from sources to sinks, so it can flag when sensitive values propagate into logging calls. This dataflow tracking is what detects improper handling of sensitive information in logs, unlike pattern or style checks.

Exposed environment variables mean the database credential is compromised, so it must be rotated immediately by changing the password and updating the deployment manifest to distribute the new value. This invalidates the leaked credential before the attacker can reuse it.

Automated scanning of stored artifacts detects known CVEs in dependencies and images before deployment, blocking compromised components from reaching consumers. This satisfies the supply chain constraint by continuously verifying that registry contents remain free of exploitable vulnerabilities throughout their retention.

Security review of design documentation belongs in the design phase, where architecture, data flows and trust boundaries are still malleable. Catching flaws here avoids costly rework later, satisfying the stem's requirement for the most appropriate SDLC phase to formally assess the system's design.

Ease of exploitability and public exploit availability directly determine real-world risk, so they must weight DAST triage. A remotely exploitable flaw with a weaponised exploit warrants immediate remediation, whereas a theoretical issue requiring unusual conditions ranks lower. This satisfies the stem's prioritisation constraint by ranking findings on practical attack likelihood.

A service mesh with mTLS ensures that each service authenticates to others using certificates, and authorization policies at the sidecar proxy enforce least privilege. This design provides strong identity and access control at the network layer, preventing lateral movement because a compromised service cannot impersonate another without valid certificates. The sidecar proxy intercepts all traffic, enabling consistent policy enforcement and detailed audit logging, which is ideal for microservices.

Verifying the artifact's digital signature with the organisation's trusted public key proves the build system signed those exact bytes; any tampering invalidates the signature. This satisfies the stem's integrity constraint, unlike checksums, which an attacker who alters the artifact could also recompute.

Aligning security risk management with enterprise risk management ties technical risk exposure to the organisation's overall risk appetite and reporting structures. This satisfies the stem's governance requirement by ensuring security decisions are prioritised using the same business-impact criteria that drive strategic objectives.

An SBOM enumerates every component, library and dependency version within the software, giving the complete inventory needed to identify affected third-party libraries when a new vulnerability is disclosed. This visibility satisfies the third-party library management requirement by enabling rapid impact assessment and remediation.

Accountability ensures that every action can be traced to a responsible entity. RBAC restricts access to authorized clinicians, and tamper-evident audit logs record who accessed what and when. Together, they provide the ability to hold users responsible for their actions. Digital signatures on logs add integrity, preventing undetected modification. This directly satisfies the requirement that access is logged with a tamper-evident trail.

FedRAMP mandates the use of secure protocols such as TLS 1.2 or higher for data in transit, with FIPS 140-2 validated cryptographic modules. This requirement ensures confidentiality and integrity of data during transmission, directly aligning with FedRAMP controls. It is specific, verifiable, and meets the regulatory baseline.

A VDP publishes a defined intake route, such as a security contact or bug bounty portal, so external researchers can report findings without resorting to public disclosure. This gives the vendor private remediation time, satisfying the stem's focus on the policy's primary function.

Scoping the registry URL in .npmrc to your internal Artifactory or Nexus ensures npm resolves scoped packages only from the private registry, so a malicious public package with the same name cannot be substituted. This directly prevents the dependency confusion attack described in the stem.

A digital signature provides integrity and authenticity. If the payload is modified in transit, the signature verification will fail because the hash no longer matches. TLS only protects the message while in transit between immediate hops; once the message is stored in the queue, TLS does not protect it. Signing the payload ensures end-to-end integrity regardless of intermediate storage.

A read-only root filesystem prevents an attacker who compromises a container from writing malware, altering binaries or persisting changes to the image layers. This contains the breach to the running container's ephemeral state, minimising impact within the cloud-native environment.

Regulations overlap, so satisfying each independently leaves gaps. Adopting the most restrictive control for every requirement ensures compliance with all applicable laws simultaneously, since meeting the strictest threshold inherently satisfies the looser obligations of the others.

Automated security unit tests run inside the CI pipeline on every commit, so flaws are caught without a separate review gate. This preserves the short iteration cadence Agile demands, satisfying the stem's security velocity constraint rather than slowing delivery through manual checkpoints.

For tokenization to reduce PCI DSS scope, the sensitive card data must be isolated from the application environment. Hosting the tokenization service in a separate segment and ensuring the application never handles raw card data means the application falls outside the cardholder data environment (CDE). This minimizes the systems that need to be PCI DSS compliant, which is the primary goal of tokenization.

The ':latest' tag is mutable: a registry push can repoint it to a different image digest at any time. Because the build server resolves the tag at pull time, an attacker who compromises the registry or upstream project can substitute a malicious image, executing arbitrary code in the build pipeline.

Granular segmentation constrains east-west traffic, so a zero-day exploit on one host cannot pivot freely. Since no signature exists to block the initial compromise, limiting lateral movement contains blast radius and satisfies the hardening constraint.

A service mesh with mTLS encrypts and authenticates all service-to-service communication, and fine-grained access policies enforce least privilege between services. This segmentation limits lateral movement because a compromised service cannot freely communicate with others without proper authorization. The service mesh also provides observability and policy enforcement, making it a robust pattern for containing breaches in microservices architectures.

Data masking ensures that cardholder data is not exposed in the user interface or logs. Displaying only the last four digits of the PAN is a common PCI DSS requirement. Masking other sensitive data prevents accidental leakage through screenshots, logs, or shoulder surfing. This design principle protects data in use and helps meet compliance requirements for display of cardholder data.

PoLP grants each user, process or service only the permissions required to complete its defined task, nothing more. This directly satisfies the stem's goal by shrinking the attack surface and limiting blast radius, since compromised accounts cannot reach unrelated systems or data beyond their task scope.

A security-focused Lessons Learned meeting identifies root causes and control gaps from the incident, then feeds concrete improvements back into the SDLC — requirements, design reviews, coding standards and testing — so similar vulnerabilities are prevented in future releases rather than merely documented.

Tracing untrusted input from entry points (sources) to sensitive operations (sinks) exposes injection, path traversal and deserialisation flaws that pattern-matching tools miss. This directly satisfies the stem's manual review constraint: a human follows tainted data across functions and files, confirming whether validation or encoding actually neutralises it.

Misuse case modelling documents adversarial goals against legitimate functionality, capturing the attacker's SQL injection intent as a structured abuse scenario. This satisfies the Secure Software Requirements phase constraint by recording the threat's behaviour during requirements, before design or code exists, so mitigations such as parameterised queries can be specified as explicit security requirements.

Whitelisting, or positive validation, defines exactly what is allowed and rejects everything else. This is highly effective against injection attacks because it prevents malicious characters or patterns from being processed. It is a robust design approach that minimizes the attack surface and is recommended by security standards for input validation.

Cryptographic hashes uniquely identify the exact artifact and enable integrity verification. When a new vulnerability is announced, a hash allows you to confirm whether the specific binary or package you received is affected, rather than relying solely on version numbers which can be ambiguous or spoofed. This supports rapid and accurate response, as you can match the hash against known vulnerable artifacts and ensure you are analyzing the correct code.

Hermetic builds require isolation from external inputs, so disabling network access during the build stops dependency downloads, exfiltration and remote code retrieval. This closes the pipeline compromise vector where an attacker injects malicious content over the network mid-build.

A dedicated secret management service stores credentials centrally, encrypts them at rest, enforces access policies and audits retrieval. Injecting secrets at runtime keeps them out of source code, build artefacts and container images, eliminating hard-coded credential exposure — the most secure pattern for the stated requirement.

Fourth-party sub-processors are the upstream dependencies where supply chain failures actually originate. Requesting this list exposes concentration risk and unassessed vendors beneath the SaaS provider, directly satisfying the stem's resilience evaluation of the extended supply chain rather than the provider's own controls.

Splitting commit and deployment across two identities enforces separation of duties: the developer who authors code cannot also push it to production. This directly satisfies the policy's constraint that no single principal holds both write and release privileges, preventing unilateral changes from reaching production without a second authorised actor.

Integrity is one of the three core CIA triad pillars, ensuring data remains accurate and unaltered unless modified by authorised parties. The stem asks for recognised triad components, and integrity is explicitly named in the acronym itself, making it a definitive member.

Using hardware-backed key storage ensures that the encryption key is protected by dedicated security hardware, making it extremely difficult to extract even if the device is compromised. Storing the encrypted data in the app's private directory prevents other apps from accessing it. This design provides strong confidentiality for data at rest and protects against unauthorized access, meeting the requirements for lost/stolen devices and inter-app isolation.

Isolation and compartmentalization involve dividing a system into separate components with controlled interfaces, so a compromise in one does not automatically grant access to others. In a mobile banking app, this could mean isolating the authentication module from the data storage module, using sandboxes, or enforcing network segmentation. This directly limits lateral movement and reduces the blast radius, matching the security team's goal.

Authentication error messages must be generic so they cannot reveal whether an account exists, preventing username enumeration. This satisfies the stem's secure API authentication test-case element, complementing valid and invalid credential checks, lockout behaviour and token handling.

PDF is a standard, portable output format for security testing reports, preserving layout and supporting distribution to stakeholders who lack the original tooling. It satisfies the stem's requirement for a common report output format alongside other formats such as XML or HTML.

Robust authentication forces callers to prove identity before reaching API logic, blocking anonymous abuse and shrinking the reachable attack surface. It is a recognised minimisation technique because unauthenticated endpoints expose parsing, business logic and data-access code to untrusted input.

Security acceptance criteria inside the Definition of Done make each increment incomplete until controls are met, embedding verification into every sprint rather than a separate phase, which satisfies the Scrum constraint of continuous, team-owned compliance.

Native object serialisation reconstructs arbitrary types from attacker-controlled bytes, and gadget chains in the classpath then execute during deserialisation. This language-specific mechanism, not generic parsing, is the root cause the stem's insecure deserialisation audit targets.

Secure configuration management enforces baselines that keep development, test and production environments in an identical hardened state, eliminating drift that attackers exploit. This directly satisfies the stem's requirement for a primary objective: consistency across all environments, achieved through automated configuration enforcement rather than one-off manual hardening.

GitHub's secret scanning detects committed credentials, and push protection blocks them before they reach the remote repository. This pre-commit interception satisfies the stem's DevSecOps requirement to prevent secrets from being committed, rather than detecting them only after exposure.

Pinning dependencies to exact versions with verified hashes prevents a compromised or substituted package from entering the build, blocking supply-chain attacks such as typosquatting or malicious updates that floating version ranges would silently pull in.

Injecting quotes and comment markers directly exercises the parser's handling of untrusted input, satisfying the requirement for a test case that detects SQL injection resistance. Single quotes break string literals, while `--` truncates the remaining query, so unsanitised concatenation produces malformed SQL or altered logic, revealing the vulnerability.

Moving the secret to a server-side broker places it inside a trust boundary the attacker does not control. The client authenticates to your own backend using a credential appropriate to a public client, and the backend holds the vendor secret and makes the privileged call. This removes the secret from the untrusted environment entirely, which is the correct architectural fix.

Disabling unused services and ports shrinks the attack surface, so nothing unnecessary listens for connections. This directly enforces secure-by-default: the production container image exposes only what the application genuinely requires, eliminating latent entry points attackers could exploit.

Fuzzing generates malformed traffic that can corrupt records, trigger unintended transactions or leak data. Running it against an isolated environment with synthetic or sanitised data prevents production records being damaged or exposed, satisfying the stem's requirement for a recommended web service fuzzing practise.

Digital signatures provide integrity and origin authentication by hashing the message payload and encrypting that hash with the sender's private key, so any modification is detectable on verification. This directly satisfies the SOA requirement that messages between services are not tampered with, unlike transport-only protections that leave payloads exposed once decrypted.

Bypassing password complexity for internal testing accounts introduces an authentication weakness that may reach production. Documenting the risk and performing a formal risk assessment satisfies the CSSLP requirement to analyse and quantify security impact before accepting, mitigating or rejecting the stakeholder's request through governance.

Complete Mediation requires that every access to every object be authorised at the time of the request, with no reliance on cached decisions or assumed trust. Checking authorisation for every access request directly implements this, closing gaps where prior approval might be reused improperly.

Random, non-predictable UUIDs prevent attackers from enumerating or guessing valid resource identifiers, removing the predictable-ID precondition BOLA exploits. This satisfies the stem's design-choice constraint by making object references unguessable, so unauthorised direct object access attempts cannot target known IDs.

Storing files outside the web root prevents direct execution or rendering by the web server. Serving them with Content-Disposition: attachment forces download rather than inline display, and a safe Content-Type like application/octet-stream prevents the browser from interpreting the file as HTML or script. This effectively mitigates stored XSS because even if a malicious file is uploaded, it cannot execute in the context of the site.

Injecting a fresh, valid JWT into the Authorization header before each request ensures the fuzzer reaches authenticated API logic rather than being rejected at the authentication layer. This satisfies the stem's constraint by exercising the endpoints under test with legitimate credentials throughout the campaign.

Pinning exact versions in a lock file plus scoped registries on a private repository ensures resolution targets internal packages, satisfying the stem's dependency-confusion constraint. Scoping prevents public registry packages from shadowing internal names, and lock files block silent version substitution.

Embedding security requirements as user stories with acceptance criteria ensures that security is considered from the start of each sprint and validated continuously. This aligns with Agile principles and shift-left security, allowing teams to address security alongside functional requirements. It promotes shared responsibility and avoids late-stage surprises, making it the most effective integration approach.

Fail-safe defaults require that access decisions deny unless explicitly granted, so a failed authorisation check must return deny rather than permit. Explicitly denying on failure satisfies this constraint, preventing accidental access when the check cannot confirm permission.

Using `<%= %>` escapes HTML entities before interpolation, neutralising injected markup so browsers treat user data as text rather than executable script. This directly satisfies the XSS mitigation requirement for EJS rendering, unlike `<%- %>`, which emits raw unescaped output and permits script injection.

Threat modeling is a structured approach to identify potential threats and security requirements during the design phase. By analyzing data flows, trust boundaries, and potential attack vectors, the team can define security controls early, reducing the cost of remediation later. It aligns with the CSSLP principle of building security in from the start and is a core activity in secure software design.

This is correct because the plaintext DEK never persists in storage; only the wrapped DEK and ciphertext do. An attacker with bucket read access cannot unwrap the DEK without the KMS KEK, and KMS access is separately authenticated and audited. Per-record DEKs also limit the blast radius of any single key compromise.

Abuse case modelling examines how an attacker could misuse the application, deriving security requirements from anticipated threats during the earliest SDLC phases. Unlike functional use cases, it explicitly captures adversarial goals, feeding concrete protective requirements into design before code is written.

A rollback procedure restores the previous known good release if deployment fails or introduces vulnerabilities, directly satisfying the stem's deployment-plan requirement. It differs from backup alone by including the tested mechanism and decision criteria for reverting, preserving availability and integrity during failed releases.

An HSM or KMS provides secure key storage, access control, and often key lifecycle management. Keys are never exposed in plaintext to the application; cryptographic operations are performed within the secure boundary. This is the recommended practice for protecting sensitive keys, as it prevents extraction and unauthorized use even if the application server is compromised.

The Snyk plugin runs during the image build step, scanning layers for known vulnerabilities before the image is tagged and promoted. This gates the pipeline at the earliest point, satisfying the requirement to scan prior to production promotion.

Running SAST on code as it is written gives developers immediate feedback on secure coding patterns, letting them correct unsafe constructs while the code is still fresh, rather than discovering systemic mistakes during later testing or review.

Parameterised queries send SQL code and user data as separate constructs, so supplied values are bound as literals and cannot alter query structure. This removes the injection vector at the database interface regardless of input content.

Memory-safe languages eliminate entire classes of flaws such as buffer overflows and use-after-free at the source. Isolating unavoidable native code behind a small, validated boundary limits the blast radius of any residual flaw, which is precisely the containment and early-detection goal stated in the scenario.

The impact on confidentiality, integrity, and availability (CIA) is a core component of risk assessment. A vulnerability that exposes sensitive data or allows modification of critical records has higher priority than one with minimal impact. This factor directly informs the severity and urgency of remediation, making it essential for triaging DAST findings.

Row-level security enforces tenant isolation in the data layer, so even if a developer forgets a WHERE clause, the database will not return another tenant's rows. This provides a defense-in-depth control that does not depend on application code discipline. It aligns with the architectural goal of enforcing a security constraint centrally rather than per-query.

SLSA Level 3 requires the build platform to be hardened against tampering and to generate authenticated provenance, cryptographically signed by the build service. This ensures artefacts trace to a trusted, isolated builder rather than a developer workstation.

Psychological acceptability requires security mechanisms to be usable enough that users do not circumvent them. A mobile app push notification approves authentication with a single tap, imposing minimal cognitive burden while preserving the second factor, unlike cumbersome token entry or complex password rules.