(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) (CSSLP) — Questions 76–150

Mapping each security requirement to the feature or module that implements it establishes traceability between stated security needs and delivered functionality, satisfying the matrix's purpose of proving coverage and exposing requirements with no corresponding implementation.

Mandating an SBOM for all delivered software gives the policy a concrete, verifiable foundation: it establishes component-level visibility across the supply chain, enabling vulnerability tracking, licence review and provenance checks on third-party and open-source dependencies.

Password reset flows frequently bypass primary authentication, relying on weaker tokens, security questions or email links. Testing this workflow exposes flaws such as predictable reset tokens or user enumeration, covering an authentication bypass vector the question requires.

Static analysis engines model pointer arithmetic and array bounds, flagging writes beyond allocated buffers. Buffer overflow is a memory-safety defect detectable from source alone, unlike runtime-only faults, so Fortify or Coverity identify it during code review before compilation or execution.

The Security Architect translates business and compliance drivers into technical security requirements, threat models and control baselines early, before design is fixed. That forward-looking remit matches identifying security requirements during initial SDLC phases, unlike developers or testers who act later.

Privacy by Design requires limiting collection and retention to what is strictly necessary. Enforcing data minimisation across the entire lifecycle — collection, processing, storage and disposal — reduces exposure of PII, directly satisfying the proactive, embedded privacy constraint the stem demands rather than bolting controls on afterwards.

Confidentiality is one of the three classic security requirement categories, alongside integrity and availability — the CIA triad. It directly satisfies the stem's demand for typical classification categories, as it addresses preventing unauthorised disclosure of information, a foundational objective that security requirements must express.

A sidecar proxy intercepts all inbound and outbound traffic for its paired workload, terminating and originating mTLS connections while evaluating authorisation policies per request. This satisfies the stem's service mesh requirement, since encryption and access control are enforced transparently at the data plane without altering application code.

A risk-based assessment quantifies the exposure each usability trade-off introduces, letting the team select controls proportionate to identified threats rather than defaulting to maximum restriction. This satisfies the stem's requirement to resolve the conflict by weighing both concerns against actual business impact, producing a documented, defensible balance instead of an arbitrary preference.

Gap analysis compares current or planned controls against a chosen baseline such as ISO 27001 or OWASP ASVS, exposing absent or weak controls. That comparison output is what drives requirements, satisfying the stem's aim of identifying missing security controls during the requirements phase.

The script-src directive whitelists origins permitted to supply executable JavaScript, blocking inline and untrusted external scripts. It is the specific CSP control governing script loading sources, directly satisfying the requirement to restrict where scripts may be fetched from.

A digital signature, such as Authenticode or GPG, is verified with the signer's public key to confirm the code's integrity and origin authenticity. This satisfies the stem's proof-of-signing requirement, unlike a hash alone, which detects alteration but does not establish who signed.

A CSPRNG is designed to produce output that is computationally infeasible to predict, even if previous outputs are known. Seeding it with a high-entropy source like /dev/urandom or CryptGenRandom ensures unpredictability. This directly satisfies the requirement for session identifiers that resist guessing attacks, as opposed to general-purpose random functions that may have predictable patterns.

Shift-left means security work migrates to the earliest lifecycle stage. Capturing security requirements during initial planning embeds controls before design and code exist, when change is cheapest, rather than retrofitting them during testing or operations in the legacy waterfall transition.

The SRTM links each regulatory obligation to the specific features and tests that satisfy it, providing bidirectional traceability so auditors can confirm coverage, which satisfies the need to map compliance requirements to concrete software functionality.

Snyk Open Source scans dependency manifests against a vulnerability database and fails the GitHub Actions job when high-severity issues are found, gating the build. This satisfies the automated policy requirement by blocking merges rather than merely reporting findings.

A documented tracking and patching process demonstrates repeatable, proactive vulnerability management rather than ad hoc reaction. This satisfies the stem's demand for the strongest indicator, since it evidences an ongoing capability to identify and remediate vulnerable components before exploitation.

Cross-border financial transactions trigger AML obligations regardless of jurisdiction, since AML regimes criminalise laundering proceeds and mandate customer due diligence, transaction monitoring and suspicious activity reporting. This directly satisfies the stem's compliance-identification constraint for software handling such payments.

The --suppression flag accepts an XML file listing false-positive identifiers, causing Dependency-Check to omit those matches from reported findings. This directly satisfies the stem's constraint of ignoring specific false-positive vulnerabilities in a third-party library without disabling broader detection.

An SBOM enumerates every component and version in the software, enabling automated matching against vendor lifecycle data to flag components past their support date. This directly satisfies the stem's supply chain threat: unpatched, unsupported dependencies that no longer receive security fixes, which attackers exploit through known vulnerabilities.

Taint analysis is the primary mechanism for tracking data from sources to sinks in SAST.

Splitting deployment approval across two distinct roles prevents any single individual from both writing and releasing code, enforcing the dual-control requirement central to separation of duties. It directly satisfies the stem by ensuring no one holds end-to-end authority over the production change.

Validating the architecture against established security patterns confirms the design implements proven controls rather than ad hoc measures, satisfying the review's requirement to assess whether the proposed structure meets the organisation's security standards before code is written.

Encoding output neutralises injected markup before it reaches the browser, blocking cross-site scripting even when input validation fails. This satisfies the stem's layered-control requirement: an independent, downstream safeguard that still contains an attacker after an earlier defensive layer is bypassed, rather than relying on any single control.

NetworkPolicy is Kubernetes' native pod-level firewall, and its egress rules restrict outbound connections by namespace and label selector. This directly satisfies the stem's constraint of limiting the microservice's anomalous outbound traffic to only known authorised endpoints, which security groups or service mesh policies cannot enforce at pod granularity.

A shared service account removes per-service identity, so database audit logs cannot attribute actions to a specific microservice. This destroys accountability and makes forensic reconstruction of which service performed a malicious or erroneous action effectively impossible.

Fail-safe defaults deny access when a decision cannot be evaluated, so a component failure or malformed input cannot silently grant privileges. This directly satisfies the stem's resilience constraint by keeping the system secure under fault conditions rather than depending on every check completing successfully.

Running services with minimal OS privileges ensures that if a service is compromised, the attacker gains limited access. This is a core aspect of least privilege, applied to service accounts. It reduces the blast radius and prevents privilege escalation. Therefore, it is a correct practice for achieving least privilege in system design.

Platform audit logs capture administrative API activity such as role changes, secret access, and workload modifications. Forwarding them to a SIEM and applying correlation rules enables near-real-time detection of anomalous patterns, and alerting the on-call team ensures a timely response. This directly satisfies the requirement to detect and respond to administrative actions quickly in the payment microservice environment.

Spring Security's HttpSecurity CSRF configuration enforces synchroniser tokens on state-changing methods (POST, PUT, DELETE), rejecting requests lacking a valid token. This directly satisfies the stem's requirement to prevent CSRF on state-changing HTTP requests in the Spring Boot application.

SAST analyzes source code for security flaws without executing it. Integrating SAST into the developer's IDE or CI pipeline during implementation provides immediate feedback, allowing developers to fix issues early. This is a key shift-left practice that reduces the cost of remediation and prevents vulnerabilities from progressing to later stages.

Per-service workload identity with short-lived, narrowly scoped credentials is the core of least privilege in a microservices mesh. If one service is compromised, the attacker inherits only that service's permissions and only until the credential expires. This directly limits lateral movement and blast radius, which is exactly the design objective stated in the scenario.

Mutual TLS authenticates both client and server through X.509 certificates during the TLS handshake, satisfying gRPC's requirement for strong service-to-service authentication without shared secrets. Each microservice verifies the other's certificate, providing cryptographic identity and encrypted transport, which suits machine-to-machine communication where no interactive user exists to supply credentials.

The percentage of applications with completed threat models indicates the adoption of proactive security practices. Threat modeling helps identify design flaws early, reducing the cost of fixes. Tracking this metric shows how well the organization is integrating security into the early phases of the lifecycle, which is a core goal of secure SDLC management.

Economy of mechanism holds that security functions should be as simple as possible, since complexity breeds implementation errors and overlooked flaws. Keeping designs small and understandable makes them easier to verify, test and maintain, directly satisfying the stem's requirement that developers keep security mechanisms simple to understand and implement.

A unique per-user salt defeats rainbow tables and ensures identical passwords produce different digests, while hashing remains one-way. This satisfies the stem's requirement for the standard practice applied to all stored passwords, unlike encryption, which is reversible.

Requirements phase defects are cheapest to fix because no code or architecture exists yet. Identifying and correcting security requirements here prevents costly rework during design, coding and testing, satisfying the lifecycle constraint that earliest-phase remediation yields the greatest cost-effectiveness.

Availability ensures authorised users can access services and data when required, including under heavy load or active denial-of-service conditions. The other pillars address secrecy and integrity, not sustained service access, so availability directly matches the scenario described.

Pseudonymization replaces direct identifiers with artificial identifiers, reducing the linkability of data to individuals. This supports data minimization by limiting the exposure of personal data in secondary uses like analytics and logging. It is a privacy-enhancing technique that aligns with the principle of using only the data necessary for the purpose, making it a correct choice.

The 'state' parameter carries an opaque value the client generates and returns with the authorisation response. The client verifies it matches the value it sent, binding the response to its own request and blocking cross-site request forgery attacks that would otherwise inject a forged authorisation code.

Data residency and sovereignty laws dictate where personal data may be stored and processed, varying by jurisdiction. For an international product, these legal constraints determine hosting regions, cross-border transfer mechanisms and data localisation, making them a primary compliance requirement.

Synchronous replication maintains a live duplicate of data, so service continues when the primary database fails. This directly satisfies the stem's requirement that data remain accessible despite server failure, which is the availability leg of the CIA triad rather than integrity or confidentiality.

Developers frequently lack secure coding knowledge, so they introduce vulnerabilities and cannot interpret security tooling output. This skills gap forces security teams to remediate late, undermining the Secure SDLC's shift-left intent across a large organisation.

Redundancy with automatic failover ensures that if one component fails, another can take over, maintaining availability. This is a core principle of resilience, as it reduces single points of failure and allows the system to continue operating during disruptions. It also helps mitigate denial-of-service attacks by providing additional capacity and failover paths.

Economy of Mechanism keeps the design as simple as possible, so fewer code paths, interfaces and features exist for attackers to exploit. Reduced complexity directly shrinks the attack surface and lowers the chance of implementation flaws.

Validating input at multiple layers ensures that if one layer is bypassed or has a flaw, another layer can still catch malicious input. This is a classic defense-in-depth approach: redundant controls that address the same threat from different angles. It reduces the likelihood of a single point of failure leading to a vulnerability.

Fail-safe defaults means access decisions fall back to denial when the module cannot complete its checks. A login error therefore refuses entry rather than granting it, satisfying the stem's requirement that the authentication module default to a secure state under failure.

Misuse cases are a structured technique to identify negative scenarios and derive security requirements. They help non-technical stakeholders understand threats by illustrating attacker goals, making it easier to elicit specific, testable requirements. This approach directly addresses completeness and unambiguity by forcing consideration of abuse scenarios and corresponding mitigations, which can be validated during testing.

Signing artifacts with a private key lets Jenkins verify provenance and detect tampering after the build, so only artefacts whose signature validates are deployed. This satisfies the integrity constraint by binding the deployed binary to the trusted build rather than trusting storage or transport.

Layered controls at distinct tiers: input validation and parameterised queries harden application code against injection, while a WAF filters malicious HTTP traffic at the perimeter. Compromise of one layer does not defeat the others, satisfying the defence-in-depth requirement.

Continuous monitoring of vulnerability disclosures for third-party libraries satisfies the stem's requirement to manage inherited risk after integration. Feeds such as the National Vulnerability Database, vendor advisories and software composition analysis alerts identify newly published CVEs affecting pinned versions, enabling timely patching before attackers exploit known flaws in deployed dependencies.

A secret management service stores the API key outside source code and injects it at runtime, removing the hardcoded credential from the repository. This satisfies the requirement to manage the secret securely, enabling rotation and access auditing.

Automated drift detection continuously compares deployed configurations against the approved baseline, then remediates deviations before they accumulate. This directly satisfies the stem's requirement to reduce configuration drift, since manual comparison cannot scale across dynamic environments and leaves unauthorised changes undetected until they undermine the secure software baseline.

An abstraction layer intercepts every call to the legacy system, validating and sanitising data in both directions. This isolates your application from the legacy system's vulnerabilities, such as injection flaws, so a compromise there cannot propagate across the boundary — directly minimising the risk the stem describes.

IaC encodes configuration as version-controlled templates, so scanning them in the pipeline catches misconfigurations before deployment rather than after. This satisfies the stem's lifecycle-wide constraint, enforcing secure baselines consistently across environments and preventing configuration drift that manual hardening cannot sustain.

Without token handling, the application will reject the forged request.

Deprecated cryptographic libraries, such as MD5, SHA-1 or TLS 1.0, contain known weaknesses that attackers can exploit. Replacing them with current, supported algorithms and protocols removes those exploitable primitives, directly improving the legacy system's security posture at its foundational trust layer.

Shadow IT systems are procured and operated outside central governance, so security teams cannot inventory them, assess their configurations or apply consistent controls. This visibility gap prevents uniform policy enforcement across the enterprise, which is the core challenge when eliciting security requirements.

External API credentials grant access to third-party services and often carry billing or data-scope privileges. Storing them in a secure vault rather than source code or configuration files enforces confidentiality and controlled retrieval, satisfying the need to protect secrets from disclosure or unauthorised reuse.

The Software Requirements Specification captures functional and non-functional constraints that architects must design against. Documenting GDPR erasure obligations there satisfies the stem's requirement by ensuring deletion timelines and data lifecycle rules are traceable, testable requirements rather than informal assumptions discovered after design.

Using a hardware-backed keystore ensures that sensitive tokens are encrypted and protected by the device's secure element, making extraction difficult even with physical access. Requiring user authentication adds a layer of protection. This aligns with the principle of securing data at rest and leveraging platform security features, which is a best practice for mobile banking applications.

AFL relies on compile-time instrumentation to insert coverage-tracking probes at basic blocks, feeding feedback to the fuzzer's queue. Without afl-clang or afl-gcc instrumentation, AFL falls back to blind fuzzing with no coverage signal, so high coverage demands instrumented binaries.

Terraform state files store resource attributes and secrets in plaintext, so a remote backend such as S3 with server-side encryption and tightly scoped IAM policies protects that data at rest and restricts who can read or alter it.

This approach grants only the permissions necessary for the portal to function, which is the essence of least privilege. If the account is compromised, the attacker cannot access unrelated tables or perform administrative actions. It limits the potential damage and aligns with secure design principles.

An IDOR means the application fails to enforce object-level authorisation, so the test must confirm whether another user's resources are reachable by manipulating the identifier. Attempting access to other users' objects directly validates the vulnerability and satisfies the stem's next-step requirement.

Sender-constrained tokens are useless to an attacker who copies them without the corresponding private key, which is stored in hardware-backed keystore and ideally non-exportable. Rotation on each use also detects replay, because a reused token invalidates the chain, giving the defender a signal of compromise.

Security requirements definition establishes the protective and compliance obligations the software must satisfy before design begins, making it an essential SSDLC component. Without it, later design, coding and testing activities lack measurable security criteria to verify against, so requirements cannot be traced or validated.

Built-in language APIs avoid invoking a shell, so user input cannot be interpreted as command syntax. This eliminates OS command injection at its source, satisfying the requirement to handle untrusted input securely rather than relying on escaping or sanitisation of shell metacharacters.

Context-aware output encoding neutralises injected markup at the exact point of rendering, matching each sink (HTML, attribute, JavaScript, URL). This defeats XSS regardless of how input bypassed earlier filtering, satisfying the presentation-layer defence the scenario requires.

Classifying data sensitivity determines the protection level each asset warrants, driving selection of encryption, access control and handling requirements proportionate to impact. This satisfies the stem's goal of linking sensitivity classification to the controls and protection levels applied to specific data assets.

The SRTM maps each security requirement to its design, code and test artefacts, so the SMS-MFA prohibition for high-risk accounts is recorded and verifiably traced. This satisfies the stem's documentation need, unlike a general security policy or design document that lacks traceability linkage.

With a shared schema and tenant column, isolation is enforced only by application-layer predicates. Any missed WHERE clause, ORM bypass, ad-hoc report query, or new developer mistake leaks cross-tenant data. There is no database-enforced boundary acting as a backstop, so a single coding error becomes a multi-tenant breach, which is precisely the systemic risk a security architect must flag in this design.

SLSA level 3 requires that provenance be generated by a trusted build platform and that it be signed and stored in a way that prevents tampering by the build system itself. Storing unsigned provenance on the same server allows an attacker who compromises the build server to alter both the artifact and its provenance. This violates the core requirement for non-falsifiable provenance and isolation between the build and provenance storage.

The layout file is the signed root of trust in in-toto; it specifies the ordered supply chain steps, the functionaries authorised to perform each, and the artefacts each step must produce. Verification then checks link metadata against these defined expectations.

Open Design holds that security must not depend on secrecy of the design itself. Publishing the architecture invites independent scrutiny, allowing flaws to be identified and corrected rather than hidden, which strengthens assurance without relying on obscurity.