CSSLP Practice Questions

Question 1

A developer is using AFL (American Fuzzy Lop) for fuzzing a C++ application. What is the primary requirement for achieving high coverage?

Accepted Answer

Instrumenting the code during compilation with afl-clang or afl-gcc.. AFL uses instrumentation to track branch coverage; without compiling with AFL's compiler wrappers, the feedback loop cannot function.

Answer

Configuring the fuzzer to use only random byte-flipping.

Answer

null

Answer

Running the fuzzer on a virtual machine without network access.

Answer

Providing the fuzzer with a binary that was stripped of all symbols.

Question 2

You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?

Accepted Answer

Token signature bypass/forgery.. The 'alg: none' vulnerability allows an attacker to forge tokens by telling the server to skip signature verification.

Answer

Cross-Site Request Forgery (CSRF).

Answer

Broken object-level authorization.

Answer

Insecure cookie flags.

Question 3

You are configuring a Content Security Policy (CSP) for a web application. Which directive should be used to restrict the sources from which scripts can be loaded?

Accepted Answer

script-src. The script-src directive in a Content Security Policy controls which sources are permitted to load and execute JavaScript. It is the primary defense against cross-site scripting (XSS) and malicious script injection, restricting scripts to trusted origins, nonces, or hashes. Other directives govern different resource types and do not affect script loading.

Answer

style-src

Answer

img-src

Answer

connect-src

Question 4

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Accepted Answer

Using a secure credential vault to inject secrets at runtime.. Option A is correct because a secure credential vault (e.g., HashiCorp Vault, AWS Secrets Manager, or Jenkins Credentials Binding) injects secrets at runtime so they are never hardcoded or persisted in source control or build logs. Option B is correct because SAST tools (e.g., SonarQube, Checkmarx, Semgrep) analyze source code for vulnerabilities such as injection flaws and insecure deserialization before artifacts are built, shifting security left in the pipeline. Option D is correct because isolating build runners in a restricted network segment limits lateral movement and blast radius if a build agent is compromised, enforcing least-privilege network access to only required dependencies and registries. Option C is wrong because granting Admin privileges to all developers violates least privilege and enables unauthorized pipeline, credential, and configuration changes. Option E is wrong because storing secrets in plain text within a Jenkinsfile exposes them to anyone with repository read access and to build log leakage, rather than using masked, runtime-injected credentials.

Answer

Granting 'Admin' privileges to all developers on the CI/CD server.

Answer

Storing pipeline secrets in plain text within the Jenkinsfile.

Question 5

A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?

Accepted Answer

Spoofing. STRIDE is Microsoft's threat modeling framework, and the 'S' stands for Spoofing, which is the threat of an attacker impersonating a legitimate user, system, or process. Spoofing violates authentication and is typically mitigated with strong authentication mechanisms such as MFA or certificates.

Answer

Software integrity

Answer

Service availability

Answer

System hardening

Answer

Secure architecture

Question 6

You are configuring log aggregation for a microservices architecture. Which practice is essential for secure logging management?

Accepted Answer

Implement an automated log masking process to remove sensitive data like session tokens and PII before ingestion.. Log files often contain PII or secrets; they must be redacted before storage and access must be strictly controlled.

Answer

Store all application logs in a publicly accessible S3 bucket for easy debugging.

Answer

Delete all logs after 24 hours to ensure compliance with the Right to be Forgotten.

Answer

Increase the log verbosity to the maximum level in production indefinitely.

Question 7

Which TWO inputs are most important when developing 'Abuse Cases'?

Accepted Answer

System functional requirements. Option A (System functional requirements) is correct because abuse cases are derived by systematically negating and misusing each legitimate function the system is specified to perform, so the functional requirements define the attack surface and the intended behaviors that must be subverted. Option D (Known threat intelligence and past incident history) is correct because real-world attacker tactics, techniques, and procedures (TTPs) and prior incidents reveal which abuses are realistic and likely, grounding the abuse cases in evidence rather than speculation. The annual maintenance budget (B) is a financial planning input that does not describe attacker behavior or system functionality, so it cannot drive abuse-case content. Developer performance metrics (C) measure productivity or code quality and are irrelevant to modeling adversarial misuse. The internal office floor plan (E) is a physical-security artifact and, while tangentially related to facility security, is not a primary input for developing abuse cases about system behavior.

Answer

The annual maintenance budget

Answer

Developer performance metrics

Answer

The internal office floor plan

Question 8

A design uses a shared service account for multiple microservices to access a common database. Which architectural risk does this create?

Accepted Answer

Loss of accountability and difficulty in auditing specific service actions.. Shared accounts prevent granular auditing and lead to excessive privilege accumulation.

Answer

Increased network latency.

Answer

Increased risk of SQL injection.

Answer

Incompatibility with container orchestrators.

Question 9

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Accepted Answer

Use the Jenkins Snyk Security plugin to trigger a scan during the image build step.. Integrating the Snyk Security plugin into the Jenkins build step scans the container image at build time, before promotion, enabling fail-fast remediation. This shifts security left and blocks vulnerable images from reaching production. It is the most effective because scanning occurs in the pipeline stage where the image is created.

Answer

Configure a post-deployment notification to Slack using a webhook.

Answer

Manually verify image signatures using Docker Content Trust after deployment.

Answer

Enable Jenkins 'Build periodically' to scan images in the registry.

Question 10

A security architect is reviewing the design of a payment processing system that uses a message queue to decouple services. The architect wants to ensure that if a message is intercepted and modified in transit, the receiving service can detect the tampering and reject the message. The system already uses TLS for transport encryption. Which additional design control best provides end-to-end integrity for the message payload?

Accepted Answer

Digitally sign the message payload with the sender's private key and have the receiver verify the signature using the sender's public key.. Digital signatures bind the message content to the sender's private key, so any modification invalidates the signature. Unlike transport-layer protections, a signature remains verifiable after the message leaves the TLS tunnel and is stored in a queue. This provides end-to-end integrity and authenticity, which is critical for payment messages that may traverse multiple services.

Answer

Enable TLS mutual authentication (mTLS) between the sender and the message queue and between the queue and the receiver.

Answer

Encrypt the message payload with a symmetric key shared between the sender and receiver before placing it on the queue.

Answer

Use a message authentication code (MAC) with a key shared between all services that interact with the queue.

Question 11

When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?

Accepted Answer

Analyzing the implementation of HttpOnly and Secure flags on session cookies.. Session management is best reviewed by analyzing the cookie attributes and token handling flows.

Answer

Checking for SQL injection in login forms.

Answer

Reviewing the database schema for password hashing algorithms.

Answer

Verifying the presence of a Web Application Firewall (WAF).

Question 12

You are tasked with implementing a 'Shift-Left' approach in a legacy waterfall project transitioning to DevSecOps. What is the highest priority action for early security lifecycle management?

Accepted Answer

Defining security requirements during the initial project planning/requirements phase.. Security requirements must be defined at the start of the project to ensure that security is built-in, rather than added as an afterthought in later phases.

Answer

Implementing automated DAST tools.

Answer

Deploying a Web Application Firewall (WAF) to protect the current environment.

Answer

Performing a manual code review on all legacy source code.

Question 13

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

Accepted Answer

Testing the password recovery/reset workflow.. Option A is correct because the password recovery/reset workflow is a classic authentication bypass vector: testers must check for predictable or leaked reset tokens, token reuse, missing expiry, host-header injection in reset links, and whether the reset endpoint verifies the user's identity before allowing a password change. Option C is correct because manipulating session cookies (e.g., tampering with session IDs, forging JWTs, altering role/identity claims, or replaying stolen cookies) directly tests whether the application properly validates session state and can be tricked into granting authenticated access without valid credentials. Option E is correct because brute forcing account credentials tests authentication strength controls such as account lockout thresholds, rate limiting, CAPTCHA enforcement, and password complexity, all of which are core to assessing whether authentication can be bypassed through weak credential policies. Options B and D are incorrect because changing the CSS file or the application's color scheme are purely cosmetic presentation changes that have no bearing on authentication logic, session handling, or access control.

Answer

Changing the application's CSS file.

Answer

Testing the application's color scheme.

Question 14

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

Accepted Answer

Enforcing mutual TLS (mTLS) for authentication.. Option A is correct because enforcing mutual TLS (mTLS) authenticates both the client and the server at the transport layer, adding a strong cryptographic identity check that complements higher-layer controls in a defense-in-depth strategy. Option B is correct because rate limiting at the API gateway mitigates abuse, brute-force attempts, and denial-of-service by throttling excessive requests, providing an independent protective layer even if other controls fail. Option E is correct because input validation for all parameters prevents injection attacks (such as SQLi and XSS) and malformed data from reaching backend logic, forming a critical application-layer defense. Option C is not appropriate because hardcoding API keys in source code exposes secrets to anyone with repository access and prevents rotation, weakening security rather than adding a layer. Option D is not appropriate because relying solely on a WAF creates a single point of failure and ignores other layers like authentication, input validation, and rate limiting that defense in depth requires.

Answer

Hardcoding API keys in the code for efficiency.

Answer

Relying solely on the WAF for security.

Question 15

When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?

Accepted Answer

Repudiation.. Digital signatures provide non-repudiation because the signer's private key uniquely binds them to the message, so they cannot later deny having signed it, which directly mitigates Repudiation (A). Digital signatures also detect any modification of the signed data through cryptographic hash verification, so any alteration invalidates the signature and mitigates Tampering (E). Elevation of Privilege (B) is mitigated by authorization controls and least-privilege design, not by signatures. Information Disclosure (C) is addressed by encryption such as TLS or AES, not by signing. Denial of Service (D) is mitigated by availability controls like rate limiting and redundancy, which signatures do not provide.

Answer

Elevation of Privilege.

Answer

Information Disclosure.

Answer

Denial of Service.

(ISC)2 Certified Secure Software Lifecycle Professional CSSLP practice test

Three ways to study

Study CSSLP by domain

Study CSSLP by topic

Secure Software Requirements practice questions

Secure Software Concepts practice questions

Secure Software Lifecycle Management practice questions

Secure Software Deployment Operations And Management practice questions

Secure Software Supply Chain practice questions

Secure Software Implementation practice questions

Secure Software Architecture And Design practice questions

Secure Software Testing practice questions

CSSLP fundamentals practice questions

CSSLP scenario practice questions

CSSLP troubleshooting practice questions

(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) practice questions