Sample questions
(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) practice questions
When designing secure software, why is 'Economy of Mechanism' important?
Which TWO of the following are essential components for achieving 'Non-repudiation'?
A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?
A developer is performing a threat modeling exercise using STRIDE. What does the 'S' in STRIDE represent?
In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by req…
A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?
You are using the 'Complete Mediation' principle in your system's access control design. What does this require?
When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?
Which of the following is an example of defense-in-depth in a web application architecture?
Which TWO of the following strategies best implement the principle of 'Separation of Duties' in an application design?
When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?
Which design activity helps identify security requirements during the earliest phases of the SDLC?
When performing threat modeling using the STRIDE model, which TWO of the following threats are mitigated by implementing digital signatures?
When designing for auditability, which THREE of the following pieces of information should be captured in security logs?
When designing an application that relies on external APIs, which THREE of the following are necessary security considerations?
Which THREE of the following are key components of a 'Secure Design Review' process?
In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?
An organization is moving a monolithic application to a microservices architecture. Which security design pattern is most effective for centralizing authentication while decoupling…
You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is…
During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?
You are auditing a design that uses JSON Web Tokens (JWTs) for stateless authentication. Which vulnerability is most critical if the 'alg: none' attack is possible?
During threat modeling, you are asked to classify data sensitivity. Which outcome is the primary goal of this activity?
When conducting a secure design review, which activity provides the most insight into potential session management vulnerabilities?
During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?