(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) (CSSLP) — Questions 1–75

During a threat model, you identify a risk related to 'Broken Access Control'. Which design mitigation is best suited for this?

When managing software security governance, which document should define the organization's high-level security expectations for all software development projects?

An application utilizes the Clark-Wilson integrity model. Which mechanism does it use to ensure that subjects only perform authorized operations on objects?

A developer is configuring a web application to use the principle of least privilege. Which action best aligns with this philosophy?

In a DevSecOps pipeline, which TWO of the following are critical for ensuring the integrity of the software supply chain?

A team is using SonarQube to enforce secure coding standards. Which analysis approach is required to detect vulnerabilities related to improper handling of sensitive information in logs?

During an incident response, you identify that a threat actor has gained unauthorized access to an application's environment variables. What is the immediate correct step to take regarding credential management?

You are implementing 'Blue-Green' deployment. What is the most critical security step to perform during the cut-over process?

When designing an automated pipeline to prevent supply chain attacks, which THREE of the following features should be included in your artifact registry?

Which phase of the SDLC is the most appropriate for conducting a formal security review of the system's design documentation?

When implementing the Biba Integrity Model, which operation is restricted for a subject to maintain the integrity of a higher-level object?

Which THREE factors should be considered when prioritizing findings from a DAST scan?

To ensure secure deployment of software artifacts, you must verify the integrity of the binaries. Which mechanism is most effective for ensuring that artifacts have not been tampered with since they were signed by the build system?

When evaluating software security governance, which TWO of the following are necessary to ensure security alignment with business goals?

When managing third-party libraries, why is a Software Bill of Materials (SBOM) essential?

What is the primary function of a 'Vulnerability Disclosure Policy' (VDP) in a vendor's secure development lifecycle?

Your development team is integrating a new third-party library via npm. To prevent dependency confusion attacks where a malicious package is pulled from a public registry instead of your internal private registry, which configuration should be applied?

In a cloud-native environment, which design practice minimizes the impact of a compromised container?

When designing a system that must satisfy both HIPAA and local privacy laws, which requirement approach is most appropriate?

Which design principle is exemplified by implementing a Web Application Firewall (WAF) to inspect incoming traffic before it hits the application logic?

You are designing a fuzz testing strategy for a binary protocol parser. Which type of fuzzing is most effective for discovering memory corruption vulnerabilities in this component?

When integrating security into an Agile environment, which THREE of the following activities are considered essential for maintaining security velocity?

During IAST implementation in a CI/CD pipeline, the agent reports a high number of false positives regarding SQL injection. What is the most likely cause?

You notice that your build server environment pulls Docker images from a public registry with the ':latest' tag. Why is this a major supply chain security flaw?

Which TWO methods are effective in hardening the production environment against 'Zero-Day' vulnerabilities?

When setting up a penetration testing lab for a web application, which THREE network configurations are recommended?

What is the primary goal of the 'Principle of Least Privilege' (PoLP)?

During a STRIDE threat modeling session for an API gateway, you identify a risk where an attacker could intercept data in transit. Which design pattern effectively mitigates this?

What is the primary benefit of conducting a security-focused 'Lessons Learned' meeting after a software incident?

Which TWO of the following are crucial when performing a manual code review for security?

You are leading a threat modeling session for a new cloud-native application. You identify a potential threat where an attacker attempts to inject malicious SQL queries into the search bar. Which technique should you employ to document this behavior during the Secure Software Requirements phase?

To protect against a compromised build pipeline, which TWO of the following configurations should be implemented to ensure 'Hermetic Builds'?

A company is implementing a Secure SDLC. Which phase is the most appropriate to start defining security test cases?

When designing an application that requires secret management (e.g., API keys, database credentials), which design pattern is considered most secure?

When performing a vendor security assessment for a new SaaS product, which THREE of the following should be requested to evaluate their supply chain resilience?

A security auditor is using OWASP ZAP and wants to perform an authenticated scan. Which ZAP feature should they use to maintain the session across different scan requests?

A security team implements a 'Separation of Duties' policy in the CI/CD pipeline. Which implementation is correct?

You are designing a web application and need to ensure the Principle of Least Privilege is applied to database access. Which approach best satisfies this requirement?

Which TWO of the following are recognized components of the 'Confidentiality, Integrity, and Availability' (CIA) triad?

When designing a test case for secure API authentication, which THREE elements should be included?

Which TWO of the following represent common output formats for security testing reports?

Which THREE of the following are recognized techniques for minimizing the attack surface of an API?

You are integrating security into a Scrum-based SDLC. The team wants to use the 'Definition of Done' (DoD) to ensure security compliance. Which action most effectively embeds security into the sprint cycle?

You are auditing a web application for insecure deserialization. Which language-specific feature is most commonly the source of this vulnerability?

Which of the following is a primary objective of 'Secure Configuration Management' in the software lifecycle?

You are utilizing GitHub Actions for CI/CD and need to prevent secrets from being committed to the repository. Which approach is most effective for a DevSecOps workflow?

When utilizing a third-party library, what is the best strategy to minimize security risks during the build process?

A developer wants to ensure that a web application is resistant to SQL injection. Which test case should be included in the automated test suite?

Your team is adopting a 'Secure by Default' posture. Which design requirement should be included in the development specification?

Which TWO of the following practices are recommended when performing fuzz testing on a web service?

In a service-oriented architecture (SOA), which design pattern is most effective for ensuring that messages between services are not tampered with?

A stakeholder requests a feature that allows users to bypass password complexity requirements for 'internal testing accounts.' As a CSSLP, what is your first step in requirements analysis?

A security engineer is analyzing a report from a SAST tool (e.g., Fortify). A finding is marked as 'Low Confidence'. What does this imply?

Your team is using OWASP SAMM to evaluate security maturity. Which category specifically addresses the process of ensuring that security activities are integrated into the SDLC?

You are using the 'Complete Mediation' principle in your system's access control design. What does this require?

Which TWO of the following design choices mitigate the risk of 'Broken Object-Level Authorization' (BOLA)?

You are performing a fuzzing campaign on a REST API. The API uses JSON Web Tokens (JWT). What is the most effective way to include these tokens in the fuzzer input?

You are auditing your software deployment process. Which practice is best to prevent 'Dependency Confusion' attacks where malicious packages are pulled from public registries instead of internal ones?

You are designing a system to comply with 'Fail-Safe Defaults'. Which configuration best reflects this?

You are reviewing a Node.js web application. Which secure coding practice directly mitigates Cross-Site Scripting (XSS) when rendering user-supplied data in an EJS template?

Which design activity helps identify security requirements during the earliest phases of the SDLC?

Which of the following is a key component of a 'Secure Software Deployment' plan?

You are implementing CI/CD pipelines using Jenkins. You need to ensure that container images are scanned for vulnerabilities before they are promoted to production. Which tool integration is most effective for this stage?

Which TWO of the following are primary benefits of integrating SAST into the early stages of the SDLC?

Which THREE of the following are effective methods to prevent SQL Injection in a database-driven application?

An organization is adopting the SLSA (Supply-chain Levels for Software Artifacts) framework. To achieve Level 3, what requirement must be met regarding the build platform?

You are implementing 'Psychological Acceptability' in a new multi-factor authentication system. Which design choice is most appropriate?

Which THREE items should be included in a 'Security Requirements Traceability Matrix'?

A supplier asks you to describe your 'Supply Chain Security Policy'. What is the most appropriate foundational element to include?

When designing a test case for a secure authentication bypass, which THREE areas should be covered?

When conducting a static code analysis for a C++ application, which memory management error is best detected by tools like Fortify or Coverity?

Which role is typically responsible for identifying security requirements during the initial phases of the software development lifecycle?

You are determining compliance requirements for a software product that handles PII. Which requirement is essential for demonstrating 'Privacy by Design'?

Which THREE categories are typically used to classify security requirements?

You are evaluating container orchestration security. What is the purpose of a 'Sidecar Container' in a Service Mesh?