(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) CSSLP Questions 151–198 | Page 3/3

151

Multi-Selecthard

When designing for auditability, which THREE of the following pieces of information should be captured in security logs?

Select 3 answers

A.The full password of the user involved in the event.

B.The type of action performed.

C.The user's home address and phone number.

D.User identity or service account identifier.

E.The timestamp and success/failure status of the action.

AnswersB, D, E

Essential for understanding the activity.

Why this answer

Who (user/service), what (action), and result (success/failure) are mandatory for reconstruction.

Full explanation →

152

MCQeasy

When designing an API, which approach best supports the 'Complete Mediation' principle?

A.Relying on the frontend to filter out unauthorized menu items.

B.Checking authorization only once at the beginning of the user session.

C.Allowing public access to all GET methods in the API.

D.Verifying authorization on every single API request.

AnswerD

Ensures every interaction is authorized against current policy.

Why this answer

Complete mediation requires that every access to every object be checked for authority.

Full explanation →

153

MCQeasy

When gathering requirements for a new healthcare application, which regulation must be consulted to ensure the proper handling of Protected Health Information (PHI)?

A.GDPR

B.FISMA

C.HIPAA

D.SOX

AnswerC

HIPAA sets the requirements for protecting PHI within healthcare software.

Why this answer

HIPAA (Health Insurance Portability and Accountability Act) is the primary regulation for securing PHI in the United States.

Full explanation →

154

Multi-Selectmedium

Which TWO of the following are common challenges when implementing IAST?

Select 2 answers

A.Requirement for full source code access.

B.Inability to find vulnerabilities in unreachable code.

C.Lack of false positives.

D.Difficulty in installing agents on client machines.

E.Performance overhead on the application.

AnswersB, E

IAST can only see what executes during testing.

Why this answer

IAST implementation challenges typically revolve around performance overhead and compatibility with the application stack.

Full explanation →

155

MCQhard

An organization is concerned about 'Typosquatting' in their build system. Which strategy is most effective at preventing the accidental inclusion of malicious, similarly-named packages?

A.Rely on the developer's ability to check spelling.

B.Configure an allowlist-only proxy repository.

C.Increase the frequency of penetration tests.

D.Enable two-factor authentication on developer accounts.

AnswerB

If it is not on the allowlist, it cannot be downloaded.

Why this answer

Using a private proxy/repository that only allows an approved 'allowlist' of packages prevents developers from pulling typosquatted packages from public registries.

Full explanation →

156

MCQhard

You are implementing a Software Bill of Materials (SBOM) using the CycloneDX standard for your CI/CD pipeline. Which of the following fields is mandatory to uniquely identify an individual component within the SBOM to ensure accurate vulnerability tracking?

A.hash-algorithm

B.author-email

C.license-id

D.purl

AnswerD

purl provides the standardized format for component identification.

Why this answer

The purl (Package URL) is the standard identifier in CycloneDX for mapping components to vulnerability databases like the NVD.

Full explanation →

157

MCQhard

You are auditing a SAST tool's findings for a Java application. The tool flags a potential XSS in a JSP file, but the output is encoded using a library. How should you classify this finding?

A.Informational.

B.Mitigated / False Positive.

C.null

D.Confirmed Vulnerability.

E.Critical.

AnswerB

Proper encoding effectively mitigates XSS risk.

Why this answer

If the application uses proper context-aware encoding, the vulnerability is mitigated; the SAST tool likely flagged the use of a sink without verifying the preceding encoding.

Full explanation →

158

MCQeasy

Which cryptographic practice is recommended for protecting sensitive data at rest in a relational database?

A.Using cleartext with database permissions

B.Using MD5 hashing

C.Using AES-256 encryption

D.Storing data in base64 encoding

AnswerC

AES-256 is the current standard for secure encryption.

Why this answer

AES-256 is the industry standard for symmetric encryption of data at rest.

Full explanation →

159

Multi-Selectmedium

Which THREE of the following activities should be included in a Secure Software Lifecycle Management plan?

Select 3 answers

A.Requiring developers to use only one specific programming language.

B.Providing secure coding training to developers.

C.Conducting periodic risk assessments of applications.

D.Buying insurance for all cyber incidents.

E.Defining requirements for audit logging and monitoring.

AnswersB, C, E

Training is a proactive measure for lifecycle management.

Why this answer

Risk assessment, secure coding training, and audit logging requirements are all essential management activities in the SDLC.

Full explanation →

160

Multi-Selecteasy

Which TWO of the following are essential components of an effective Vendor Security Assessment program?

Select 2 answers

A.Physical inspection of the vendor's data center.

B.Mandatory integration of your internal tools with the vendor.

C.Review of third-party audit reports (e.g., SOC 2, ISO 27001).

D.Standardized vendor security questionnaires.

E.Requiring the vendor to use your internal developers.

AnswersC, D

Leverages independent verification of security controls.

Why this answer

Effective programs combine standardized assessment questionnaires with a review of objective evidence, such as third-party audit reports (SOC 2).

Full explanation →

161

Multi-Selecthard

Which TWO of the following are required to successfully implement a secure logging mechanism?

Select 2 answers

A.Log every single user mouse movement

B.Send logs to a publicly accessible bucket

C.Filter sensitive data before logging

D.Store logs in a tamper-evident system

E.Disable all logging to improve performance

AnswersC, D

Correct - prevents leakage of PII/credentials.

Why this answer

Sensitive data must be filtered, and logs must be stored in a secure, tamper-evident location.

Full explanation →

162

MCQhard

In an OAuth 2.0 flow, you are using the 'Authorization Code' grant type. You notice an attacker is attempting to intercept the code. Which security concept is being utilized by requiring the client_secret during the token exchange?

A.Availability

B.Non-repudiation

C.Confidentiality

D.Authentication

E.Integrity

AnswerD

Authentication verifies the identity of the client application.

Why this answer

The client_secret provides authentication of the client to the authorization server, ensuring only the intended client can exchange the code.

Full explanation →

163

MCQhard

You are managing requirements for a distributed microservices application. You need to ensure that service-to-service communication is encrypted. Which requirement type best categorizes this constraint?

A.Non-functional security requirement

B.Functional requirement

C.Business rule

D.Use case description

AnswerA

Encryption constraints are properties of the system architecture that qualify as non-functional requirements.

Why this answer

Security requirements are often classified as non-functional requirements because they define how the system performs or behaves rather than what specific business function it provides.

Full explanation →

164

Multi-Selecthard

Which THREE security controls are essential when implementing a 'Secure CI/CD' pipeline?

Select 3 answers

A.Using a secure credential vault to inject secrets at runtime.

B.Scanning source code for vulnerabilities using SAST tools.

C.Granting 'Admin' privileges to all developers on the CI/CD server.

D.Isolating build runners in a restricted network segment.

E.Storing pipeline secrets in plain text within the Jenkinsfile.

AnswersA, B, D

Vaults are necessary for managing access to sensitive deployment keys.

Why this answer

Pipeline security requires securing the build environment, scanning the artifacts, and protecting the credentials used for deployment.

Full explanation →

165

Multi-Selecteasy

Which TWO aspects of the software deployment process directly impact the 'Confidentiality' of the application data?

Select 2 answers

A.The speed at which the deployment occurs.

B.The number of instances deployed in the auto-scaling group.

C.The use of secure vaulting mechanisms for application secrets and keys.

D.The color scheme used in the application UI.

E.Enforcing TLS/SSL for all data in transit between components.

AnswersC, E

Secrets management prevents unauthorized access to sensitive data.

Why this answer

Data encryption during transit and the management of secrets are critical for maintaining confidentiality.

Full explanation →

166

MCQeasy

You are eliciting security requirements for an application that must comply with PCI-DSS. What is the most effective way to identify the scope of the systems requiring the highest level of security?

A.Perform a network vulnerability scan

B.Map the data flow of credit card information

C.Review the application source code

D.Update the firewall rule set

AnswerB

Mapping data flows identifies exactly which components interact with sensitive data, defining the compliance scope.

Why this answer

PCI-DSS requires identifying the Cardholder Data Environment (CDE) to define the scope of compliance, which is the most critical first step.

Full explanation →

167

MCQhard

When configuring a custom scan in Nessus to identify vulnerabilities in a web-based management interface, which setting is essential for deep authenticated scanning?

A.Disabling the 'Plugin' set for OS detection.

B.Enabling 'Safe Checks' in the policy settings.

C.Providing the 'Authentication' credentials in the 'Web Applications' section.

D.Configuring the 'Port Scanner' to only scan port 80.

E.null

AnswerC

Without valid authentication, a scanner only sees the public login page.

Why this answer

Nessus needs credentials (HTTP/HTML form authentication) to access protected pages to perform a full vulnerability assessment.

Full explanation →

168

Multi-Selecteasy

When evaluating a secure design, which TWO of the following practices are considered essential for secure session management?

Select 2 answers

A.Allowing multiple simultaneous sessions for a single user.

B.Using long-lived sessions to improve user experience.

C.Setting the HttpOnly and Secure flags on session cookies.

D.Storing session tokens in the browser's local storage.

E.Regenerating the session ID after a successful login.

AnswersC, E

Prevents cookie theft and plaintext transit.

Why this answer

Using secure, HTTP-only, and SameSite flags are critical for cookie security, and regenerating session IDs prevents fixation.

Full explanation →

169

Multi-Selecthard

Which THREE of the following represent effective 'Shift-Left' strategies for secure software lifecycle management?

Select 3 answers

A.Integrating security linting into the IDE.

B.Performing security design reviews before coding begins.

C.Conducting post-deployment vulnerability scanning.

D.Conducting static analysis (SAST) during the development phase.

E.Relying solely on external bug bounty programs.

AnswersA, B, D

IDE plugins provide the fastest feedback for developers.

Why this answer

Static analysis, secure design reviews, and IDE-integrated tools all move security activities earlier into the developer workflow.

Full explanation →

170

Multi-Selecthard

In threat modeling, which THREE categories are explicitly defined by the STRIDE methodology?

Select 3 answers

A.Tampering

B.Repudiation

C.Encryption

D.Spoofing

E.Identification

AnswersA, B, D

This is a valid STRIDE category.

Why this answer

STRIDE categories are Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

Full explanation →

171

MCQmedium

A security auditor reviews your code and flags that you are using 'hardcoded cryptographic keys' in the source repository. Which security concept is being violated?

A.Availability

B.Confidentiality

C.Non-repudiation

D.Integrity

E.Accounting

AnswerB

Exposing keys in source code leads to a breach of secret material, violating confidentiality.

Why this answer

Hardcoded keys violate confidentiality because the keys are exposed to anyone with access to the source code.

Full explanation →

172

Multi-Selectmedium

Which TWO of the following are effective strategies to prevent Cross-Site Scripting (XSS)?

Select 2 answers

A.Relying on antivirus software

B.Disabling cookies

C.Using insecure HTML comments

D.Using a Content Security Policy (CSP)

E.Context-aware output encoding

AnswersD, E

Correct - prevents execution of unauthorized scripts.

Why this answer

Context-aware encoding and CSP are the most effective defenses against XSS.

Full explanation →

173

MCQmedium

Your application uses digital signatures to confirm the sender of a message. Which security goal is primarily achieved?

A.Authorization

B.Encryption

C.Availability

D.Non-repudiation

E.Confidentiality

AnswerD

A digital signature prevents a sender from denying the message origin.

Why this answer

Digital signatures are the standard mechanism for proving authenticity and non-repudiation.

Full explanation →

174

MCQmedium

When performing a threat model using the STRIDE methodology, which component are you analyzing when you evaluate the risk of an attacker sniffing traffic between a client and the web server?

A.Elevation of Privilege.

B.Tampering.

C.Information Disclosure.

D.Spoofing.

AnswerC

Information Disclosure occurs when unauthorized parties gain access to sensitive data.

Why this answer

STRIDE stands for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Sniffing traffic is categorized as Information Disclosure.

Full explanation →

175

MCQeasy

When setting up operational monitoring, what is the 'Golden Signal' that specifically indicates a potential Denial of Service (DoS) attack?

A.An increase in the number of developers logged into the system.

B.A decrease in CPU utilization across all servers.

C.A significant increase in the rate of 5xx errors and request latency.

D.A reduction in database write operations.

AnswerC

High error rates and latency often result from resource exhaustion during a DoS attack.

Why this answer

A sudden spike in error rates or latency, combined with high request volume, is a primary indicator of a DoS attack.

Full explanation →

176

MCQeasy

When performing automated security testing, which of the following is considered a 'false positive'?

A.The scanner reports a vulnerability that is not present in the application.

B.The scanner misses an existing vulnerability.

C.The scanner causes the application to crash.

D.The scanner reports a vulnerability that is already fixed.

E.null

AnswerA

This is the definition of a false positive.

Why this answer

A false positive is a report of a vulnerability that does not actually exist in the target application.

Full explanation →

177

Multi-Selectmedium

Which THREE actions are essential for ensuring a secure Incident Response process for deployed software?

Select 3 answers

A.Maintaining an updated contact list and clear incident escalation paths.

B.Allowing the threat actor to continue accessing the system to observe their tactics.

C.Immediately deleting all production logs to hide the incident from auditors.

D.Conducting a post-mortem analysis to identify root causes and improve future security.

E.Isolating the affected systems to prevent the spread of the attack.

AnswersA, D, E

Preparation ensures a rapid and organized response.

Why this answer

Preparation, containment, and post-incident analysis are critical phases for managing security incidents effectively.

Full explanation →

178

MCQmedium

A developer is implementing a REST API. To prevent Mass Assignment vulnerabilities, what should be enforced during the model binding process?

A.Use Data Transfer Objects (DTOs) to restrict input

B.Disable SSL on the API endpoint

C.Increase the request timeout

D.Store user passwords in plaintext

AnswerA

DTOs act as an allow-list for fields, preventing unauthorized property injection.

Why this answer

Mass assignment occurs when input fields are mapped directly to database objects; using Data Transfer Objects (DTOs) allows explicit control over allowed fields.

Full explanation →

179

Multi-Selectmedium

Which TWO security monitoring strategies should be implemented to secure an application during its operational lifecycle?

Select 2 answers

A.Share all internal server IP addresses in the public DNS records.

B.Implement centralized log aggregation with automated alerting for security events.

C.Enforce strict egress filtering policies to block communication with unknown IP addresses.

D.Permit all inbound traffic on port 80 to ensure maximum availability.

E.Disable all egress traffic from the application servers to prevent data exfiltration.

AnswersB, C

Centralized logging is required for observability and incident response.

Why this answer

Log monitoring and egress filtering are essential for detecting and containing active threats in production.

Full explanation →

180

MCQmedium

You are analyzing an application to prevent unauthorized API access. Which requirement elicitation technique is best suited to identify potential entry points that an attacker might exploit?

A.User Story Mapping

B.Abuse Case Modeling

C.Compliance Gap Analysis

D.Cost-Benefit Analysis

AnswerB

Abuse cases help identify how a user might maliciously leverage an API endpoint.

Why this answer

Abuse case analysis is specifically focused on identifying entry points and malicious usage paths during the requirements phase.

Full explanation →

181

MCQmedium

Which metric is most useful to measure the effectiveness of a secure SDLC program over time?

A.Total number of lines of code written.

B.Number of developers on the team.

C.Mean Time to Remediate (MTTR) for vulnerabilities.

D.Budget allocated to security tools.

AnswerC

This is a key performance indicator for security lifecycle management.

Why this answer

Mean Time to Remediate (MTTR) tracks how quickly security vulnerabilities are addressed, reflecting both the efficiency of the remediation process and the maturity of the security program.

Full explanation →

182

Multi-Selectmedium

Which TWO of the following are primary benefits of including security requirements early in the SDLC?

Select 2 answers

A.Reduces the total cost of remediation

B.Ensures security architecture is aligned with business requirements

C.Eliminates the need for penetration testing

D.Reduces the amount of documentation required

E.Allows for the removal of all security testing

AnswersA, B

Fixing defects early is significantly cheaper.

Why this answer

Early integration reduces cost and ensures security is baked into the architecture, not bolted on.

Full explanation →

183

MCQeasy

Which of the following describes the purpose of 'misuse case' modeling?

A.To ensure user interface guidelines are followed

B.To describe scenarios where the system is used to cause harm

C.To identify all potential bugs in the code

D.To document the project timeline

AnswerB

This is the core definition of a misuse case in security requirements engineering.

Why this answer

Misuse cases identify threats by describing how an actor can misuse the system to create a negative impact.

Full explanation →

184

MCQhard

You are configuring Checkmarx for a .NET application. The scan results consistently miss vulnerabilities in a third-party DLL. What is the most likely reason?

A.The vulnerability is a logic error that static analysis cannot find.

B.The .NET framework version is set incorrectly in the project settings.

C.The scan engine is set to 'Quick Scan' mode.

D.The third-party DLL is not configured as a source project or included in the scan scope.

E.null

AnswerD

SAST tools need access to code or dependencies to perform data flow analysis.

Why this answer

Checkmarx requires binary/source access for full scanning; if the third-party DLL is not included as a source or dependency project, it cannot be analyzed effectively.

Full explanation →

185

Multi-Selectmedium

Which TWO of the following are examples of how software can maintain 'Integrity'?

Select 2 answers

A.Encrypting data at rest using AES.

B.Ensuring the server is always online.

C.Using cryptographic hash functions (e.g., SHA-256) to verify file contents.

D.Implementing strong access control lists (ACLs) to prevent unauthorized writes.

E.Forcing users to change passwords regularly.

AnswersC, D

Hashes detect unauthorized changes.

Why this answer

Integrity is maintained through mechanisms that ensure data is not tampered with.

Full explanation →

186

MCQeasy

What is the primary security benefit of using a hardened container base image for microservices?

A.It reduces the attack surface

B.It increases execution speed

C.It automatically encrypts application logs

D.It eliminates the need for patching

AnswerA

Removing unused tools makes it harder for an attacker to escalate privileges.

Why this answer

Hardened images remove unnecessary binaries and shells, reducing the attack surface for potential exploits.

Full explanation →

187

MCQhard

A government client requires that all software be validated against FIPS 140-3 standards. During requirements gathering, what is the most important step for the cryptographic module implementation?

A.Ensure all cryptographic modules are FIPS-validated

B.Implement multi-party authorization

C.Develop custom encryption algorithms

D.Encrypt all databases at rest

AnswerA

Compliance requires the specific modules to be certified as meeting the FIPS standard.

Why this answer

FIPS 140-3 validates the specific cryptographic modules used; therefore, the requirement must mandate the use of pre-validated modules.

Full explanation →

188

Multi-Selectmedium

When designing a secure API, which THREE of the following practices are part of a 'defense in depth' strategy?

Select 3 answers

A.Enforcing mutual TLS (mTLS) for authentication.

B.Implementing rate limiting at the API gateway.

C.Hardcoding API keys in the code for efficiency.

D.Relying solely on the WAF for security.

E.Implementing input validation for all parameters.

AnswersA, B, E

Provides strong identity and transport security.

Why this answer

Input validation, rate limiting, and mTLS are three different layers of defense protecting the API.

Full explanation →

189

Multi-Selecthard

When implementing a 'Zero Trust' architecture in software design, which THREE principles are fundamental?

Select 3 answers

A.Assume breach

B.Trust but verify

C.Use least privilege access

D.Trust all internal network traffic

E.Verify explicitly

AnswersA, C, E

Operate with the mindset that an attacker is already present.

Why this answer

Zero trust assumes no implicit trust and requires constant verification.

Full explanation →

190

Multi-Selectmedium

Which TWO of the following practices are key components of a robust Software Security Governance framework?

Select 2 answers

A.Outsourcing all security tasks to third-party vendors.

B.Mandating that all developers become certified hackers.

C.Discontinuing all legacy applications.

D.Establishing and tracking security performance metrics.

E.Defining clear security policies and standards.

AnswersD, E

Metrics ensure that the governance program is effective and improving.

Why this answer

Policy definition and measurable security metrics are foundational for governing software security activities.

Full explanation →

191

MCQhard

A developer is using an ORM (Object-Relational Mapping) framework. What risk remains even when using built-in ORM features?

A.Cross-Site Scripting

B.Brute force attacks

C.Buffer overflows

D.SQL Injection through unsafe raw queries

AnswerD

Using raw query functions with dynamic strings bypasses ORM protections.

Why this answer

Even with ORMs, developers can introduce SQL injection if they dynamically construct queries using string concatenation inside the ORM's raw query methods.

Full explanation →

192

MCQmedium

You are configuring a SAST tool to run in your CI/CD pipeline. To minimize developer friction, which strategy should you use?

A.Disable all rules except for critical-level vulnerabilities.

B.Perform incremental scans of the changed code.

C.Run full scans on every single commit.

D.Set the tool to break the build for every warning.

AnswerB

This minimizes latency and keeps feedback loops short.

Why this answer

Incremental scanning focuses on the changed code rather than the entire codebase, significantly reducing the scan time and the number of alerts presented to developers in every build.

Full explanation →

193

MCQhard

You are applying the Bell-LaPadula model to a secure software system. A user with 'Secret' clearance attempts to write data to a 'Top Secret' file. Based on the *-property, what is the outcome?

A.The write is denied because the *-property prohibits writing to a higher security level.

B.The write is permitted.

C.The write is denied due to the no-write-down rule.

D.The system allows the write only if encryption is used.

AnswerA

The *-property prevents a user from writing to a higher level to prevent information flow leakage.

Why this answer

The *-property (star-property) of Bell-LaPadula prevents 'write-down', meaning a subject cannot write to a lower level, but also enforces no-read-up/no-write-down rules.

Full explanation →

194

MCQeasy

What is the goal of implementing a Software Bill of Materials (SBOM) in your development lifecycle?

A.To increase the speed of software compilation.

B.To automatically patch vulnerabilities in code.

C.To replace the need for secure coding training.

D.To maintain transparency of components and manage dependency risks.

AnswerD

This is the core objective of SBOMs for supply chain visibility.

Why this answer

An SBOM provides a comprehensive list of all third-party and open-source components, facilitating vulnerability management and supply chain security.

Full explanation →

195

Multi-Selectmedium

Which TWO actions should be taken when preparing a software build for a secure production deployment?

Select 2 answers

A.Embed hardcoded credentials for the database in the build artifact to ensure connectivity.

B.Bypass unit tests to speed up the deployment pipeline.

C.Perform a Software Composition Analysis (SCA) to identify vulnerable dependencies.

D.Sign the final build artifact using a secure private key.

E.Compile the code with debugging symbols enabled for easier production troubleshooting.

AnswersC, D

SCA is critical for managing open-source risk.

Why this answer

Software composition analysis and signing are essential for verifying the integrity and security of the third-party components and the final artifact.

Full explanation →

196

MCQhard

When assessing a SaaS provider's supply chain, you are concerned about their 'Vendor Risk Management' (VRM) program. Which practice indicates a mature approach to fourth-party risk?

A.The vendor provides a generic privacy policy.

B.The vendor maintains an inventory of their critical fourth-party service providers.

C.The vendor only uses software developed internally.

D.The vendor uses a public cloud provider.

AnswerB

Managing fourth-party risk is a hallmark of mature supply chain security.

Why this answer

A mature VRM program includes visibility into the vendor's sub-processors (fourth parties), as these are the vendors of your vendor, and represent a significant blind spot.

Full explanation →

197

MCQeasy

When performing a penetration test on an API, which tool is best suited for identifying broken object level authorization (BOLA)?

A.SQLmap.

B.null

C.Postman.

D.Nmap.

E.Wireshark.

AnswerC

Postman allows for easy manipulation of request parameters to test BOLA.

Why this answer

Postman or Burp Suite are used to manually manipulate IDs in API requests to see if unauthorized access is granted to other objects.

Full explanation →

198

MCQhard

When implementing file uploads, which practice is most effective in preventing remote code execution (RCE)?

A.Storing files outside the web root and renaming them

B.Checking the file size

C.Validating the file extension only

D.Enabling execution permissions on the upload folder

AnswerA

This prevents direct execution of uploaded files by the web server.

Why this answer

Renaming files and storing them outside the web root prevents attackers from executing malicious scripts they have uploaded.

Full explanation →

(ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) (CSSLP) (CSSLP) — Questions 151–198