Certified Secure Software Lifecycle Professional (CSSLP) — Questions and Answers

Question 1: A test that verifies the application correctly enforces access restrictions (e.g., a regular user cannot access admin functions) is called:

Availability testing
Authorization testing (Correct answer)
Functional testing
Authentication testing

Correct answer: Authorization testing

Authorization testing specifically checks that the application enforces proper access controls, ensuring users can only access resources and perform actions they are permitted to.

Question 2: Which term describes the process of breaking down complex security requirements into smaller, actionable components?

Risk decomposition
Security partitioning
Threat modeling
Requirements decomposition (Correct answer)

Correct answer: Requirements decomposition

Requirements decomposition breaks high-level security requirements into specific, testable, and implementable components that can be assigned to development teams.

Question 3: What is the purpose of requirements traceability in secure software development?

To track bugs from development to production
To link security requirements to design decisions, code, and tests ensuring nothing is missed (Correct answer)
To monitor runtime behavior of deployed applications
To manage software licensing compliance

Correct answer: To link security requirements to design decisions, code, and tests ensuring nothing is missed

Requirements traceability ensures every security requirement can be traced forward to its implementation and test cases, confirming all requirements are addressed.

Question 4: Which disposal technique renders data on storage media unrecoverable by overwriting it multiple times with random data?

Physical destruction
Secure wiping/overwriting (Correct answer)
Cryptographic erasure
Degaussing

Correct answer: Secure wiping/overwriting

Secure overwriting (data wiping) replaces existing data with random or patterned bit sequences multiple times, making recovery impractical without physical destruction.

Question 5: Which secure design principle advocates for simplicity in security mechanisms to reduce the chance of flaws?

Separation of privilege
Economy of mechanism (Correct answer)
Least common mechanism
Fail securely

Correct answer: Economy of mechanism

Economy of mechanism states that security designs should be as simple as possible, since complex designs are harder to analyze, implement correctly, and verify.

Question 6: When assessing a cloud service provider (CSP) as part of software acquisition, which document provides a standardized security assessment framework?

PCI PA-DSS report
GDPR Data Processing Agreement
SOC 2 Type II report (Correct answer)
ISO 9001 certification

Correct answer: SOC 2 Type II report

A SOC 2 Type II report provides an independent auditor's assessment of a service provider's security controls over a defined period, making it a key document for CSP security due diligence.

Question 7: Which attack category involves sending more data to a buffer than it can handle, potentially allowing code execution?

Cross-site scripting
SQL injection
Buffer overflow (Correct answer)
Directory traversal

Correct answer: Buffer overflow

A buffer overflow occurs when a program writes more data to a buffer than it can hold, which can overwrite adjacent memory and potentially allow an attacker to execute arbitrary code.

Question 8: What is a key security requirement for decommissioning a system that stored sensitive data?

Transferring all data to the replacement system before shutdown
Archiving all system logs to cold storage
Sanitizing all storage media to ensure no sensitive data can be recovered from decommissioned hardware (Correct answer)
Revoking only the service account credentials

Correct answer: Sanitizing all storage media to ensure no sensitive data can be recovered from decommissioned hardware

Before decommissioning, all storage media containing sensitive data must be sanitized using approved methods (overwriting, degaussing, or physical destruction) to prevent data recovery.

Question 9: What is the primary goal of penetration testing?

To verify that all unit tests pass in the CI/CD pipeline
To ensure compliance with coding standards
To measure application performance under high load
To actively exploit vulnerabilities in a controlled manner to assess the real-world impact of security weaknesses (Correct answer)

Correct answer: To actively exploit vulnerabilities in a controlled manner to assess the real-world impact of security weaknesses

Penetration testing simulates real attack scenarios to discover and demonstrate the exploitability of vulnerabilities and their potential business impact.

Question 10: What is the risk of using hard-coded credentials in source code?

Credentials can be extracted from code repositories or binaries, granting unauthorized access (Correct answer)
It slows down application startup
It causes incompatibility with modern authentication protocols
It prevents the application from scaling horizontally

Correct answer: Credentials can be extracted from code repositories or binaries, granting unauthorized access

Hard-coded credentials embedded in source code can be discovered through code repository access, reverse engineering, or accidental public exposure, leading to unauthorized system access.

Question 11: Which security property ensures that data has not been altered in an unauthorized manner?

Availability
Non-repudiation
Integrity (Correct answer)
Confidentiality

Correct answer: Integrity

Integrity ensures that data remains accurate and unaltered, detecting any unauthorized modifications made during storage or transmission.

Question 12: A security control that detects and alerts on attacks but does not prevent them is called:

Detective control (Correct answer)
Deterrent control
Preventive control
Corrective control

Correct answer: Detective control

Detective controls identify and record security incidents or policy violations but do not stop them from occurring, providing visibility for response activities.

Question 13: What is the primary goal of defense in depth?

Eliminate all vulnerabilities in software
Layer multiple security controls so that failure of one does not compromise the system (Correct answer)
Encrypt all data at rest and in transit
Perform regular penetration testing

Correct answer: Layer multiple security controls so that failure of one does not compromise the system

Defense in depth uses multiple overlapping security controls so that if one layer is bypassed, additional layers still protect the asset.

Question 14: A multi-tier architecture that separates presentation, business logic, and data storage is considered a best practice because it:

Reduces the need for authentication
Eliminates the need for input validation
Speeds up development by reducing code complexity
Limits the blast radius of a breach and enforces separation of concerns (Correct answer)

Correct answer: Limits the blast radius of a breach and enforces separation of concerns

Separating tiers means an attacker who compromises the presentation layer does not automatically gain access to the database, limiting damage and enabling independent security controls.

Question 15: What does 'test coverage' measure in software security testing?

The proportion of code paths, branches, or requirements exercised by the test suite (Correct answer)
The time required to complete a full security test cycle
The number of vulnerabilities found per test cycle
The percentage of requirements reviewed by the security team

Correct answer: The proportion of code paths, branches, or requirements exercised by the test suite

Test coverage metrics quantify how much of the application's code or functionality is exercised by tests, helping identify untested areas that may contain hidden vulnerabilities.

Question 16: Which supply chain attack technique involves injecting malicious code into a software update mechanism before it reaches end users?

Watering hole attack
Build pipeline compromise (Correct answer)
Session hijacking
SQL injection

Correct answer: Build pipeline compromise

Compromising the build pipeline allows an attacker to insert malicious code that gets distributed to all downstream users through legitimate update channels.

Question 17: What is the purpose of fuzz testing (fuzzing) in secure software development?

To measure code coverage of unit tests
To test software under simulated production load
To verify that UI elements render correctly across browsers
To automatically generate random or malformed inputs to discover crashes and security vulnerabilities (Correct answer)

Correct answer: To automatically generate random or malformed inputs to discover crashes and security vulnerabilities

Fuzzing sends unexpected, random, or malformed data to a program to find crashes, memory corruption, and security flaws that structured testing might miss.

Question 18: What does 'continuous monitoring' mean in the context of a federal information system's security authorization?

Performing annual security assessments as required by FISMA
Running automated scans only during scheduled maintenance windows
Monitoring only network traffic at the perimeter firewall
Ongoing assessment of security controls to maintain awareness of the system's security posture over time (Correct answer)

Correct answer: Ongoing assessment of security controls to maintain awareness of the system's security posture over time

NIST's continuous monitoring strategy requires ongoing assessment of security controls, change management, and status reporting to maintain situational awareness and authorization decisions.

Question 19: Which practice BEST mitigates the risk of malicious packages being introduced through open-source dependencies?

Using a private artifact repository with vetted, approved packages and automated vulnerability scanning (Correct answer)
Storing open-source packages on a USB drive disconnected from the internet
Prohibiting all use of open-source software
Requiring developers to manually review all open-source licenses

Correct answer: Using a private artifact repository with vetted, approved packages and automated vulnerability scanning

A private artifact repository with pre-approved packages and continuous vulnerability scanning creates a controlled supply chain gateway that prevents malicious or vulnerable packages from entering the build environment.

Question 20: What does the principle of 'secure defaults' mean in software implementation?

Security controls are enabled by default and users must explicitly disable them if needed (Correct answer)
The application defaults to the last known-good configuration after a crash
Security patches are applied automatically without user intervention
All security features are disabled by default to avoid user friction

Correct answer: Security controls are enabled by default and users must explicitly disable them if needed

Secure defaults means that out-of-the-box configurations are the most secure option, requiring administrators to consciously loosen security rather than having to add it.

Question 21: What is the purpose of configuration management in secure software operations?

To maintain a known, secure baseline of system configurations and control changes to them (Correct answer)
To manage user access provisioning
To schedule security patches automatically
To monitor application performance metrics

Correct answer: To maintain a known, secure baseline of system configurations and control changes to them

Configuration management establishes and maintains secure baselines for systems, ensuring that changes are tracked, authorized, and do not introduce security regressions.

Question 22: What does the term 'attack surface' refer to in software security?

The sum of all entry points where an attacker could try to enter or extract data (Correct answer)
The number of known CVEs in a codebase
The visual interface exposed to end users
The physical perimeter of a data center

Correct answer: The sum of all entry points where an attacker could try to enter or extract data

The attack surface is the total exposure of a system, including all interfaces, data paths, and code paths that an attacker could potentially exploit.

Question 23: Which testing technique systematically explores all possible input values and states to find edge cases that trigger security flaws?

Smoke testing
Boundary value analysis (Correct answer)
Regression testing
Load testing

Correct answer: Boundary value analysis

Boundary value analysis tests inputs at and around the boundaries of valid ranges, since off-by-one errors and buffer overflows often occur at these edges.

Question 24: Which contract clause BEST protects an organization if a software vendor suffers a security breach that exposes the organization's data?

Most-favored-nation pricing clause
Automatic renewal clause
Warranty disclaimer clause
Indemnification and breach notification clause (Correct answer)

Correct answer: Indemnification and breach notification clause

An indemnification and breach notification clause obligates the vendor to notify the organization of breaches and provides legal and financial recourse for resulting damages.

Question 25: In secure software development, what is a 'security user story'?

A vulnerability report in story format
An agile artifact describing a security requirement in terms of user roles, goals, and outcomes (Correct answer)
A use case written from a security analyst's perspective
A pen tester's narrative of an attack scenario

Correct answer: An agile artifact describing a security requirement in terms of user roles, goals, and outcomes

Security user stories apply the agile user story format to security requirements, expressing them as 'As a [role], I need [security feature] so that [security outcome].'

Question 26: Which practice helps prevent insecure deserialization vulnerabilities?

Use only stateless authentication mechanisms
Validate and sanitize serialized data, use integrity checks, and avoid deserializing data from untrusted sources (Correct answer)
Always use JSON instead of XML
Compress data before serializing it

Correct answer: Validate and sanitize serialized data, use integrity checks, and avoid deserializing data from untrusted sources

Insecure deserialization can allow attackers to manipulate serialized objects to achieve remote code execution, so all deserialized data from untrusted sources must be carefully validated.

Question 27: Which concept describes accepting a risk because the cost of mitigation exceeds the potential loss?

Risk reduction
Risk avoidance
Risk acceptance (Correct answer)
Risk transfer

Correct answer: Risk acceptance

Risk acceptance is a deliberate management decision to acknowledge a risk and take no action to mitigate it, typically when the cost of controls outweighs the potential impact.

Question 28: Which process ensures that software is deployed consistently and securely using automated, repeatable steps?

Continuous integration/continuous deployment (CI/CD) pipeline (Correct answer)
Blue-green deployment
Change advisory board (CAB) review
Manual deployment checklist

Correct answer: Continuous integration/continuous deployment (CI/CD) pipeline

A secure CI/CD pipeline automates building, testing, and deploying software with consistent security checks applied at every stage, reducing human error and ensuring repeatable deployments.

Question 29: Which technique allows an organization to verify that a software binary was compiled from a specific, unmodified source code version?

Penetration testing
Fuzz testing
Dynamic application security testing (DAST)
Reproducible builds (Correct answer)

Correct answer: Reproducible builds

Reproducible builds ensure that compiling the same source code with the same tools always produces bit-for-bit identical binaries, allowing independent verification that no tampering occurred during the build process.

Question 30: Which principle states that a system should default to a secure state when it fails or encounters an error?

Least privilege
Complete mediation
Open design
Fail securely (Correct answer)

Correct answer: Fail securely

Fail securely (or fail safe) ensures that when an error occurs, the system defaults to a secure state such as denying access rather than inadvertently allowing it.

Question 31: Which practice involves monitoring production systems continuously for signs of security incidents or anomalous behavior?

Code review
Vulnerability scanning
Penetration testing
Security information and event management (SIEM) (Correct answer)

Correct answer: Security information and event management (SIEM)

SIEM systems aggregate and correlate log data from across the environment in real time, generating alerts for suspicious patterns that may indicate a security incident.

Question 32: Which term describes a flaw or weakness in a system that could be exploited to violate security policy?

Risk
Vulnerability (Correct answer)
Threat
Exposure

Correct answer: Vulnerability

A vulnerability is a weakness in a system, application, or process that a threat actor could exploit to gain unauthorized access or cause harm.

Question 33: What is a race condition vulnerability in software?

A deadlock in multi-threaded applications
A flaw where the security outcome depends on the uncontrolled timing or ordering of concurrent events (Correct answer)
A performance bug caused by excessive memory allocation
A network timeout that exposes sensitive data

Correct answer: A flaw where the security outcome depends on the uncontrolled timing or ordering of concurrent events

A race condition (or TOCTOU - Time of Check to Time of Use) occurs when system behavior depends on the sequence or timing of uncontrollable events, potentially allowing security bypass.

Question 34: What is the OWASP-recommended approach for protecting sensitive data in web applications?

Classify data, apply encryption at rest and in transit, and minimize retention of sensitive data (Correct answer)
Store all sensitive data in client-side cookies with HttpOnly flag
Restrict sensitive data access to administrators only
Use Base64 encoding for all sensitive fields in the database

Correct answer: Classify data, apply encryption at rest and in transit, and minimize retention of sensitive data

OWASP recommends classifying sensitive data, using strong encryption both at rest and in transit, and not storing sensitive data beyond its necessary retention period.

Question 35: Which coding practice prevents cross-site scripting (XSS) attacks by transforming special HTML characters into their safe equivalents?

Output encoding (Correct answer)
Parameterized queries
Input sanitization
Input validation

Correct answer: Output encoding

Output encoding converts characters like '<', '>', and '&' into HTML entities before rendering them in the browser, preventing injected scripts from being executed.

Question 36: What is the MAIN security concern with using abandoned or unmaintained open-source libraries?

They violate software export control regulations
Newly discovered vulnerabilities will not receive patches, leaving applications permanently exposed (Correct answer)
They are incompatible with modern programming languages
They are more expensive to license than commercial alternatives

Correct answer: Newly discovered vulnerabilities will not receive patches, leaving applications permanently exposed

Unmaintained open-source libraries will not receive security patches for newly discovered vulnerabilities, creating a permanently unmitigated risk in any application that depends on them.

Question 37: In the context of secure software acquisition, what does 'security by contract' mean?

Purchasing commercial security software to protect organizational assets
Requiring vendors to sign non-disclosure agreements before sharing security information
Using contractual penalties as the sole mechanism to enforce software quality
Embedding specific, enforceable security requirements and obligations into vendor contracts (Correct answer)

Correct answer: Embedding specific, enforceable security requirements and obligations into vendor contracts

Security by contract means explicitly incorporating measurable security requirements, standards compliance, audit rights, and breach notification obligations into vendor agreements to make security legally enforceable.

Question 38: What is a common metric used to prioritize remediation of discovered vulnerabilities?

Lines of code affected
CVSS (Common Vulnerability Scoring System) score (Correct answer)
Age of the vulnerability
Number of user reports

Correct answer: CVSS (Common Vulnerability Scoring System) score

CVSS provides a standardized numerical score from 0 to 10 representing the severity of a vulnerability based on exploitability, scope, and impact, helping teams prioritize remediation.

Question 39: What is the primary purpose of a privacy policy in software development?

To document internal access control policies
To specify encryption algorithms used by the application
To describe how an organization collects, uses, and protects personal information (Correct answer)
To define incident response procedures

Correct answer: To describe how an organization collects, uses, and protects personal information

A privacy policy is a public statement that discloses how an organization gathers, uses, manages, and protects user personal data.

Question 40: A system that processes payment card data must comply with which standard?

HIPAA
SOX
FERPA
PCI DSS (Correct answer)

Correct answer: PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organizations that store, process, or transmit cardholder data.

Question 41: What is the purpose of a privacy impact assessment (PIA)?

To assess physical security of data centers
To identify and evaluate risks to personal information in a system (Correct answer)
To measure compliance with encryption standards
To test software performance under load

Correct answer: To identify and evaluate risks to personal information in a system

A PIA is a process used to evaluate how personally identifiable information is collected, used, shared, and maintained, identifying privacy risks and mitigation strategies.

Question 42: What does the CIA triad stand for in information security?

Control, Identity, Authentication
Confidentiality, Integrity, Availability (Correct answer)
Confidentiality, Identity, Assurance
Compliance, Integrity, Authorization

Correct answer: Confidentiality, Integrity, Availability

The CIA triad represents the three core security objectives: Confidentiality (preventing unauthorized disclosure), Integrity (ensuring data accuracy), and Availability (ensuring reliable access).

Question 43: What does IAST (Interactive Application Security Testing) combine?

Elements of SAST and DAST by instrumenting the application and monitoring it during runtime testing (Correct answer)
Threat modeling and penetration testing
Network scanning and host-based vulnerability assessment
Manual code review and automated scanning

Correct answer: Elements of SAST and DAST by instrumenting the application and monitoring it during runtime testing

IAST uses agents or instrumentation within the running application to detect vulnerabilities in real time as the application is exercised, combining the context of SAST with the runtime behavior of DAST.

Question 44: What is the main security concern with using third-party components or libraries in software development?

They are not compatible with modern encryption standards
They cannot be updated or patched by the development team
They always contain deliberate backdoors
They may introduce known or unknown vulnerabilities that affect the entire application (Correct answer)

Correct answer: They may introduce known or unknown vulnerabilities that affect the entire application

Third-party components may contain vulnerabilities, outdated dependencies, or insecure code that extends the application's attack surface beyond what the development team controls.

Question 45: Which activity is MOST critical when onboarding a new software development outsourcing partner?

Conducting security due diligence, establishing secure development requirements, and defining data handling protocols (Correct answer)
Allowing the partner to define their own security standards independently
Requiring the partner to use only the organization's IDE and version control tools
Sharing full access to the organization's production environment for testing

Correct answer: Conducting security due diligence, establishing secure development requirements, and defining data handling protocols

Thorough due diligence combined with clearly defined secure development requirements and data handling protocols establishes the security baseline and obligations before any code is written.

Question 46: What is the primary purpose of a business continuity plan (BCP) related to software systems?

To document software licensing agreements with vendors
To specify encryption standards for data at rest
To define how the software development team handles sprint planning
To ensure critical business functions can continue during and after a disruptive event (Correct answer)

Correct answer: To ensure critical business functions can continue during and after a disruptive event

A BCP identifies critical business functions and defines strategies to maintain or quickly restore those functions during disruptions, including alternate processing sites and manual workarounds.

Question 47: Which process involves systematically identifying and documenting all software assets and their versions in a production environment?

Vulnerability management
Release management
Software inventory management / asset management (Correct answer)
Change management

Correct answer: Software inventory management / asset management

Software asset management maintains an accurate inventory of all software deployed in the environment, enabling rapid identification of systems affected when new vulnerabilities are disclosed.

Question 48: Which HTTP header prevents a web page from being embedded in an iframe on another domain, protecting against clickjacking?

X-Frame-Options (Correct answer)
X-Content-Type-Options
Content-Security-Policy
Strict-Transport-Security

Correct answer: X-Frame-Options

The X-Frame-Options header (or the frame-ancestors directive in Content-Security-Policy) controls whether the browser allows the page to be displayed in a frame or iframe on another origin.

Question 49: What is the primary security risk of storing passwords as plain text in a database?

It prevents the application from enforcing password complexity
It consumes excessive storage space
A database breach exposes all user passwords directly, enabling immediate account takeover (Correct answer)
It makes password rotation more difficult

Correct answer: A database breach exposes all user passwords directly, enabling immediate account takeover

Plain text password storage means any unauthorized access to the database immediately exposes every user's credentials, which are often reused across other services.

Question 50: In the context of CSSLP, what is 'privacy by design'?

Adding privacy controls as an afterthought after development
Using obfuscation to hide user data from developers
Embedding privacy protections into the design of systems from the start (Correct answer)
Storing all PII in encrypted flat files

Correct answer: Embedding privacy protections into the design of systems from the start

Privacy by design is an approach where privacy protections are integrated into the architecture and design of systems from the very beginning rather than being added retroactively.

Question 51: Which U.S. executive order significantly elevated software supply chain security requirements for federal government software procurement?

Executive Order 14028 on Improving the Nation's Cybersecurity (Correct answer)
Executive Order 13636 on Improving Critical Infrastructure Cybersecurity
Executive Order 13587 on Structural Reforms to Improve the Security of Classified Networks
Executive Order 13800 on Strengthening the Cybersecurity of Federal Networks

Correct answer: Executive Order 14028 on Improving the Nation's Cybersecurity

EO 14028, signed in May 2021, specifically mandated enhanced software supply chain security practices including SBOM requirements, secure development attestations, and security testing for software sold to the federal government.

Question 52: Which framework provides guidelines specifically for managing cybersecurity risks within the supply chain and is published by NIST?

NIST SP 800-161 (Correct answer)
PCI DSS
OWASP Top 10
ISO/IEC 27001

Correct answer: NIST SP 800-161

NIST SP 800-161, 'Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations,' provides comprehensive guidance for managing supply chain cybersecurity risks.

Question 53: In secure software disposal, what is cryptographic erasure?

Encrypting files before deleting them from the filesystem
Destroying the encryption keys used to protect data, making encrypted data permanently unreadable (Correct answer)
Applying a one-way hash to all data before deletion
Using a crypto library to overwrite deleted file space

Correct answer: Destroying the encryption keys used to protect data, making encrypted data permanently unreadable

Cryptographic erasure renders data unrecoverable by destroying the encryption keys that protect it, since without the keys the encrypted data is effectively meaningless.

Question 54: What is the purpose of an interface design review in secure software development?

To review API performance characteristics
To evaluate user experience design
To assess database schema design
To identify trust boundaries and validate that security controls are applied at all interfaces (Correct answer)

Correct answer: To identify trust boundaries and validate that security controls are applied at all interfaces

Interface design reviews examine all points where data crosses trust boundaries to ensure input validation, authentication, and authorization controls are correctly applied.

Question 55: Which type of analysis tool automatically scans source code for security vulnerabilities without executing the program?

Runtime application self-protection (RASP)
Dynamic application security testing (DAST)
Static application security testing (SAST) (Correct answer)
Interactive application security testing (IAST)

Correct answer: Static application security testing (SAST)

SAST tools analyze source code, bytecode, or binaries at rest to find security flaws without running the application, enabling early detection in the development pipeline.

Question 56: A threat model that categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege is known as:

OCTAVE
PASTA
DREAD
STRIDE (Correct answer)

Correct answer: STRIDE

STRIDE is a threat modeling methodology developed by Microsoft that provides a structured way to identify and classify software threats.

Question 57: Which of the following best describes personally identifiable information (PII)?

Information that can be used to identify, contact, or locate a specific individual (Correct answer)
Encrypted data that cannot be read without a key
Any data transmitted over a network
Any data stored in a database

Correct answer: Information that can be used to identify, contact, or locate a specific individual

PII is any information that can be used on its own or in combination with other information to identify, contact, or locate a single person.

Question 58: A company is evaluating a commercial off-the-shelf (COTS) product. Which security activity is MOST important before deployment?

Replacing all authentication modules with custom implementations
Rewriting the COTS product's source code to remove vulnerabilities
Conducting a security assessment against defined security requirements and testing for known vulnerabilities (Correct answer)
Requiring the vendor to open-source the product

Correct answer: Conducting a security assessment against defined security requirements and testing for known vulnerabilities

Assessing the COTS product against security requirements and testing for known vulnerabilities allows the organization to make an informed risk acceptance decision before deployment.

Question 59: In cryptographic design, what is the purpose of a salt?

To increase encryption speed
To add random data to passwords before hashing, preventing precomputed hash attacks (Correct answer)
To extend the length of an encryption key
To compress data before encryption

Correct answer: To add random data to passwords before hashing, preventing precomputed hash attacks

A cryptographic salt is random data added to a password before hashing, ensuring that identical passwords produce different hash values and defeating rainbow table attacks.

Question 60: Which document formally defines the security requirements that a third-party software vendor must meet before their product can be integrated into an organization's environment?

Statement of Work (SOW)
Memorandum of Understanding (MOU)
Software Security Requirements Specification (SSRS) (Correct answer)
Service Level Agreement (SLA)

Correct answer: Software Security Requirements Specification (SSRS)

An SSRS formally captures the security requirements that a vendor's software must satisfy, serving as the contractual and technical baseline for third-party integration.

Question 61: What is the purpose of a disaster recovery plan (DRP) in secure software operations?

To specify procedures for restoring critical systems and data after a disruptive event (Correct answer)
To define how security incidents are reported to regulators
To manage software licensing during system migrations
To document the software development methodology used by the team

Correct answer: To specify procedures for restoring critical systems and data after a disruptive event

A DRP provides documented, tested procedures for recovering IT systems, applications, and data to restore business operations following a disaster or major incident.

Question 62: Which security practice involves regularly reviewing and removing user accounts and access rights that are no longer needed?

Penetration testing
Access recertification / account lifecycle management (Correct answer)
Threat modeling
Security awareness training

Correct answer: Access recertification / account lifecycle management

Access recertification is a periodic review process that ensures user accounts and permissions are still appropriate, removing stale accounts and over-provisioned access rights.

Question 63: Which design principle advocates that components with different trust levels or functions should be isolated from one another?

Economy of mechanism
Separation of duties
Fail securely
Compartmentalization (Correct answer)

Correct answer: Compartmentalization

Compartmentalization isolates system components so that a compromise in one area does not automatically lead to a compromise in others.

Question 64: Which standard provides a framework for software assurance maturity, helping organizations improve their secure software development practices?

OWASP SAMM (Correct answer)
CIS Benchmarks
NIST CSF
ISO 27001

Correct answer: OWASP SAMM

The OWASP Software Assurance Maturity Model (SAMM) provides a measurable framework for integrating security practices into software development and helps organizations benchmark their maturity.

Question 65: Which secure deployment technique runs two identical production environments, directing traffic to one while updating the other, enabling instant rollback?

Rolling deployment
Blue-green deployment (Correct answer)
Shadow deployment
Canary deployment

Correct answer: Blue-green deployment

Blue-green deployment maintains two identical environments; the live 'blue' environment serves traffic while the 'green' is updated, and traffic is switched after validation, enabling instant rollback.

Question 66: Which US regulation protects the privacy of student education records and limits disclosure of personally identifiable information?

FERPA (Correct answer)
GLBA
HIPAA
COPPA

Correct answer: FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records at schools receiving federal funding.

Question 67: What type of software requirement defines how the system should behave in terms of security, performance, or reliability?

User story
Business requirement
Functional requirement
Non-functional requirement (Correct answer)

Correct answer: Non-functional requirement

Non-functional requirements describe system qualities such as security, performance, and maintainability rather than specific behaviors or functions.

Question 68: Which approach to security requirements gathers input from stakeholders to identify what the system must NOT do to prevent harm?

Use case analysis
Functional decomposition
Misuse case analysis (Correct answer)
Formal verification

Correct answer: Misuse case analysis

Misuse case analysis explicitly models malicious or unintended uses of the system to derive security requirements that prevent those scenarios.

Question 69: Which security requirement category ensures that data is protected from unauthorized access when stored on disk?

Data in transit protection
Audit logging requirement
Data masking requirement
Data at rest protection (Correct answer)

Correct answer: Data at rest protection

Data at rest protection requirements specify controls such as disk encryption, access controls, and key management to protect stored data from unauthorized access.

Question 70: What is the primary difference between a vulnerability assessment and a penetration test?

A vulnerability assessment identifies weaknesses while a penetration test actively exploits them to demonstrate real-world impact (Correct answer)
Vulnerability assessments require source code access
Penetration tests only cover network infrastructure
Vulnerability assessments are more expensive

Correct answer: A vulnerability assessment identifies weaknesses while a penetration test actively exploits them to demonstrate real-world impact

A vulnerability assessment catalogs potential weaknesses; a penetration test goes further by safely exploiting those weaknesses to determine their actual exploitability and business impact.

Question 71: What is the primary security benefit of using parameterized queries in database interactions?

They encrypt database traffic
They improve query performance
They prevent SQL injection by separating SQL logic from user-supplied data (Correct answer)
They enforce database access controls

Correct answer: They prevent SQL injection by separating SQL logic from user-supplied data

Parameterized queries ensure user input is always treated as data rather than executable SQL code, effectively preventing SQL injection attacks.

Question 72: What is the key goal of user acceptance testing (UAT) from a security perspective?

To confirm the application meets the functional requirements of end users
To test the application's performance under expected user load
To verify that security requirements are met and residual risks are accepted by the business owner before deployment (Correct answer)
To validate that the user interface is accessible and usable

Correct answer: To verify that security requirements are met and residual risks are accepted by the business owner before deployment

From a security perspective, UAT provides the opportunity for the business owner to verify that security controls meet requirements and formally accept any residual risk before authorizing deployment.

Question 73: Which document formally authorizes a system to operate in a production environment after security testing and risk acceptance?

System security plan (SSP)
Security test plan
Authorization to Operate (ATO) (Correct answer)
Risk assessment report

Correct answer: Authorization to Operate (ATO)

An ATO is the formal management decision granting authority for a federal information system to operate, based on assessment of implemented security controls and residual risk.

Question 74: A right-to-audit clause in a vendor contract is PRIMARILY intended to:

Define the software update and patch delivery schedule
Give the acquiring organization the right to inspect the vendor's security practices and controls (Correct answer)
Establish the maximum penalty for contract breaches
Allow the vendor to audit the customer's usage of licensed software

Correct answer: Give the acquiring organization the right to inspect the vendor's security practices and controls

A right-to-audit clause grants the customer the contractual right to inspect, assess, or have a third party assess the vendor's security controls, ensuring ongoing compliance with security requirements.

Question 75: What type of security test deliberately overloads a system with requests to determine its breaking point?

Regression test
Fuzz test
Penetration test
Stress test / DoS resilience test (Correct answer)

Correct answer: Stress test / DoS resilience test

Stress testing pushes the system beyond normal operational capacity to find the point of failure, helping identify DoS vulnerabilities and ensuring graceful degradation under overload.

Question 76: What is the primary security concern with end-of-life (EOL) software components in production?

They no longer receive security patches, leaving known vulnerabilities permanently unaddressed (Correct answer)
They are incompatible with modern encryption standards
They cannot be monitored by SIEM tools
They consume more system resources than supported software

Correct answer: They no longer receive security patches, leaving known vulnerabilities permanently unaddressed

EOL software no longer receives security updates from the vendor, meaning known vulnerabilities will remain unpatched indefinitely, creating persistent risk in production environments.

Question 77: What is a key management system (KMS) responsible for in secure software design?

Enforcing password complexity policies
Managing user account passwords
Generating, distributing, storing, and revoking cryptographic keys throughout their lifecycle (Correct answer)
Monitoring SSL/TLS certificate expiration dates

Correct answer: Generating, distributing, storing, and revoking cryptographic keys throughout their lifecycle

A KMS handles the complete lifecycle of cryptographic keys including generation, storage, distribution, rotation, and revocation, ensuring keys are protected and managed consistently.

Question 78: Which change management process ensures that security implications are evaluated before any software change is deployed to production?

Sprint retrospective
User acceptance testing
Change advisory board (CAB) review (Correct answer)
Agile standup

Correct answer: Change advisory board (CAB) review

A CAB reviews proposed changes to assess risk, including security impact, ensures testing has been performed, and authorizes production changes to prevent unintended security regressions.

Question 79: Which architectural pattern uses a single component to handle all requests and enforce consistent security checks before routing to handlers?

Observer pattern
Front controller pattern (Correct answer)
Decorator pattern
Factory pattern

Correct answer: Front controller pattern

The Front Controller pattern centralizes request handling so that authentication, authorization, and input validation are applied consistently before any business logic is reached.

Question 80: Which testing approach validates that security controls work correctly by confirming the system blocks or alerts on known attack patterns?

Integration testing
Compliance testing
Negative testing (Correct answer)
Positive testing

Correct answer: Negative testing

Negative testing (or adversarial testing) verifies that the system correctly rejects invalid inputs and malicious patterns, confirming security controls function as intended.

Question 81: What is the purpose of a certificate authority (CA) in a public key infrastructure (PKI)?

To issue and sign digital certificates that bind public keys to identities (Correct answer)
To store private keys securely on behalf of users
To generate symmetric encryption keys for users
To perform key exchange during TLS handshakes

Correct answer: To issue and sign digital certificates that bind public keys to identities

A CA is a trusted entity that verifies the identity of certificate requestors and issues digitally signed certificates binding a public key to an identity.

Question 82: What is the primary purpose of a vulnerability scan in software security testing?

To automatically identify known vulnerabilities and misconfigurations in systems and applications (Correct answer)
To review source code for security defects
To actively exploit discovered vulnerabilities
To simulate an insider threat scenario

Correct answer: To automatically identify known vulnerabilities and misconfigurations in systems and applications

Vulnerability scanning uses automated tools to identify known vulnerabilities (CVEs), missing patches, and misconfigurations without exploiting them, providing a broad view of the attack surface.

Question 83: What is the purpose of a code review focused on security in the SDLC?

To measure developer productivity
To verify that code meets performance benchmarks
To identify security vulnerabilities in source code before deployment (Correct answer)
To ensure coding style guidelines are followed

Correct answer: To identify security vulnerabilities in source code before deployment

Security-focused code reviews examine source code for vulnerabilities such as injection flaws, insecure configurations, and improper error handling before the code reaches production.

Question 84: What is the role of a 'trusted foundry' in hardware supply chain security?

An independent auditor that reviews vendor security practices
A certified manufacturing facility that meets government standards for producing trustworthy hardware (Correct answer)
A cloud provider that hosts software in an isolated environment
A legal entity that holds escrow copies of vendor source code

Correct answer: A certified manufacturing facility that meets government standards for producing trustworthy hardware

A trusted foundry is a certified semiconductor or hardware manufacturing facility that meets rigorous government or industry standards, reducing the risk of hardware backdoors or tampering.

Question 85: What security design pattern ensures that a user must provide evidence from at least two distinct authentication factors?

Single sign-on (SSO)
Attribute-based access control (ABAC)
Multi-factor authentication (MFA) (Correct answer)
Role-based access control (RBAC)

Correct answer: Multi-factor authentication (MFA)

MFA requires users to present at least two factors from different categories (something you know, something you have, something you are) before granting access.

Question 86: Which memory protection mechanism prevents code from executing in data memory regions, mitigating buffer overflow exploits?

Control Flow Integrity (CFI)
Address Space Layout Randomization (ASLR)
Stack canaries
Data Execution Prevention (DEP) / NX bit (Correct answer)

Correct answer: Data Execution Prevention (DEP) / NX bit

DEP (also called the NX/XD bit) marks memory regions as either executable or writable but not both, preventing attackers from injecting shellcode into data buffers and executing it.

Question 87: Which US law requires healthcare organizations to implement safeguards protecting the privacy and security of electronic protected health information (ePHI)?

HIPAA (Correct answer)
FERPA
GLBA
SOX

Correct answer: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities to implement administrative, physical, and technical safeguards for ePHI.

Question 88: What is the purpose of an incident response plan (IRP) in software operations?

To define SLAs for system availability
To document software deployment procedures
To provide a structured approach for detecting, containing, eradicating, and recovering from security incidents (Correct answer)
To specify change management approval workflows

Correct answer: To provide a structured approach for detecting, containing, eradicating, and recovering from security incidents

An IRP defines roles, responsibilities, and procedures that enable an organization to respond effectively to security incidents, minimizing damage and recovery time.

Question 89: Which session management design practice prevents session fixation attacks?

Generating a new session ID after successful authentication (Correct answer)
Storing session data in client-side cookies
Using long session timeouts
Using sequential session identifiers

Correct answer: Generating a new session ID after successful authentication

Regenerating the session ID upon authentication prevents session fixation, where an attacker pre-sets a known session ID and waits for the victim to authenticate with it.

Question 90: Which methodology would a security tester use to verify that a web application properly validates session tokens and prevents session hijacking?

Load testing
Session management testing (Correct answer)
Static code analysis
Code coverage analysis

Correct answer: Session management testing

Session management testing evaluates the strength and handling of session tokens, checking for predictable IDs, improper expiration, missing secure and HttpOnly cookie flags, and hijacking vulnerabilities.

Question 91: During software acquisition, which practice helps ensure that delivered software has not been tampered with during transit or distribution?

Verification of cryptographic hash values or digital signatures against vendor-published checksums (Correct answer)
Runtime application self-protection (RASP) deployment
Code obfuscation by the vendor
Mandatory penetration testing before delivery

Correct answer: Verification of cryptographic hash values or digital signatures against vendor-published checksums

Comparing cryptographic hashes or validating digital signatures against vendor-published values confirms that the software package has not been altered since it was signed by the vendor.

Question 92: What does 'threat hunting' refer to in the context of software and system security testing?

Generating threat scenarios for use in tabletop exercises
Proactively searching for hidden threats or attacker activity that has evaded existing security controls (Correct answer)
Automated scanning for known CVEs in production systems
Reviewing threat models created during the design phase

Correct answer: Proactively searching for hidden threats or attacker activity that has evaded existing security controls

Threat hunting is a proactive, human-led security activity where analysts search for indicators of compromise and adversary behavior that automated tools may have missed.

Question 93: What is the purpose of security regression testing?

To test the application against the latest threat intelligence
To verify that previously fixed vulnerabilities have not been reintroduced by new code changes (Correct answer)
To perform annual penetration tests of production systems
To test new features for security vulnerabilities

Correct answer: To verify that previously fixed vulnerabilities have not been reintroduced by new code changes

Security regression testing re-runs tests for previously identified and fixed vulnerabilities after each change to ensure the fixes remain intact and have not been inadvertently broken.

Question 94: Which acquisition practice BEST reduces the risk of counterfeit or tampered hardware and firmware in the supply chain?

Procuring from vetted, trusted suppliers and verifying cryptographic integrity of firmware (Correct answer)
Disabling unused hardware features after delivery
Purchasing exclusively from lowest-cost vendors
Requiring vendors to provide source code escrow

Correct answer: Procuring from vetted, trusted suppliers and verifying cryptographic integrity of firmware

Using trusted suppliers with established verification processes and validating firmware integrity via cryptographic signatures reduces the risk of counterfeit or backdoored hardware.

Question 95: Which security concept ensures that a party cannot deny having performed an action or transaction?

Non-repudiation (Correct answer)
Authorization
Authentication
Accountability

Correct answer: Non-repudiation

Non-repudiation provides proof of the origin and integrity of data, preventing a party from later denying they sent or received information.

Question 96: What is the security significance of maintaining an audit log in production systems?

Audit logs replace the need for access controls
Audit logs provide a tamper-evident record of actions taken, supporting forensic investigation and accountability (Correct answer)
Audit logs improve system performance by caching frequently accessed data
Audit logs are required only for financial transaction systems

Correct answer: Audit logs provide a tamper-evident record of actions taken, supporting forensic investigation and accountability

Audit logs create a chronological, tamper-evident record of system and user activities, which is essential for detecting incidents, conducting forensic investigations, and demonstrating compliance.

Question 97: Which practice ensures that error messages shown to end users do not reveal sensitive system information?

Secure error handling (Correct answer)
Session management
Output encoding
Input validation

Correct answer: Secure error handling

Secure error handling ensures that detailed technical error information (stack traces, database errors, file paths) is logged internally but never displayed to end users.

Question 98: In the context of the CSSLP, what is a 'security-focused' peer code review intended to catch?

Only performance-related coding mistakes
Only licensing compliance issues in third-party libraries
Security vulnerabilities including injection flaws, insecure API usage, and logic errors affecting security (Correct answer)
Only syntax errors and style violations

Correct answer: Security vulnerabilities including injection flaws, insecure API usage, and logic errors affecting security

Security-focused peer code reviews use checklists and reviewer expertise to identify vulnerabilities like injection points, broken authentication, and insecure configurations before they reach production.

Question 99: A design pattern where no implicit trust is granted to any user, device, or network, even those inside the corporate perimeter, is called:

Defense in depth
Micro-segmentation
Perimeter security
Zero trust architecture (Correct answer)

Correct answer: Zero trust architecture

Zero trust architecture operates on the principle of 'never trust, always verify,' requiring continuous validation of identity and access rights regardless of network location.

Question 100: What does a patch management process primarily address in production systems?

Applying security fixes to software and systems to remediate known vulnerabilities in a timely manner (Correct answer)
Backing up production databases before maintenance
Deploying new application features to users
Managing software licenses and compliance

Correct answer: Applying security fixes to software and systems to remediate known vulnerabilities in a timely manner

Patch management is the systematic process of identifying, acquiring, testing, and applying security updates to reduce exposure to known vulnerabilities.

Question 101: Which type of testing verifies that newly added code does not break existing security functionality?

Regression testing (Correct answer)
Acceptance testing
Unit testing
Integration testing

Correct answer: Regression testing

Regression testing re-executes a suite of existing tests after code changes to confirm that previously working functionality, including security controls, has not been broken.

Question 102: Which design approach assigns permissions based on a user's organizational role rather than their individual identity?

Mandatory access control (MAC)
Role-based access control (RBAC) (Correct answer)
Discretionary access control (DAC)
Attribute-based access control (ABAC)

Correct answer: Role-based access control (RBAC)

RBAC assigns permissions to roles (such as admin, editor, viewer) and then assigns roles to users, simplifying permission management in large organizations.

Question 103: Which testing methodology tests software from the outside without knowledge of the internal code or architecture?

White-box testing
Gray-box testing
Static analysis
Black-box testing (Correct answer)

Correct answer: Black-box testing

Black-box testing simulates an external attacker's perspective, probing the application through its interfaces without access to source code, design documents, or internal logic.

Question 104: Which principle states that a system should grant users only the minimum access rights needed to perform their job functions?

Need to know
Least privilege (Correct answer)
Separation of duties
Defense in depth

Correct answer: Least privilege

Least privilege limits access rights to the bare minimum required for a user's legitimate purpose, reducing the attack surface.

Question 105: Dynamic Application Security Testing (DAST) differs from SAST because it:

Tests the running application by sending inputs and observing responses (Correct answer)
Requires access to the source code
Focuses on reviewing infrastructure configuration
Only identifies logic flaws rather than coding errors

Correct answer: Tests the running application by sending inputs and observing responses

DAST tests a running application from the outside, sending crafted requests to find vulnerabilities such as injection flaws, authentication weaknesses, and misconfigurations.

Question 106: Which term describes the likelihood that a threat will exploit a vulnerability and the resulting impact?

Control
Threat
Vulnerability
Risk (Correct answer)

Correct answer: Risk

Risk is calculated as the combination of the probability that a threat will exploit a vulnerability and the magnitude of the resulting harm.

Question 107: What is the purpose of a data flow diagram (DFD) in security requirements analysis?

To visualize how data moves through a system, identifying trust boundaries and sensitive data flows (Correct answer)
To model database schema relationships
To document API endpoint specifications
To track software version changes

Correct answer: To visualize how data moves through a system, identifying trust boundaries and sensitive data flows

DFDs show how data flows between processes, data stores, and external entities, making trust boundaries visible and helping identify where security controls are needed.

Question 108: What is the purpose of a software bill of materials (SBOM) in secure software development?

To specify hardware requirements for running the software
To provide a comprehensive inventory of all components, libraries, and dependencies in a software product (Correct answer)
To track developer hours spent on security features
To document all known vulnerabilities in the codebase

Correct answer: To provide a comprehensive inventory of all components, libraries, and dependencies in a software product

An SBOM is a formal record of all software components and their supply chain relationships, enabling rapid identification of affected systems when new vulnerabilities are disclosed.

Question 109: What is 'typosquatting' in the context of software supply chain attacks?

Injecting malicious content into website form fields
Publishing malicious packages with names nearly identical to popular legitimate packages (Correct answer)
Registering domain names similar to legitimate ones to intercept traffic
Exploiting URL encoding to bypass input validation

Correct answer: Publishing malicious packages with names nearly identical to popular legitimate packages

Typosquatting in supply chain attacks involves publishing malicious packages with names that closely mimic popular libraries, exploiting developer typographical errors during package installation.

Question 110: What is a security requirement that specifies users must be authenticated before accessing any resource?

Audit requirement
Authorization requirement
Availability requirement
Authentication requirement (Correct answer)

Correct answer: Authentication requirement

An authentication requirement specifies how and when users must prove their identity before the system grants them access to resources.

Question 111: In supply chain risk management, 'nth-party risk' refers to:

Risk associated with using outdated cryptographic algorithms
Regulatory risk from non-compliance with data protection laws
Security risk propagated through a vendor's own suppliers and subcontractors (Correct answer)
Risk from internal employees with privileged access

Correct answer: Security risk propagated through a vendor's own suppliers and subcontractors

Nth-party risk extends beyond direct (first-party) and immediate vendor (third-party) risks to include the security posture of the vendor's own supply chain and subcontractors.

Question 112: Which type of injection attack occurs when malicious commands are injected into an OS shell command executed by the application?

Command injection (Correct answer)
LDAP injection
XML injection
SQL injection

Correct answer: Command injection

Command injection occurs when user-supplied input is passed to a system shell without proper sanitization, allowing attackers to execute arbitrary operating system commands.

Question 113: What is the purpose of a security control baseline in software development?

To measure code performance against an industry benchmark
To define the minimum set of security controls required for a given risk level (Correct answer)
To compare two versions of source code for changes
To document all known vulnerabilities in a system

Correct answer: To define the minimum set of security controls required for a given risk level

A security control baseline establishes the minimum security requirements that must be met based on the system's categorization, providing a starting point for tailoring controls.

Question 114: Which cryptographic algorithm is currently recommended by NIST for symmetric encryption?

AES (Correct answer)
DES
RC4
3DES

Correct answer: AES

NIST recommends AES (Advanced Encryption Standard) for symmetric encryption, with 128-bit, 192-bit, or 256-bit key lengths depending on the security requirement.

Question 115: What is the primary purpose of software composition analysis (SCA) in the context of supply chain security?

Identifying open-source components and their known vulnerabilities within a codebase (Correct answer)
Verifying that software binaries match their source code
Monitoring runtime behavior of third-party libraries
Analyzing network traffic for malicious payloads

Correct answer: Identifying open-source components and their known vulnerabilities within a codebase

SCA tools catalog open-source and third-party components in a codebase and cross-reference them against vulnerability databases to identify known risks.

Question 116: Which secure design practice involves reducing the amount of code, features, and services to only what is strictly necessary?

Input validation
Defense in depth
Minimization (attack surface reduction) (Correct answer)
Compartmentalization

Correct answer: Minimization (attack surface reduction)

Minimizing the attack surface by removing unnecessary features, APIs, and services reduces the number of potential entry points an attacker can exploit.

Question 117: Which process involves identifying and classifying data based on its sensitivity to determine appropriate security controls?

Data aggregation
Data masking
Data classification (Correct answer)
Data normalization

Correct answer: Data classification

Data classification assigns labels (such as public, internal, confidential, or top secret) to data based on sensitivity, guiding decisions about protection mechanisms.

Question 118: In secure coding, what does 'input validation' ensure?

That the application encrypts data before storing it
That output is formatted correctly for the user interface
That database queries use parameterized statements
That all data received from untrusted sources conforms to expected format, type, and range before processing (Correct answer)

Correct answer: That all data received from untrusted sources conforms to expected format, type, and range before processing

Input validation verifies that user-supplied or externally sourced data meets expectations for format, type, length, and range, rejecting or sanitizing any data that does not conform.

Question 119: A requirement that specifies the system must record all access attempts to sensitive data is an example of:

Authentication requirement
Authorization requirement
Audit and accountability requirement (Correct answer)
Availability requirement

Correct answer: Audit and accountability requirement

Audit and accountability requirements ensure that actions can be traced to responsible individuals, supporting incident response, forensics, and compliance activities.

Question 120: A trusted computing base (TCB) refers to:

A cryptographic module certified by NIST
The set of all hardware, firmware, and software critical to enforcing the security policy (Correct answer)
An external audit firm that validates software security
The baseline configuration of a hardened operating system

Correct answer: The set of all hardware, firmware, and software critical to enforcing the security policy

The TCB encompasses all components of a system that are relied upon to enforce the security policy, meaning any failure in the TCB could compromise the entire system's security.

Question 121: Which US law mandates security and privacy requirements for federal agency information systems?

GLBA
HIPAA
FISMA (Correct answer)
PCI DSS

Correct answer: FISMA

The Federal Information Security Modernization Act (FISMA) requires federal agencies to develop, document, and implement security programs for their information systems.

Question 122: The principle that every access attempt by a subject to an object must be checked against the access policy is known as:

Complete mediation (Correct answer)
Open design
Psychological acceptability
Economy of mechanism

Correct answer: Complete mediation

Complete mediation requires that every access to every object be checked for authority, preventing attackers from bypassing access controls through caching or assumptions.

Question 123: Which threat modeling methodology focuses on assets, attack surfaces, and mitigations and was developed by Microsoft?

OCTAVE
VAST
STRIDE (Correct answer)
PASTA

Correct answer: STRIDE

STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) is Microsoft's threat categorization framework used with data flow diagrams.

Question 124: What does the OWASP Top 10 primarily represent?

The ten most common programming languages used in web development
A list of the ten most critical web application security risks (Correct answer)
The ten required controls for PCI DSS compliance
A ranking of the ten most dangerous malware families

Correct answer: A list of the ten most critical web application security risks

The OWASP Top 10 is a standard awareness document representing the most critical security risks to web applications, updated periodically based on real-world data.

Question 125: Which secure coding technique prevents integer overflow vulnerabilities?

Avoiding the use of integers in security-sensitive calculations
Validating arithmetic operations and using safe integer libraries that check for overflow (Correct answer)
Using unsigned integers for all calculations
Converting all integers to floating-point numbers

Correct answer: Validating arithmetic operations and using safe integer libraries that check for overflow

Integer overflow prevention involves checking arithmetic operations before they occur or using language constructs and libraries that throw exceptions when overflow would result.

Question 126: Which supply chain security practice verifies the integrity of software components by confirming their cryptographic hash matches a known-good value?

Dependency pinning
Code signing verification (Correct answer)
Software composition analysis
License compliance scanning

Correct answer: Code signing verification

Code signing and hash verification confirm that a software component has not been tampered with since it was signed by the trusted publisher, protecting against supply chain attacks.

Question 127: In abuse case modeling, what does an abuse case represent?

A poorly written user story
A use case that has not been tested
A scenario describing how an attacker might misuse the system (Correct answer)
A deprecated software feature

Correct answer: A scenario describing how an attacker might misuse the system

Abuse cases (also called misuse cases) describe how a malicious actor or a user with bad intent could abuse the system's functionality to cause harm.

Certified Secure Software Lifecycle Professional (CSSLP)

The CSSLP validates advanced technical skills and knowledge necessary to authenticate software security throughout the SDLC. Offered by ISC2, it is designed for software development, engineering, and security professionals.

125

Questions

180 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds