CSLLP Secure Software Concepts 2 — Questions and Answers
Question 1: Which attack category involves sending more data to a buffer than it can handle, potentially allowing code execution?
- SQL injection
- Buffer overflow (Correct answer)
- Cross-site scripting
- Directory traversal
Correct answer: Buffer overflow
A buffer overflow occurs when a program writes more data to a buffer than it can hold, which can overwrite adjacent memory and potentially allow an attacker to execute arbitrary code.
Question 2: What is the purpose of a privacy impact assessment (PIA)?
- To test software performance under load
- To identify and evaluate risks to personal information in a system (Correct answer)
- To assess physical security of data centers
- To measure compliance with encryption standards
Correct answer: To identify and evaluate risks to personal information in a system
A PIA is a process used to evaluate how personally identifiable information is collected, used, shared, and maintained, identifying privacy risks and mitigation strategies.
Question 3: The principle that every access attempt by a subject to an object must be checked against the access policy is known as:
- Complete mediation (Correct answer)
- Open design
- Psychological acceptability
- Economy of mechanism
Correct answer: Complete mediation
Complete mediation requires that every access to every object be checked for authority, preventing attackers from bypassing access controls through caching or assumptions.
Question 4: Which secure design principle advocates for simplicity in security mechanisms to reduce the chance of flaws?
- Separation of privilege
- Fail securely
- Economy of mechanism (Correct answer)
- Least common mechanism
Correct answer: Economy of mechanism
Economy of mechanism states that security designs should be as simple as possible, since complex designs are harder to analyze, implement correctly, and verify.
Question 5: Which security property ensures that data has not been altered in an unauthorized manner?
- Availability
- Confidentiality
- Integrity (Correct answer)
- Non-repudiation
Correct answer: Integrity
Integrity ensures that data remains accurate and unaltered, detecting any unauthorized modifications made during storage or transmission.
Question 6: A trusted computing base (TCB) refers to:
- The set of all hardware, firmware, and software critical to enforcing the security policy (Correct answer)
- An external audit firm that validates software security
- The baseline configuration of a hardened operating system
- A cryptographic module certified by NIST
Correct answer: The set of all hardware, firmware, and software critical to enforcing the security policy
The TCB encompasses all components of a system that are relied upon to enforce the security policy, meaning any failure in the TCB could compromise the entire system's security.
CSLLP Secure Software Concepts 2
Which attack category involves sending more data to a buffer than it can handle, potentially allowing code execution?