CSLLP Secure Software Concepts 1 — Questions and Answers
Question 1: Which principle states that a system should grant users only the minimum access rights needed to perform their job functions?
- Least privilege (Correct answer)
- Defense in depth
- Separation of duties
- Need to know
Correct answer: Least privilege
Least privilege limits access rights to the bare minimum required for a user's legitimate purpose, reducing the attack surface.
Question 2: What does the CIA triad stand for in information security?
- Confidentiality, Integrity, Availability (Correct answer)
- Control, Identity, Authentication
- Compliance, Integrity, Authorization
- Confidentiality, Identity, Assurance
Correct answer: Confidentiality, Integrity, Availability
The CIA triad represents the three core security objectives: Confidentiality (preventing unauthorized disclosure), Integrity (ensuring data accuracy), and Availability (ensuring reliable access).
Question 3: Which security concept ensures that a party cannot deny having performed an action or transaction?
- Authentication
- Non-repudiation (Correct answer)
- Authorization
- Accountability
Correct answer: Non-repudiation
Non-repudiation provides proof of the origin and integrity of data, preventing a party from later denying they sent or received information.
Question 4: A threat model that categorizes threats into Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege is known as:
- PASTA
- STRIDE (Correct answer)
- DREAD
- OCTAVE
Correct answer: STRIDE
STRIDE is a threat modeling methodology developed by Microsoft that provides a structured way to identify and classify software threats.
Question 5: What is the primary goal of defense in depth?
- Eliminate all vulnerabilities in software
- Layer multiple security controls so that failure of one does not compromise the system (Correct answer)
- Encrypt all data at rest and in transit
- Perform regular penetration testing
Correct answer: Layer multiple security controls so that failure of one does not compromise the system
Defense in depth uses multiple overlapping security controls so that if one layer is bypassed, additional layers still protect the asset.
Question 6: Which term describes the likelihood that a threat will exploit a vulnerability and the resulting impact?
- Threat
- Vulnerability
- Risk (Correct answer)
- Control
Correct answer: Risk
Risk is calculated as the combination of the probability that a threat will exploit a vulnerability and the magnitude of the resulting harm.
CSLLP Secure Software Concepts 1
Which principle states that a system should grant users only the minimum access rights needed to perform their job functions?