CSLLP Secure Software Design 2

Question 1

What is the purpose of an interface design review in secure software development?

Accepted Answer

To identify trust boundaries and validate that security controls are applied at all interfaces

Answer

Interface design reviews examine all points where data crosses trust boundaries to ensure input validation, authentication, and authorization controls are correctly applied.

Question 2

Which cryptographic algorithm is currently recommended by NIST for symmetric encryption?

Accepted Answer

AES

Answer

NIST recommends AES (Advanced Encryption Standard) for symmetric encryption, with 128-bit, 192-bit, or 256-bit key lengths depending on the security requirement.

Question 3

What security design pattern ensures that a user must provide evidence from at least two distinct authentication factors?

Accepted Answer

Multi-factor authentication (MFA)

Answer

MFA requires users to present at least two factors from different categories (something you know, something you have, something you are) before granting access.

Question 4

Which design approach assigns permissions based on a user's organizational role rather than their individual identity?

Accepted Answer

Role-based access control (RBAC)

Answer

RBAC assigns permissions to roles (such as admin, editor, viewer) and then assigns roles to users, simplifying permission management in large organizations.

Question 5

What is the purpose of a certificate authority (CA) in a public key infrastructure (PKI)?

Accepted Answer

To issue and sign digital certificates that bind public keys to identities

Answer

A CA is a trusted entity that verifies the identity of certificate requestors and issues digitally signed certificates binding a public key to an identity.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Design 2