CSLLP Secure Software Design 3

Question 1

What is a key management system (KMS) responsible for in secure software design?

Accepted Answer

Generating, distributing, storing, and revoking cryptographic keys throughout their lifecycle

Answer

Managing user account passwords

Answer

Monitoring SSL/TLS certificate expiration dates

Answer

Enforcing password complexity policies

Question 2

Which secure design practice involves reducing the amount of code, features, and services to only what is strictly necessary?

Accepted Answer

Minimization (attack surface reduction)

Answer

Defense in depth

Answer

Compartmentalization

Answer

Input validation

Question 3

A design pattern where no implicit trust is granted to any user, device, or network, even those inside the corporate perimeter, is called:

Accepted Answer

Zero trust architecture

Answer

Defense in depth

Answer

Perimeter security

Answer

Micro-segmentation

Question 4

What is the main security concern with using third-party components or libraries in software development?

Accepted Answer

They may introduce known or unknown vulnerabilities that affect the entire application

Answer

They always contain deliberate backdoors

Answer

They cannot be updated or patched by the development team

Answer

They are not compatible with modern encryption standards

Question 5

Which session management design practice prevents session fixation attacks?

Accepted Answer

Generating a new session ID after successful authentication

Answer

Using long session timeouts

Answer

Storing session data in client-side cookies

Answer

Using sequential session identifiers

Question 6

What does the OWASP Top 10 primarily represent?

Accepted Answer

A list of the ten most critical web application security risks

Answer

The ten most common programming languages used in web development

Answer

The ten required controls for PCI DSS compliance

Answer

A ranking of the ten most dangerous malware families