CSLLP Secure Software Design 3

Question 1

What is a key management system (KMS) responsible for in secure software design?

Accepted Answer

Generating, distributing, storing, and revoking cryptographic keys throughout their lifecycle

Answer

A KMS handles the complete lifecycle of cryptographic keys including generation, storage, distribution, rotation, and revocation, ensuring keys are protected and managed consistently.

Question 2

Which secure design practice involves reducing the amount of code, features, and services to only what is strictly necessary?

Accepted Answer

Minimization (attack surface reduction)

Answer

Minimizing the attack surface by removing unnecessary features, APIs, and services reduces the number of potential entry points an attacker can exploit.

Question 3

A design pattern where no implicit trust is granted to any user, device, or network, even those inside the corporate perimeter, is called:

Accepted Answer

Zero trust architecture

Answer

Zero trust architecture operates on the principle of 'never trust, always verify,' requiring continuous validation of identity and access rights regardless of network location.

Question 4

What is the main security concern with using third-party components or libraries in software development?

Accepted Answer

They may introduce known or unknown vulnerabilities that affect the entire application

Answer

Third-party components may contain vulnerabilities, outdated dependencies, or insecure code that extends the application's attack surface beyond what the development team controls.

Question 5

Which session management design practice prevents session fixation attacks?

Accepted Answer

Generating a new session ID after successful authentication

Answer

Regenerating the session ID upon authentication prevents session fixation, where an attacker pre-sets a known session ID and waits for the victim to authenticate with it.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Design 3