CSLLP Secure Software Design

Question 1

Which design principle advocates that components with different trust levels or functions should be isolated from one another?

Accepted Answer

Compartmentalization

Answer

Compartmentalization isolates system components so that a compromise in one area does not automatically lead to a compromise in others.

Question 2

A multi-tier architecture that separates presentation, business logic, and data storage is considered a best practice because it:

Accepted Answer

Limits the blast radius of a breach and enforces separation of concerns

Answer

Separating tiers means an attacker who compromises the presentation layer does not automatically gain access to the database, limiting damage and enabling independent security controls.

Question 3

What is the primary security benefit of using parameterized queries in database interactions?

Accepted Answer

They prevent SQL injection by separating SQL logic from user-supplied data

Answer

Parameterized queries ensure user input is always treated as data rather than executable SQL code, effectively preventing SQL injection attacks.

Question 4

Which principle states that a system should default to a secure state when it fails or encounters an error?

Accepted Answer

Fail securely

Answer

Fail securely (or fail safe) ensures that when an error occurs, the system defaults to a secure state such as denying access rather than inadvertently allowing it.

Question 5

In cryptographic design, what is the purpose of a salt?

Accepted Answer

To add random data to passwords before hashing, preventing precomputed hash attacks

Answer

A cryptographic salt is random data added to a password before hashing, ensuring that identical passwords produce different hash values and defeating rainbow table attacks.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Design