CSLLP Secure Software Implementation 2 — Questions and Answers
Question 1: Which HTTP header prevents a web page from being embedded in an iframe on another domain, protecting against clickjacking?
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- Strict-Transport-Security
- X-Content-Type-Options
Correct answer: X-Frame-Options
The X-Frame-Options header (or the frame-ancestors directive in Content-Security-Policy) controls whether the browser allows the page to be displayed in a frame or iframe on another origin.
Question 2: What is a race condition vulnerability in software?
- A performance bug caused by excessive memory allocation
- A flaw where the security outcome depends on the uncontrolled timing or ordering of concurrent events (Correct answer)
- A network timeout that exposes sensitive data
- A deadlock in multi-threaded applications
Correct answer: A flaw where the security outcome depends on the uncontrolled timing or ordering of concurrent events
A race condition (or TOCTOU - Time of Check to Time of Use) occurs when system behavior depends on the sequence or timing of uncontrollable events, potentially allowing security bypass.
Question 3: Which secure coding technique prevents integer overflow vulnerabilities?
- Using unsigned integers for all calculations
- Validating arithmetic operations and using safe integer libraries that check for overflow (Correct answer)
- Avoiding the use of integers in security-sensitive calculations
- Converting all integers to floating-point numbers
Correct answer: Validating arithmetic operations and using safe integer libraries that check for overflow
Integer overflow prevention involves checking arithmetic operations before they occur or using language constructs and libraries that throw exceptions when overflow would result.
Question 4: What is the OWASP-recommended approach for protecting sensitive data in web applications?
- Store all sensitive data in client-side cookies with HttpOnly flag
- Classify data, apply encryption at rest and in transit, and minimize retention of sensitive data (Correct answer)
- Use Base64 encoding for all sensitive fields in the database
- Restrict sensitive data access to administrators only
Correct answer: Classify data, apply encryption at rest and in transit, and minimize retention of sensitive data
OWASP recommends classifying sensitive data, using strong encryption both at rest and in transit, and not storing sensitive data beyond its necessary retention period.
Question 5: Which practice helps prevent insecure deserialization vulnerabilities?
- Always use JSON instead of XML
- Validate and sanitize serialized data, use integrity checks, and avoid deserializing data from untrusted sources (Correct answer)
- Compress data before serializing it
- Use only stateless authentication mechanisms
Correct answer: Validate and sanitize serialized data, use integrity checks, and avoid deserializing data from untrusted sources
Insecure deserialization can allow attackers to manipulate serialized objects to achieve remote code execution, so all deserialized data from untrusted sources must be carefully validated.
Question 6: What is the purpose of a software bill of materials (SBOM) in secure software development?
- To track developer hours spent on security features
- To provide a comprehensive inventory of all components, libraries, and dependencies in a software product (Correct answer)
- To document all known vulnerabilities in the codebase
- To specify hardware requirements for running the software
Correct answer: To provide a comprehensive inventory of all components, libraries, and dependencies in a software product
An SBOM is a formal record of all software components and their supply chain relationships, enabling rapid identification of affected systems when new vulnerabilities are disclosed.
CSLLP Secure Software Implementation 2
Which HTTP header prevents a web page from being embedded in an iframe on another domain, protecting against clickjacking?