CSLLP Secure Software Implementation 3

Question 1

What is the purpose of fuzz testing (fuzzing) in secure software development?

Accepted Answer

To automatically generate random or malformed inputs to discover crashes and security vulnerabilities

Answer

To test software under simulated production load

Answer

To verify that UI elements render correctly across browsers

Answer

To measure code coverage of unit tests

Question 2

Which type of injection attack occurs when malicious commands are injected into an OS shell command executed by the application?

Accepted Answer

Command injection

Answer

SQL injection

Answer

LDAP injection

Answer

XML injection

Question 3

What does the principle of 'secure defaults' mean in software implementation?

Accepted Answer

Security controls are enabled by default and users must explicitly disable them if needed

Answer

All security features are disabled by default to avoid user friction

Answer

The application defaults to the last known-good configuration after a crash

Answer

Security patches are applied automatically without user intervention

Question 4

What is the primary security risk of storing passwords as plain text in a database?

Accepted Answer

A database breach exposes all user passwords directly, enabling immediate account takeover

Answer

It consumes excessive storage space

Answer

It makes password rotation more difficult

Answer

It prevents the application from enforcing password complexity

Question 5

Which memory protection mechanism prevents code from executing in data memory regions, mitigating buffer overflow exploits?

Accepted Answer

Data Execution Prevention (DEP) / NX bit

Answer

Address Space Layout Randomization (ASLR)

Answer

Stack canaries

Answer

Control Flow Integrity (CFI)

Question 6

In the context of the CSSLP, what is a 'security-focused' peer code review intended to catch?

Accepted Answer

Security vulnerabilities including injection flaws, insecure API usage, and logic errors affecting security

Answer

Only performance-related coding mistakes

Answer

Only syntax errors and style violations

Answer

Only licensing compliance issues in third-party libraries