CSLLP Secure Software Implementation 3

Question 1

What is the purpose of fuzz testing (fuzzing) in secure software development?

Accepted Answer

To automatically generate random or malformed inputs to discover crashes and security vulnerabilities

Answer

Fuzzing sends unexpected, random, or malformed data to a program to find crashes, memory corruption, and security flaws that structured testing might miss.

Question 2

Which type of injection attack occurs when malicious commands are injected into an OS shell command executed by the application?

Accepted Answer

Command injection

Answer

Command injection occurs when user-supplied input is passed to a system shell without proper sanitization, allowing attackers to execute arbitrary operating system commands.

Question 3

What does the principle of 'secure defaults' mean in software implementation?

Accepted Answer

Security controls are enabled by default and users must explicitly disable them if needed

Answer

Secure defaults means that out-of-the-box configurations are the most secure option, requiring administrators to consciously loosen security rather than having to add it.

Question 4

What is the primary security risk of storing passwords as plain text in a database?

Accepted Answer

A database breach exposes all user passwords directly, enabling immediate account takeover

Answer

Plain text password storage means any unauthorized access to the database immediately exposes every user's credentials, which are often reused across other services.

Question 5

Which memory protection mechanism prevents code from executing in data memory regions, mitigating buffer overflow exploits?

Accepted Answer

Data Execution Prevention (DEP) / NX bit

Answer

DEP (also called the NX/XD bit) marks memory regions as either executable or writable but not both, preventing attackers from injecting shellcode into data buffers and executing it.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Implementation 3