CSLLP Secure Software Implementation 1

Question 1

Which coding practice prevents cross-site scripting (XSS) attacks by transforming special HTML characters into their safe equivalents?

Accepted Answer

Output encoding

Answer

Output encoding converts characters like '<', '>', and '&' into HTML entities before rendering them in the browser, preventing injected scripts from being executed.

Question 2

What is the purpose of a code review focused on security in the SDLC?

Accepted Answer

To identify security vulnerabilities in source code before deployment

Answer

Security-focused code reviews examine source code for vulnerabilities such as injection flaws, insecure configurations, and improper error handling before the code reaches production.

Question 3

Which type of analysis tool automatically scans source code for security vulnerabilities without executing the program?

Accepted Answer

Static application security testing (SAST)

Answer

SAST tools analyze source code, bytecode, or binaries at rest to find security flaws without running the application, enabling early detection in the development pipeline.

Question 4

What is the risk of using hard-coded credentials in source code?

Accepted Answer

Credentials can be extracted from code repositories or binaries, granting unauthorized access

Answer

Hard-coded credentials embedded in source code can be discovered through code repository access, reverse engineering, or accidental public exposure, leading to unauthorized system access.

Question 5

Which practice ensures that error messages shown to end users do not reveal sensitive system information?

Accepted Answer

Secure error handling

Answer

Secure error handling ensures that detailed technical error information (stack traces, database errors, file paths) is logged internally but never displayed to end users.

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP - Certified Secure Software Lifecycle Professional Practice Test

CSLLP Secure Software Implementation 1