View Full ISC CSSLP Exam Dumps and Practice Test Dumps

 

Question 41.

A development team is defining security requirements for a new customer portal. Which requirement is MOST appropriate?

1. The application should be secure
2. Sensitive customer data must be encrypted in transit and at rest using approved mechanisms
3. Developers should use good coding practices
4. The system should avoid vulnerabilities

Correct Answer: 2. Sensitive customer data must be encrypted in transit and at rest using approved mechanisms

Explanation:

Security requirements should be specific, measurable, and testable. A requirement that defines what data must be protected and under what conditions can be traced to design controls and verified during testing. Vague statements such as “the application should be secure” do not provide enough information for developers or testers to determine whether the requirement has been satisfied.

Question 42.

Which practice BEST helps prevent path traversal vulnerabilities in file-access functionality?

1. Validate and canonicalize paths, restrict access to approved directories, and avoid direct use of untrusted filenames
2. Increase file-system capacity
3. Disable authentication
4. Allow users to specify absolute server paths

Correct Answer: 1. Validate and canonicalize paths, restrict access to approved directories, and avoid direct use of untrusted filenames

Explanation:

Path traversal occurs when attackers manipulate file paths to access files outside intended directories. Applications should canonicalize and validate paths, use allowlisted locations, generate server-side filenames where possible, and restrict the process account to only required directories. User-supplied path values should never be trusted directly. Least privilege further limits the impact if validation fails.

Question 43.

A security architect wants to understand how an attacker might move from a public web interface to a sensitive backend system. Which activity is MOST useful?

1. Usability testing
2. Performance benchmarking
3. Attack-path and threat-model analysis
4. Database indexing

Correct Answer: 3. Attack-path and threat-model analysis

Explanation:

Threat modeling helps teams examine how an attacker might cross trust boundaries, exploit exposed interfaces, abuse privileges, or pivot between components. Mapping attack paths from public entry points to sensitive assets can reveal missing controls such as segmentation, authorization, input validation, or monitoring. Performance and usability testing do not directly evaluate attacker behavior.

Question 44.

A software application uses a third-party authentication library that is no longer maintained. What is the BEST response?

1. Keep using it indefinitely because it currently works
2. Disable authentication monitoring
3. Ignore future vulnerabilities in the library
4. Assess the risk and plan migration to a supported alternative

Correct Answer: 4. Assess the risk and plan migration to a supported alternative

Explanation:

Unsupported security components are risky because newly discovered vulnerabilities may never receive fixes. The organization should evaluate current exposure, identify compensating controls if necessary, and plan migration to a maintained library. Security-critical dependencies should be tracked throughout the software lifecycle so end-of-support events do not become unexpected production risks.

Question 45.

Which principle BEST supports checking authorization whenever a protected resource is requested?

1. Complete mediation
2. Open design
3. Economy of mechanism
4. Data minimization

Correct Answer: 1. Complete mediation

Explanation:

Complete mediation requires that every access attempt to a protected resource be checked against applicable authorization policy. A prior successful access should not automatically authorize later requests because permissions or context may have changed. This principle is especially relevant to APIs, object access, and privileged functions where inconsistent checks can lead to authorization bypass.

Question 46.

A development team needs to store user passwords. Which approach is MOST appropriate?

1. Encrypt passwords with a reversible shared key
2. Use a strong adaptive password-hashing function with unique salts
3. Store passwords in plaintext in a protected database
4. Encode passwords using Base64

Correct Answer: 2. Use a strong adaptive password-hashing function with unique salts

Explanation:

Passwords generally should not be stored in recoverable form. Adaptive password-hashing functions are designed to make offline guessing attacks computationally expensive, while unique salts prevent identical passwords from producing identical stored values and reduce the effectiveness of precomputed attacks. Plaintext storage, reversible encryption, and simple encoding provide weaker protection if the credential database is compromised.

Question 47.

A security review finds that an API returns more customer information than the requesting application actually needs. Which principle is MOST directly relevant?

1. Fail secure
2. Separation of duties
3. Data minimization
4. High availability

Correct Answer: 3. Data minimization

Explanation:

Data minimization means collecting, processing, and disclosing only the information necessary for the intended purpose. Returning unnecessary customer attributes increases privacy exposure and breach impact without adding business value. APIs should therefore provide only required fields and enforce authorization at an appropriate level. Minimization can also simplify compliance and reduce downstream security obligations.

Question 48.

A release pipeline permits developers to bypass testing and deploy directly to production. What is the BEST improvement?

1. Increase developer privileges
2. Disable deployment logging
3. Use one shared production account
4. Require controlled deployment gates with testing, approval, and auditability

Correct Answer: 4. Require controlled deployment gates with testing, approval, and auditability

Explanation:

A secure release process should prevent unreviewed code from reaching production. Deployment gates can enforce automated testing, security checks, approvals, artifact integrity verification, and traceability. Emergency paths may exist, but they should still preserve authorization and logging. Direct deployment by developers increases the risk of accidental, malicious, or untested changes reaching production systems.

Question 49.

Which activity BEST supports secure software requirements traceability?

1. Linking each security requirement to design controls, implementation, and verification evidence
2. Recording only the final test results
3. Documenting only functional requirements
4. Removing outdated requirements without review

Correct Answer: 1. Linking each security requirement to design controls, implementation, and verification evidence

Explanation:

Traceability helps ensure that each requirement is addressed throughout the lifecycle. A requirement should map to architecture or design decisions, implementation mechanisms, and test evidence showing that it works as intended. This makes gaps easier to identify and supports audits, change impact analysis, and maintenance. Traceability also prevents security requirements from being lost as the software evolves.

Question 50.

A web application uses a random anti-forgery token for state-changing requests. Which attack is this control primarily intended to reduce?

1. SQL injection
2. Cross-site request forgery
3. Buffer overflow
4. Path traversal

Correct Answer: 2. Cross-site request forgery

Explanation:

Cross-site request forgery tricks an authenticated user’s browser into sending an unwanted request to an application. Anti-forgery tokens help the server verify that a state-changing request originated from an expected application context rather than a malicious external page. SameSite cookie attributes, reauthentication for sensitive actions, and proper request validation can provide additional protection depending on the application’s architecture.

Question 51.

A security test shows that an application trusts a user-supplied role value sent from the browser. What is the MAIN weakness?

1. Insufficient encryption
2. Excessive logging
3. Authorization decisions are relying on untrusted client-side data
4. Weak availability design

Correct Answer: 3. Authorization decisions are relying on untrusted client-side data

Explanation:

Client-controlled values can be modified by an attacker and should not be trusted for authorization. Roles, privileges, and access decisions should be derived from trusted server-side identity or policy information. Client-side values may be useful for display purposes, but the server must independently verify permissions before performing protected actions. Otherwise, attackers may escalate privilege simply by modifying request parameters.

Question 52.

Which approach BEST protects sensitive configuration secrets in a CI/CD environment?

1. Place secrets directly in build scripts
2. Store secrets in source repositories
3. Share a single permanent token among all projects
4. Use a protected secrets service with scoped, auditable access

Correct Answer: 4. Use a protected secrets service with scoped, auditable access

Explanation:

CI/CD pipelines frequently need credentials for repositories, artifact stores, deployment targets, or cloud services. These secrets should be stored in a dedicated secrets-management mechanism rather than source code or build scripts. Access should be narrowly scoped, auditable, and preferably short-lived. The pipeline itself should be treated as sensitive infrastructure because compromise can affect many downstream systems.

Question 53.

What is the PRIMARY purpose of dynamic application security testing?

1. Identify security weaknesses by interacting with a running application
2. Replace secure coding standards
3. Analyze source code without execution
4. Measure developer productivity

Correct Answer: 1. Identify security weaknesses by interacting with a running application

Explanation:

Dynamic application security testing evaluates a running application from the outside or through exposed interfaces. It can identify issues such as input-validation flaws, authentication weaknesses, configuration problems, and some forms of injection. Because it observes application behavior during execution, it complements static analysis and code review. No single testing method should be relied upon to find every vulnerability.

Question 54.

A software team wants to reduce the risk that users remain authenticated after leaving a shared workstation unattended. Which control is MOST appropriate?

1. Increase session lifetime
2. Use appropriate idle timeouts and require reauthentication for sensitive actions
3. Store session tokens permanently
4. Disable logout functionality

Correct Answer: 2. Use appropriate idle timeouts and require reauthentication for sensitive actions

Explanation:

Idle session timeouts reduce the period during which an unattended authenticated session can be misused. High-risk actions may also require reauthentication or step-up verification even within an active session. Timeout values should balance usability with the sensitivity of the application and operating environment. Sessions should also be invalidated properly when users log out or credentials are revoked.

Question 55.

Why should security teams verify the provenance of third-party software packages?

1. To determine whether the package has the shortest name
2. To improve user-interface performance
3. To gain confidence that the component originated from an expected and trustworthy source
4. To eliminate the need for vulnerability scanning

Correct Answer: 3. To gain confidence that the component originated from an expected and trustworthy source

Explanation:

Software provenance helps establish where a component came from and whether it passed through an approved build or distribution process. This can reduce the risk of dependency substitution, repository compromise, or tampered packages. Provenance should be combined with integrity verification, vulnerability monitoring, approved repositories, and lifecycle management. It does not replace other software-supply-chain controls.

Question 56.

A team discovers that its error handler reveals stack traces and internal database queries to users. What is the BEST correction?

1. Display even more debugging detail
2. Disable all diagnostic information permanently
3. Send passwords with every error report
4. Return generic user-facing errors and record detailed diagnostics in protected logs

Correct Answer: 4. Return generic user-facing errors and record detailed diagnostics in protected logs

Explanation:

Detailed technical errors can reveal implementation details useful to attackers, including file paths, libraries, queries, and internal logic. Users generally need only enough information to understand that a request failed. Detailed diagnostics should be captured securely for authorized troubleshooting, with sensitive information excluded or masked. This approach preserves operational visibility without unnecessarily disclosing internal details.

Question 57.

What is the MAIN purpose of fuzz testing?

1. Discover unexpected behavior by supplying malformed, random, or boundary-case inputs
2. Replace all functional testing
3. Measure network throughput
4. Create user documentation

Correct Answer: 1. Discover unexpected behavior by supplying malformed, random, or boundary-case inputs

Explanation:

Fuzz testing exercises software with unusual, malformed, or unexpected inputs to uncover crashes, memory errors, validation weaknesses, parsing problems, and other defects. It is particularly useful for parsers, protocols, file formats, and input-heavy interfaces. Fuzzing complements code review, static analysis, and conventional testing because it can expose behaviors developers did not explicitly anticipate.

Question 58.

A software team must securely compare authentication tokens. Which implementation concern is MOST relevant when protecting against timing attacks?

1. Use longer variable names
2. Use comparison routines designed to avoid data-dependent timing differences
3. Disable authentication logs
4. Convert tokens to uppercase first

Correct Answer: 2. Use comparison routines designed to avoid data-dependent timing differences

Explanation:

Some naive comparison functions return as soon as they encounter the first difference. This can create measurable timing variations that may leak information about secret values. Security-sensitive token, MAC, or signature comparisons should use constant-time or otherwise timing-resistant routines provided by trusted libraries when appropriate. Developers should avoid inventing custom cryptographic comparison logic.

Question 59.

A vulnerability is fixed in one branch of a software product but remains in other supported versions. What should the security team do?

1. Assume all versions are fixed automatically
2. Close the issue after the first patch
3. Identify all affected supported versions and ensure each is remediated or otherwise addressed
4. Stop tracking the vulnerability

Correct Answer: 3. Identify all affected supported versions and ensure each is remediated or otherwise addressed

Explanation:

Security defects can affect multiple maintained versions of a product. Remediating one branch does not automatically protect others. The organization should determine affected releases, provide patches or mitigations where required, communicate appropriately, and verify that fixes are applied consistently. Vulnerability management should account for the complete supported product lifecycle rather than a single development branch.

Question 60.

Which practice BEST reflects mature secure software maintenance?

1. Stop security testing after release
2. Ignore vulnerabilities in third-party dependencies
3. Patch only after successful exploitation
4. Continuously monitor vulnerabilities, dependencies, configuration, and changing threats throughout support

Correct Answer: 4. Continuously monitor vulnerabilities, dependencies, configuration, and changing threats throughout support

Explanation:

Software security responsibilities continue after deployment. New vulnerabilities may be discovered in application code, third-party components, platforms, and infrastructure. Mature maintenance includes monitoring advisories, assessing exposure, patching or mitigating issues, verifying fixes, and reassessing security assumptions as threats and requirements change. Secure software remains actively managed until it is formally retired.