Free Certified Secure Software Lifecycle Professional (CSSLP) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Secure Software Lifecycle Professional (CSSLP) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A diagnostic endpoint exposes customer records to unauthorized visitors without changing the records or interrupting service. Which security objective is directly violated?

   1. A. Availability
   2. B. Confidentiality
   3. C. Integrity
   4. D. Nonrepudiation

   Answer: B

   Explanation: FIPS 199 states, "A loss of confidentiality is the unauthorized disclosure of information." The endpoint discloses records to unauthorized visitors; modification and service disruption are not required.

   Reference: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives, p. 2

2. 2An organization changes from waterfall to Agile development. How should secure development practices be incorporated?

   1. A. Confine them to the final release sprint.
   2. B. Apply them only to projects using waterfall.
   3. C. Integrate them throughout the selected lifecycle.
   4. D. Replace them with operational monitoring after release.

   Answer: C

   Explanation: NIST states, "Regardless of which SDLC model is used, secure software development practices should be integrated throughout it". A methodology change does not remove lifecycle-wide security work.

   Reference: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, Introduction, p. 1

3. 3Which security requirement gives a directly assessable performance target?

   1. A. The application should authenticate users quickly.
   2. B. Authentication should have excellent responsiveness.
   3. C. Authentication must complete within two seconds under the specified test load.
   4. D. Authentication should use the fastest technology available.

   Answer: C

   Explanation: NIST calls for "security-driven performance and assurance measures that enable the assessment of technical achievement." A defined response time and load provide a measurable target; the other descriptions lack assessable criteria.

   Reference: Engineering Trustworthy Secure Systems — Appendix H.3.3, SR-3.2, p. 122

4. 4An organization wants to consume a provider's finished application without managing its operating system. Which cloud service model fits that architectural boundary?

   1. A. Infrastructure as a Service
   2. B. Software as a Service
   3. C. Platform as a Service
   4. D. A self-managed virtual machine

   Answer: B

   Explanation: NIST defines SaaS as using "the provider’s applications running on a cloud infrastructure". The provider supplies the finished application; the consumer does not manage its underlying operating system.

   Reference: The NIST Definition of Cloud Computing — Section 2, Service Models, SaaS, p. 2

5. 5An application uses an untrusted search value in a SQL data predicate. Which implementation separates that value from SQL syntax?

   1. A. Concatenate the value before preparing the statement.
   2. B. Remove spaces and concatenate the remaining value.
   3. C. Bind the value as a parameter in a fixed query.
   4. D. Base64-encode the value and concatenate it.

   Answer: C

   Explanation: OWASP states, "Prepared statements treat bound values as data rather than SQL syntax." The structure must be fixed separately; preparing an already concatenated query does not provide that separation.

   Reference: SQL Injection Prevention Cheat Sheet — Defense Option 1: Prepared Statements

6. 6A testing strategy derives cases from requirements without using the implementation's internal structure. Which testing approach is this?

   1. A. Static source analysis
   2. B. Black-box testing
   3. C. Structural coverage testing
   4. D. Manual source inspection

   Answer: B

   Explanation: NIST states that black-box "tests are not based on the implementation or the particular code." Their basis is specifications, requirements, and observable behavior.

   Reference: Guidelines on Minimum Standards for Developer Verification of Software — Section 2.6, Black Box Test Cases, p. 7

7. 7A deployment moves a verified application into a site with different physical access and network arrangements. How should operational risk analysis treat the new site?

   1. A. Reuse prior site security assumptions because application code is unchanged.
   2. B. Identify changed site conditions and required security protections.
   3. C. Treat successful test-site deployment as proof of operational-site security.
   4. D. Limit the assessment to the application’s existing code-verification results.

   Answer: B

   Explanation: NIST directs teams to "Identify and define any security-relevant facility or site changes needed." A verified application does not by itself establish the security of a different operational site.

   Reference: Engineering Trustworthy Secure Systems — Appendix H.10.3, TR-1.2, p. 136

8. 8A supply chain risk team cannot distinguish mission-critical suppliers from routine suppliers. How should it organize supplier information to support risk-based prioritization?

   1. A. Map supplier relationships and supplied products to mission dependencies.
   2. B. Rank suppliers by total spending without mapping dependent services.
   3. C. Group suppliers by purchase volume without identifying critical functions.
   4. D. Classify all suppliers by contract duration rather than operational dependency.

   Answer: A

   Explanation: NIST states: "A critical first step is to ensure that there is a current and accurate inventory of the enterprise’s supplier relationships, contracts, and any products or services those suppliers provide." Mapping this inventory permits criticality-based grouping and prioritization.

   Reference: Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations — Section 3.1.1, supplier inventory and segmentation, p. 39

9. 9An attacker changes stored payment instructions while the application remains accessible and the data remains undisclosed. Which security objective is directly violated?

   1. A. Integrity
   2. B. Availability
   3. C. Confidentiality
   4. D. Accountability

   Answer: A

   Explanation: FIPS 199 states, "A loss of integrity is the unauthorized modification or destruction of information." Altering payment instructions is unauthorized modification, irrespective of continued access.

   Reference: Standards for Security Categorization of Federal Information and Information Systems — Section 3, Security Objectives, p. 2

10. 10A team reviews security requirements during planning instead of first reviewing them after implementation. What is the principal expected benefit of shifting this work left?

    1. A. Reducing later rework and cost for the same security level
    2. B. Keeping total security effort unchanged by moving work between phases
    3. C. Increasing redesign costs because security is considered before coding
    4. D. Reducing planning effort by postponing protection decisions

    Answer: A

    Explanation: NIST explains, "the earlier in the SDLC that security is addressed, the less effort and cost is ultimately required to achieve the same level of security." This is an expected cost benefit, not a guarantee or permission to omit later work.

    Reference: Secure Software Development Framework (SSDF) Version 1.1 — Section 1, Introduction, p. 1