ISC2 Certified Secure Software Lifecycle Professional (CSSLP)

Which of the following BEST describes the principle of "least privilege" in secure software design?

• AUsers should have unlimited access to all system resources by default
• BUsers and processes should be granted only the minimum permissions necessary to perform t…
• CAdministrative access should be shared among multiple users to prevent abuse
• DAll users should have the same level of access to maintain consistency

A software application implements defense in depth by using multiple layers of security controls. Which combination represents this approach?

• AUsing only a firewall at the network perimeter
• BImplementing input validation, parameterized queries, and least privilege database accoun…
• CRequiring only a username and password for authentication
• DStoring all data in plaintext for easy access

Which security principle requires that no single individual has complete control over a critical process?

• ALeast privilege
• BSeparation of duties
• CDefense in depth
• DFail secure

In the context of the CIA triad, what does the "A" represent and how is it compromised by a successful Denial of Service (DoS) attack?

• AAuthentication; compromised by stolen credentials
• BAuthorization; compromised by privilege escalation
• CAvailability; compromised by overwhelming system resources
• DAccountability; compromised by insufficient logging

A development team is designing a financial application that handles sensitive customer data. Which approach BEST demonstrates the principle of "fail secure"?

• AWhen an error occurs, the system grants full administrative access to diagnose the problem
• BWhen authentication fails, the system denies access and logs the attempt
• CWhen the database connection is lost, the system displays raw SQL queries to users
• DWhen a file is not found, the system returns a detailed stack trace

An organization implements a system where database administrators cannot modify application code, and developers cannot directly access production databases. This is an example of:

• ARole-based access control only
• BSeparation of duties
• CTwo-factor authentication
• DData encryption at rest

A software architect is designing an access control system. Which design BEST implements the principle of "complete mediation"?

• AChecking user permissions only once during initial login
• BValidating every access request against access control policies every time
• CCaching permission checks for performance and reusing them for 24 hours
• DAllowing access based on user identity without checking specific permissions

Which scenario BEST illustrates a violation of the principle of "psychological acceptability"?

• AA system that requires 20-character passwords changed daily with no repeating characters
• BA system that encrypts all data at rest using AES-256
• CA system that implements role-based access control
• DA system that logs all authentication attempts

During a risk assessment, a team identifies a vulnerability in their web application that could allow SQL injection. The likelihood is rated as "High" and impact as "Critical." What is the NEXT step in the risk management process?

• AImmediately shut down the application
• BEvaluate risk treatment options (mitigate, transfer, accept, or avoid)
• CIgnore the risk since the application is behind a firewall
• DNotify all customers about the vulnerability

A company decides to purchase cyber insurance to cover potential financial losses from data breaches. This risk treatment strategy is known as:

• ARisk mitigation
• BRisk transfer
• CRisk acceptance
• DRisk avoidance

Which formula correctly represents risk calculation in information security?

• ARisk = Threat + Vulnerability
• BRisk = Threat × Vulnerability × Impact
• CRisk = Asset Value - Control Cost
• DRisk = Impact ÷ Likelihood

A development team discovers a critical vulnerability in a legacy module that would cost $500,000 to fix. The probability of exploitation is low (1%), and potential damages are estimated at $100,000. The business decides to monitor but not fix the issue. This is an example of:

• ARisk mitigation
• BRisk avoidance
• CRisk acceptance
• DRisk transfer

In threat modeling, what is the PRIMARY purpose of identifying attack vectors?

• ATo document all possible paths an attacker might use to compromise the system
• BTo eliminate all potential vulnerabilities immediately
• CTo assign blame to development teams for security flaws
• DTo create marketing materials about security features

A software team uses the STRIDE threat modeling methodology. Which threat category would BEST describe a scenario where an attacker modifies a database transaction to change payment amounts?

• ASpoofing
• BTampering
• CRepudiation
• DInformation Disclosure

An organization conducts a quantitative risk analysis and determines the Annualized Loss Expectancy (ALE) for a specific threat is $50,000. A proposed control would reduce the ALE to $10,000 but costs $30,000 annually to implement. What should the organization do?

• AImplement the control because it reduces risk
• BNot implement the control because the cost exceeds the benefit
• CImplement the control regardless of cost for compliance reasons
• DAccept the risk and do nothing

Which regulation requires organizations to implement technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI)?

• AGDPR
• BHIPAA Security Rule
• CSOX
• DPCI DSS

A software company processes credit card payments for e-commerce transactions. Which compliance framework is MANDATORY for protecting cardholder data?

• AISO 27001
• BPCI DSS
• CNIST CSF
• DCOBIT

Under GDPR, which principle requires that personal data be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes?

• AData minimization
• BPurpose limitation
• CStorage limitation
• DAccuracy

Which regulation requires publicly traded companies in the United States to maintain adequate internal controls over financial reporting, including IT general controls?

• AGDPR
• BSOX (Sarbanes-Oxley Act)
• CHIPAA
• DGLBA

A software application handles personal data of EU residents. Under GDPR, which requirement MUST be implemented to ensure lawful processing?

• AData must be encrypted using AES-256 only
• BA valid legal basis for processing must exist, such as consent or legitimate interest
• CData must be stored only in EU data centers
• DAll users must be notified within 72 hours of any security incident

Which secure design principle advocates for keeping the design as simple and small as possible to reduce the attack surface?

• ADefense in depth
• BEconomy of mechanism
• COpen design
• DWeakest link

A system is designed so that access permissions are checked and enforced at multiple layers (web server, application server, and database). This design follows which principle?

• ADefense in depth
• BSingle point of failure
• COpen design
• DLeast common mechanism

Which secure design principle suggests that security should not depend on the secrecy of the design or implementation details?

• ASecurity through obscurity
• BOpen design
• CDefense in depth
• DLeast privilege

A system design ensures that if authentication fails, the default state is to deny access rather than grant it. This is an example of:

• AFail open
• BFail secure (fail safe)
• CFailover
• DFault tolerance

In secure software design, the principle of "least common mechanism" recommends:

• ASharing mechanisms between users to reduce resource consumption
• BMinimizing the amount of mechanism common to more than one user and depended on by all us…
• CUsing the most common security mechanisms available
• DImplementing all security controls in a single shared module

In a Waterfall SDLC model, when should security requirements be defined?

• ADuring the implementation phase
• BDuring the requirements phase, before design begins
• CDuring the testing phase
• DAfter deployment, during maintenance

Which SDLC methodology emphasizes iterative development, frequent feedback, and responding to change over following a rigid plan?

• AWaterfall
• BAgile
• CV-Model
• DSpiral

A development team releases software updates to production multiple times per day with automated testing and deployment. Which methodology BEST describes this approach?

• ATraditional Waterfall
• BContinuous Integration/Continuous Deployment (CI/CD)
• CBig Bang deployment
• DManual release management

In the Spiral SDLC model, what is the primary focus of each iteration cycle?

• AWriting the maximum amount of code possible
• BRisk analysis and risk mitigation
• CAvoiding all documentation
• DEliminating the need for testing

A software project requires extensive documentation, has well-defined requirements that are unlikely to change, and must comply with strict regulatory standards. Which SDLC model is MOST appropriate?

• AAgile/Scrum
• BWaterfall or V-Model
• CExtreme Programming (XP)
• DKanban

Which characteristic distinguishes the DevOps approach from traditional development and operations models?

• AComplete separation between development and operations teams
• BCollaboration, automation, and shared responsibility between development and operations
• CReleasing software only once per year
• DEliminating all security controls to speed up deployment

In an Agile development environment, when should security testing be performed?

• AOnly at the end of the project before release
• BContinuously throughout each sprint
• COnly during the first sprint
• DOnly when security issues are discovered in production

What is the PRIMARY goal of DevSecOps?

• ATo eliminate the need for security professionals
• BTo integrate security practices into the DevOps process from the beginning
• CTo slow down development to ensure security
• DTo separate security from development and operations

Which practice is ESSENTIAL for implementing DevSecOps in a CI/CD pipeline?

• AManual security reviews before every deployment
• BAutomated security testing integrated into the build process
• CWaiting until production to perform security testing
• DRequiring developers to email security teams for approval

A development team uses Infrastructure as Code (IaC) to provision cloud resources. What security benefit does this provide?

• AEliminates the need for security monitoring
• BEnables consistent, repeatable, and auditable infrastructure deployments
• CRemoves the requirement for access controls
• DPrevents all security vulnerabilities automatically

In a DevSecOps pipeline, what is the purpose of a "security gate"?

• ATo permanently block all deployments
• BTo automatically enforce security policies and prevent deployment of non-compliant code
• CTo add manual paperwork to the deployment process
• DTo allow developers to bypass security checks

A team implements automated secrets scanning in their CI/CD pipeline to detect API keys and passwords committed to source code. This is an example of:

• AShifting security left
• BAccepting security debt
• CDeferring security to production
• DManual security testing

Which metric would be MOST valuable for measuring the effectiveness of a DevSecOps program?

• ANumber of security tools purchased
• BMean time to remediate (MTTR) critical vulnerabilities
• CNumber of meetings held with security teams
• DTotal lines of code written

A DevSecOps team implements "immutable infrastructure" where servers are never modified after deployment. Instead, new instances are deployed with updates. What is the primary security benefit?

• AReduces the attack surface and eliminates configuration drift
• BAllows administrators to log in and make manual changes
• CEliminates the need for vulnerability scanning
• DIncreases the complexity of the infrastructure

Which security artifact documents potential threats to a system, categorizes them by type (e.g., STRIDE), and helps prioritize mitigation efforts?

• ATest plan
• BThreat model
• CUser manual
• DMarketing requirements document

Security requirements should be:

• AAdded only during the maintenance phase
• BDefined early, documented, testable, and traceable throughout the SDLC
• CKept informal to allow flexibility
• DManaged separately from functional requirements

Which document specifies the security testing approach, including what will be tested, how testing will be performed, and the acceptance criteria?

• AThreat model
• BSecurity test plan
• CSoftware architecture document
• DProject budget

A development team creates misuse cases to document how attackers might abuse system functionality. When should misuse cases be developed?

• AOnly after the system is deployed
• BDuring requirements gathering, alongside use cases
• COnly if a security breach occurs
• DDuring the marketing phase

Which security artifact provides a detailed description of the software architecture, including security controls, trust boundaries, and data flow?

• ASource code comments
• BSecure architecture/design document
• CEnd-user license agreement (EULA)
• DSocial media posts

A Software Bill of Materials (SBOM) is important for security because it:

• AReplaces the need for security testing
• BProvides an inventory of all components, libraries, and dependencies for vulnerability ma…
• CHides third-party components from security review
• DEliminates all software vulnerabilities

In project management, what is the PRIMARY purpose of a security risk register?

• ATo list all employees in the security department
• BTo document identified risks, their likelihood, impact, and mitigation plans
• CTo track project budget expenses only
• DTo store user passwords securely