CSSLP Secure Software Prep Exam Questions & Answers 2026 (11–20)

✓ Correct answer: A. Adaptive

Answer: Adaptive The NIST Cybersecurity Framework provides a policy framework for computer security guidance to private sector organizations. The framework is divided into five functions: Identify, Protect, Detect, Respond, and Recover. These functions help organizations manage cybersecurity risk by organizing information, enabling risk management decisions, addressing threats, and improving by learning from past actions. The levels of implementation tiers described in the framework are: Tier Description Tier 1: Partial Cybersecurity risk management is not formalized and may be ad hoc. Tier 2: Risk Informed Risk management practices are approved by management but lack consistency and alignment with organizational risk strategy. Tier 3: Repeatable Formal policy and processes are consistently followed and organizational-wide. Tier 4: Adaptive The organization adapts its cybersecurity practices based on lessons learned and predictive indicators derived from previous cybersecurity activities.

✓ Correct answer: A. Checksum

Answer: Checksum. Several methods can be used to ensure the authenticity and integrity of a message, including: Digital Signature: A digital signature is a cryptographic value that is calculated from the data and a secret key known only by the sender. It is highly effective for both authenticity and integrity. Hashing: Hashing involves using a hash function to convert the data into a fixed-size string of characters. Even a small change in the input will produce a significantly different output, making it effective for ensuring integrity. Message Authentication Code (MAC): A MAC is created using a secret key and can be used to verify the integrity and authenticity of a message. It is more secure than a simple checksum. Checksum: A checksum is a simple error-detection scheme that can detect accidental errors in data. It is less effective against intentional tampering as it does not use cryptographic methods.

✓ Correct answer: D. Trade secret

Answer: Trade secret Intellectual property (IP) can be protected in various ways, including: 1. Patent: A patent provides exclusive rights to an invention for a specified period of time. Patents can prevent others from using the invention even if they claimed to have invented it independently. 2. Copyright: Copyright protects written works and artistic expression from being used or copied without the creator's consent and proper attribution. They limit adaptations, performances, and who can profit from the work. 3. Trademark: Trademark protects brand association and can be either registered or common-law. Images and company names are commonly trademarked items. 4. Trade Secret: A trade secret is intellectual property that is protected only as long as it remains secret. The formula for a computer software algorithm that provides a competitive edge is often protected as a trade secret.

✓ Correct answer: C. Bug bounties

Bug bounties use a public challenge system to incentivize security researchers to discover and report vulnerabilities in software applications. This approach often includes cash rewards or other incentives based on the severity of the flaws found.

✓ Correct answer: D. Functional

Answer: Functional. Secure software testing is classified as functional or non-functional. Functional testing verifies that the software performs its intended functions, while non-functional testing ensures aspects like performance, usability, and reliability.

✓ Correct answer: D. JSON Injection

Answer: JSON Injection. JSON Injection vulnerabilities occur when user input is not properly sanitized and is included within server-sent JSON data. Attackers can craft malicious inputs that alter the structure of JSON data, potentially leading to data exposure, data modification, or execution of arbitrary code. Injection vulnerabilities are a significant category of security flaws and include many types, such as: Type Description SQL Injection SQL injection attacks involve providing malicious input that is included in a database request. SQL injection can read, write, or delete data contained within a database accessible to a vulnerable application. Command Injection Command injection vulnerabilities allow an attacker to run commands in the system terminal. For example, an application may run a command in the shell using user-provided input, which may be crafted to change the intent of the command or run additional commands. Integer Overflow Integers have a fixed size in memory and are only able to store a certain range of values. If a value to be stored in a variable exceeds this range, it wraps around and is interpreted as a smaller value. Path Traversal In a filepath, ../ indicates that the system should look in the next directory up in the file system. Path traversal vulnerabilities allow an attacker who can specify the name of a file to be read/written by an application to read/write files outside of the intended directory. JSON Injection User-provided input should be properly sanitized and encoded before being included in JSON data. Exploits can occur when unsanitized input is included within server-sent JSON data. Cross-Site Request Forgery (CSRF) Cross-site request forgery (CSRF) attacks involve tricking the browser of an authenticated user into performing an HTTP request without their knowledge/consent. For example, a user logged into social media could have their password changed if a malicious webpage tricked their browser into performing a password change request and the social media site lacked CSRF protections.

✓ Correct answer: A. Use of blacklisting

Answer: Use of blacklisting In secure software development, blacklisting should be considered a last resort. Here's why: Practice Description Priority Input validation Ensuring data is accurate and safe before use. High Use of whitelisting Only allowing known good inputs, blocking all others. High Error handling Managing errors gracefully without exposing sensitive information. High Use of blacklisting Blocking known bad inputs; however, new threats may bypass it. Low Blacklisting is considered less effective as it relies on blocking known bad inputs, which may not cover all potential threats. Whitelisting and input validation are preferred as they provide a broader security coverage.

✓ Correct answer: B. Inefficient Code

Answer: Inefficient Code During code reviews, developers assess code for various issues including inefficiencies. Complex or obfuscated code is categorized as Inefficient Code because it hinders code readability, maintainability, and performance. Common checks in a code review include: Inefficient Code: Simplifying complex or obfuscated code to enhance analysis or execution. Known Vulnerabilities: Checking code against vulnerabilities listed in resources like OWASP Top 10. Errors and Exception Handling: Ensuring code tests for all possible error cases and handles exceptions effectively. Injection Flaws: Implementing input validation to protect against injection attacks. Cryptographic Strength: Using trusted algorithms and libraries for cryptographic operations. Unsafe and Deprecated Function Calls: Using only approved functions and removing deprecated or unnecessary ones. Privilege Levels: Following the principle of least privilege when implementing code. Logging: Properly logging errors without revealing sensitive information. Secure Key Information: Protecting cryptographic keys, passwords, and similar authentication data.

✓ Correct answer: C. Design

Answer: Design A comprehensive threat model should be established during the design phase of the secure software development lifecycle. This phase involves identifying potential threats, vulnerabilities, and potential impacts on the system. Establishing a threat model early allows the team to integrate security measures effectively from the beginning. The main phases of a secure software development lifecycle are: Planning: Define security requirements and objectives. Design: Develop a comprehensive threat model and security architecture. Implementation: Write secure code and conduct code reviews. Testing: Perform security testing, such as penetration testing. Deployment: Ensure secure deployment and configuration. Maintenance: Monitor and maintain security practices.

✓ Correct answer: C. Copyleft

Answer: Copyleft Third-party software may operate under various licensing models, including: Copyright: A copyright protects the intellectual property of the author, restricting how it can be used Permissive: Permissive licenses (MIT, BSD, etc.) impose minimal requirements on how software can be used or redistributed Copyleft: Copyleft licenses (GPL, etc.) ensure that software using the original source code provides the same rights to the user, meaning any modified versions must also be freely available under the same license Open is not a licensing model.