What is the purpose of sandboxing?

To increase the performance of applications.

To run untrusted code in a restricted environment to prevent it from harming the host system.

To store data in a secure location.

To allow all code to run with full privileges.

Which statement best describes declarative security?

Security is implemented through code that explicitly checks permissions at runtime.

Security is defined using annotations, attributes, or configuration files that are processed by the framework.

Security relies on the underlying operating system's access control lists.

Security is enforced by a separate security service that intercepts all requests.

What is a key risk of using third-party libraries?

They are always slower than custom code.

They are always incompatible with the application.

They require a license that is too expensive.

They may contain vulnerabilities that are not immediately known.

Which pattern is commonly used to ensure resources are released properly in languages like Java or Python?

Ignoring resource release because it is not important.

Using a global variable to track resources.

Using try-with-resources (Java) or context managers (Python).

Relying on the operating system to clean up.

A web application allows users to upload images that are resized on the server. An attacker uploads a large number of images, causing the server to run out of memory and crash. The team must prevent this denial-of-service condition while still allowing legitimate uploads. Which approach best addresses the issue?

Use a queue to process images one at a time

Limit the file size and dimensions before processing, and process images in a separate worker process with a memory limit

Increase the server's memory to handle larger uploads

Catch the out-of-memory exception and return an error to the user

Certified Secure Software Lifecycle Professional

Domain 5Objective 1

Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 1)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

15concepts

14%of the exam

15 Concepts in This Objective

Declarative vs. Imperative Security
Concurrency and Thread Safety
Input Validation and Sanitization
Error and Exception Handling
Output Sanitization and Encoding
Secure Logging and Auditing
Session Management
Trusted and Untrusted APIs and Libraries
Resource Management
Secure Configuration Management
Tokenization
Isolation Mechanisms
Cryptography Implementation
Access Control Models
Processor Microarchitecture Security Extensions

Questions 1–5

1foundation · easy
What is the purpose of sandboxing?
Select an answer first
2foundation · easy
Which statement best describes declarative security?
Select an answer first
3foundation · easy
What is a key risk of using third-party libraries?
Select an answer first
4foundation · easy
Which pattern is commonly used to ensure resources are released properly in languages like Java or Python?
Select an answer first
5expert · hard
A web application allows users to upload images that are resized on the server. An attacker uploads a large number of images, causing the server to run out of memory and crash. The team must prevent this denial-of-service condition while still allowing legitimate uploads. Which approach best addresses the issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.