Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A startup is building a mobile payment app and wants to use an open-source cryptography library to handle encryption. The library is popular but has not had a release in 18 months. The team's security lead is concerned about supply-chain risk. The team has limited time and must integrate the library this sprint. Which action best balances security risk with the delivery constraint?

   • AUse the latest version of the library without review because it is widely used and considered trustworthy
   • BReplace the library with a custom implementation of the same cryptographic algorithms
   • CPin the library to the exact version, verify the checksum, and review the source code for known vulnerabilities before integrating
   • DFork the library and maintain a private copy with custom patches
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A development team is building a .NET web API for a government agency. The security team requires that all endpoints enforce authentication and that role-based authorization be applied consistently. The team wants to minimize the risk of a developer forgetting to add an authorization check to a new endpoint. Which approach best meets this requirement?

   • ARely on the API gateway to enforce authentication and authorization for all incoming requests
   • BApply an authorization attribute at the controller level and use role-based attributes on individual actions
   • CUse a custom middleware that checks the user's role against a hardcoded list of allowed endpoints
   • DAdd an authorization check in the first line of every action method using a helper function
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which cryptographic algorithm is considered secure for encrypting data at rest?

   • AMD5
   • BAES-256
   • CDES
   • DRC4
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A web application allows users to stay logged in across browser restarts. The session cookie is currently set without an expiration time, so it is a session cookie. Users are complaining that they are logged out every time they close the browser. The team wants to implement persistent sessions securely. Which approach should they take?

   • AStore the session data in the cookie itself with no server-side state
   • BSet a persistent cookie with a reasonable expiration and store the session data server-side with a matching timeout
   • CSet the cookie's expiration to a very long time, such as 10 years
   • DUse a session cookie and rely on the browser's 'remember me' feature
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A document management system needs to allow users to share files with specific colleagues. The system currently uses a single role-based access control (RBAC) model where users are assigned roles like 'Editor' and 'Viewer'. The product owner wants users to be able to grant access to individual files to other users. Which approach should the team implement to satisfy this requirement?

   • AUse mandatory access control (MAC) with labels on each file
   • BCreate a new role for each file and assign users to that role
   • CAllow any user with the 'Editor' role to access all files
   • DAdd a discretionary access control (DAC) layer that allows file owners to grant permissions to specific users
   Reveal Solution Discussion Select an answer first