What is cryptographic agility?

The ability to quickly switch between different cryptographic algorithms and parameters.

The ability to encrypt data without a key.

The ability to break cryptographic algorithms.

The ability to use the same key for all encryption.

Which practice helps prevent session hijacking?

Transmitting session IDs over HTTPS.

Accepting session IDs from any source.

A web application allows users to log in and access their profile. A penetration test revealed that an attacker can force a victim's browser to send a request with a known session ID, allowing the attacker to impersonate the victim. The application currently accepts any session ID presented in the cookie. Which change should the team make to prevent this attack?

Set the session cookie's Secure and HttpOnly flags

Use a longer random session ID generated by the server

Store the session ID in a hidden form field instead of a cookie

Generate a new session ID after successful authentication and bind the session to the user's IP address

Why should credentials (e.g., API keys, passwords) not be hardcoded in source code?

Because they are not needed in production.

Because they can be exposed in version control and lead to unauthorized access.

Because they are automatically rotated by the system.

Because it makes the code harder to read.

A web application accepts a 'sort' parameter in the URL to order search results. The parameter is used directly in a SQL query. An attacker submits 'sort=name; DROP TABLE users;--' and the application executes the malicious SQL. Which control should the team implement to prevent this attack?

Escape single quotes in the sort parameter

Remove semicolons and dashes from the sort parameter

Validate the sort parameter against a whitelist of allowed column names

Use parameterized queries for the sort parameter

Certified Secure Software Lifecycle Professional

Domain 5Objective 1

Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 3)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 33 practice questions to prepare you well beyond it. (estimate)

33questions here

7free pages

15concepts

14%of the exam

15 Concepts in This Objective

Declarative vs. Imperative Security
Concurrency and Thread Safety
Input Validation and Sanitization
Error and Exception Handling
Output Sanitization and Encoding
Secure Logging and Auditing
Session Management
Trusted and Untrusted APIs and Libraries
Resource Management
Secure Configuration Management
Tokenization
Isolation Mechanisms
Cryptography Implementation
Access Control Models
Processor Microarchitecture Security Extensions

Questions 11–15

11foundation · easy
What is cryptographic agility?
Select an answer first
12foundation · easy
Which practice helps prevent session hijacking?
Select an answer first
13application · medium
A web application allows users to log in and access their profile. A penetration test revealed that an attacker can force a victim's browser to send a request with a known session ID, allowing the attacker to impersonate the victim. The application currently accepts any session ID presented in the cookie. Which change should the team make to prevent this attack?
Select an answer first
14foundation · easy
Why should credentials (e.g., API keys, passwords) not be hardcoded in source code?
Select an answer first
15application · medium
A web application accepts a 'sort' parameter in the URL to order search results. The parameter is used directly in a SQL query. An attacker submits 'sort=name; DROP TABLE users;--' and the application executes the malicious SQL. Which control should the team implement to prevent this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.