Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is a trust zone?

   • AA type of encryption algorithm.
   • BA network segment with a uniform level of trust for resources and users.
   • CA database that stores user credentials.
   • DA physical location where servers are stored.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the best way to assess the trustworthiness of an open-source library?

   • AReview the library's source code for vulnerabilities.
   • BCheck if the library has a high version number.
   • CCheck if the library is popular.
   • DAssume it is secure because it is open source.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A healthcare application accepts patient names in a web form and later displays them in an HTML report. The development team is implementing a defense-in-depth approach. The application uses role-based access control to restrict who can view reports. Which combination of controls should the team implement to best protect against both stored XSS and SQL injection while maintaining the RBAC model?

   • AStored procedures for all database access and disable client-side scripting in the browser
   • BParameterized queries for database access and HTML-encode all output when rendering patient names
   • CClient-side JavaScript validation and a Web Application Firewall (WAF) in front of the application
   • DInput validation to allow only alphabetic characters and store the data in a separate database schema
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security-conscious organization is building a service that processes cryptographic keys for a high-assurance environment. The service runs on commodity hardware in a cloud environment. The threat model includes a compromised hypervisor or host operating system. The team wants to protect the keys even if the host is compromised. Which technology should they use?

   • AIntel SGX enclaves to keep the keys and processing inside a hardware-protected enclave
   • BA software-based key vault with access control lists
   • CFull-disk encryption on the VM's virtual disk
   • DA hardware security module (HSM) accessed over the network
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is a primary advantage of tokenization over encryption?

   • ATokens can be used for mathematical operations.
   • BTokens are faster to compute than encryption.
   • CTokens are not reversible without access to the tokenization system, reducing the risk of data exposure if stolen.
   • DTokens are smaller than encrypted data.
   Reveal Solution Discussion Select an answer first