Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A compliance team requires that all authentication failures be logged for security auditing. The application logs the username, timestamp, and source IP address. A privacy review found that the application also logs the password in plaintext when authentication fails. Which change should the team make to the logging implementation?

   • ALog the password only for failed attempts to help users recover their accounts
   • BHash the password before logging it
   • CRemove the password from the log message and keep the username, timestamp, and source IP
   • DMask the password with asterisks in the log
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A web application displays user-generated comments on a public page. A security tester found that a comment containing '<script>alert(1)</script>' executes in a victim's browser. The team wants to fix this while preserving the ability to display basic formatting like bold text. Which approach should they take?

   • AEncode the entire comment as HTML entities before displaying it
   • BAllow a whitelist of safe HTML tags and encode everything else when rendering the comment
   • CRemove all HTML tags from the comment before storing it
   • DUse a blacklist of dangerous tags like <script> and <iframe>
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which technology provides isolation by running applications in separate user-space instances on a shared operating system kernel?

   • ASandboxes
   • BVirtual machines
   • CContainers
   • DSeparation kernels
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of Intel SGX (Software Guard Extensions)?

   • ATo enable virtualization on a processor.
   • BTo create a secure enclave in memory that protects code and data from unauthorized access, even from the operating system.
   • CTo provide hardware acceleration for machine learning.
   • DTo speed up cryptographic operations.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An e-commerce application's checkout process throws an unhandled exception when a user submits a malformed coupon code. The default error page displays the full stack trace, including the database connection string. The team must fix this without losing the ability to diagnose issues. Which approach should they take?

   • ADisable custom errors so the default ASP.NET error page is shown to the user
   • BWrap the entire checkout in a try-catch that returns the exception message to the user
   • CCatch the exception, log the stack trace to a secure server-side log, and return a generic error message to the user
   • DValidate the coupon code format before processing and return a validation error message
   Reveal Solution Discussion Select an answer first