Adhere to Relevant Secure Coding Practices (e.g., Standards, Guidelines, Regulations) CSSLP Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is tokenization in the context of data security?

   • AHashing data to a fixed-length string.
   • BReplacing sensitive data with a non-sensitive equivalent (token) that has no exploitable value.
   • CMasking data by showing only the last four digits.
   • DEncrypting data with a strong algorithm.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A cloud provider hosts a multi-tenant application where each customer uploads and processes documents. A security review found that a vulnerability in the document parser could allow an attacker to read another customer's data. The team must isolate each customer's processing without significant performance overhead. Which isolation mechanism best meets this requirement?

   • AUse a separate virtual machine for each customer
   • BRun all customers in a single process and rely on the application's access control checks
   • CRun each customer's document processing in a separate container with a read-only filesystem and no host mounts
   • DUse Intel SGX enclaves to encrypt each customer's data in memory
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the purpose of ARM TrustZone?

   • ATo manage power consumption.
   • BTo provide a secure world and a normal world on the processor, isolating trusted applications from the main OS.
   • CTo provide a virtual machine monitor.
   • DTo increase the clock speed of the processor.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A retail company stores credit card numbers in a database for recurring billing. To reduce the scope of PCI DSS compliance, the company wants to avoid storing the actual card numbers after the initial transaction. However, the billing system needs to reference the card for future charges. Which approach should the company implement?

   • AStore the card number in a separate database with restricted access
   • BEncrypt the card number with AES-256 and store the key in the application's configuration file
   • CReplace the card number with a token issued by the payment processor and store the token in the database
   • DHash the card number with SHA-256 and store the hash for future reference
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A software team is designing a new application that stores customer PII in a database and transmits it to a third-party API. The compliance team requires that data be protected both at rest and in transit. The team also wants to be able to change algorithms in the future without rewriting the application. Which approach best satisfies these requirements?

   • AUse a proprietary encryption algorithm to protect data in transit and storage
   • BUse TLS 1.2+ for transport and AES-256-GCM for field-level encryption, with the algorithm and key identifiers stored in configuration
   • CUse AES-256-CBC for both transport and storage encryption
   • DEncrypt the entire database with transparent data encryption (TDE) and rely on the network firewall for transit
   Reveal Solution Discussion Select an answer first