Analyze Code for Security Risks CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which practice is most important when reusing an open-source component in a secure software development lifecycle?

   • AUse the component only if it is written in the same language as the project
   • BVerify the component has a permissive license
   • CRegularly monitor the component for newly disclosed vulnerabilities
   • DEnsure the component is popular and widely used
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which technique is commonly used by SAST tools to identify coding flaws?

   • AFuzzing the application with random inputs
   • BSending malicious payloads to the running application
   • CMonitoring network traffic for anomalies
   • DPattern matching against known vulnerability signatures
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security engineer is analyzing a suspicious binary and finds a section of code that is encrypted. The engineer suspects the code is a backdoor. What is the most effective way to analyze the encrypted code?

   • AUse a hex editor to manually decrypt the code.
   • BCheck the binary's entropy and compare it with known malware signatures.
   • CUse a SAST tool to scan the binary for known backdoor signatures.
   • DRun the binary in a debugger and break at the decryption routine.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security team is conducting a manual code review of a payment processing module. The reviewer finds that the code uses a weak hashing algorithm for storing passwords. What is the most appropriate recommendation?

   • AUse a symmetric encryption algorithm to encrypt passwords.
   • BUse a faster hashing algorithm to improve performance.
   • CUse a stronger hashing algorithm such as bcrypt or Argon2.
   • DStore passwords in plain text to simplify the code.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A SAST tool flags a potential buffer overflow in a C++ application. The developer reviews the code and believes it is a false positive because the buffer size is checked before the operation. What should the developer do?

   • AVerify the code manually and, if it is indeed safe, document why it is a false positive.
   • BIgnore the finding because the developer believes it is a false positive.
   • CChange the code to use a different buffer type to avoid the warning.
   • DMark the finding as a false positive in the tool and move on.
   Reveal Solution Discussion Select an answer first