A security engineer is analyzing a binary for signs of malicious code. The engineer runs a tool that calculates the entropy of various sections of the binary and finds a section with unusually high entropy. What does this finding most likely indicate?

The binary contains obfuscated or encrypted code

The binary is signed with a valid certificate

The binary contains a known vulnerability

The binary was compiled with debug symbols

A security analyst is reviewing a Java web application and finds that user-supplied input is concatenated directly into SQL queries. The analyst wants to reference a standard list of common weaknesses to justify the finding to the development team. Which resource should the analyst use?

CWE (Common Weakness Enumeration)

NVD (National Vulnerability Database)

Which code characteristic is an indicator of a potential backdoor?

A hidden hardcoded password that bypasses normal authentication

A comment explaining the purpose of a complex algorithm

A well-documented function for password reset

A variable name that is descriptive and meaningful

A development team is integrating a third-party library into their application. The library has a known vulnerability, but a patched version is available. The team is concerned about the effort required to update. What is the best course of action?

Fork the library and fix the vulnerability yourself.

Update to the patched version and test the application for compatibility.

Remove the library and rewrite the functionality.

Use the vulnerable version and add a compensating control.

What is the primary purpose of Static Application Security Testing (SAST)?

To test the application by simulating real-world attacks

To scan compiled binaries for malware signatures

To monitor application behavior in production

To detect security flaws by analyzing source code without executing it

Certified Secure Software Lifecycle Professional

Domain 5Objective 2

Analyze Code for Security Risks CSSLP Practice Questions (Page 3)

Part of the Secure Software Implementation domain, which accounts for 14% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~10–17 in this domain), expect 2–3 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

5concepts

14%of the exam

Questions 11–15

11application · medium
A security engineer is analyzing a binary for signs of malicious code. The engineer runs a tool that calculates the entropy of various sections of the binary and finds a section with unusually high entropy. What does this finding most likely indicate?
Select an answer first
12application · medium
A security analyst is reviewing a Java web application and finds that user-supplied input is concatenated directly into SQL queries. The analyst wants to reference a standard list of common weaknesses to justify the finding to the development team. Which resource should the analyst use?
Select an answer first
13foundation · easy
Which code characteristic is an indicator of a potential backdoor?
Select an answer first
14application · medium
A development team is integrating a third-party library into their application. The library has a known vulnerability, but a patched version is available. The team is concerned about the effort required to update. What is the best course of action?
Select an answer first
15foundation · easy
What is the primary purpose of Static Application Security Testing (SAST)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.