Apply Security During the Build Process CSSLP Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A development team is building a plugin for a host application. The host application does not support ASLR for plugins, but the team wants to enable DEP for their plugin. They are also concerned about a compiler warning that indicates a potential null-pointer dereference. What should they do?

   • AEnable DEP for the plugin, fix the null-pointer warning, and document that ASLR is not supported by the host.
   • BEnable ASLR anyway and hope the host application handles it.
   • CSuppress the null-pointer warning to avoid delaying the release.
   • DDisable DEP as well because ASLR is not supported.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company distributes a desktop application that is frequently targeted by crackers who remove the license check. The company has tried code signing, but the crackers simply re-sign the modified binary with their own certificate. They now want to make the license check more resistant to tampering. Which approach is most effective?

   • AMove the license check to a remote server and require online activation.
   • BCompile the application with ASLR and DEP enabled.
   • CUse a stronger code-signing certificate with a longer key length.
   • DIntegrate the license check with the application's core logic and use obfuscation and integrity checks that detect modification at runtime.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A team is developing a .NET application that will be distributed to customers. They want to apply obfuscation to protect intellectual property, but they are concerned that obfuscation might break reflection-based features or cause runtime errors. What is the most effective way to mitigate this risk?

   • ARun a comprehensive test suite after obfuscation and configure the obfuscator to exclude types and members that are accessed via reflection.
   • BApply obfuscation only to the release build and not test it.
   • CUse a decompiler to check the obfuscated code for issues.
   • DSkip obfuscation and rely on code signing for protection.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which technique is specifically designed to make it more difficult for an attacker to reverse-engineer the logic of a compiled application?

   • AASLR
   • BCode signing
   • CObfuscation
   • DCompiler warnings
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Why is it important to address compiler warnings during the build process?

   • AWarnings improve the runtime performance of the application
   • BWarnings are required for code signing to work
   • CWarnings can indicate potential security vulnerabilities in the code
   • DWarnings are always errors that prevent the build from completing
   Reveal Solution Discussion Select an answer first