Apply Security During the Build Process CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of code signing in the software build process?

   • ATo verify the identity of the software publisher and ensure the code has not been altered
   • BTo compress the software to reduce download size
   • CTo encrypt the software so that only authorized users can run it
   • DTo obfuscate the code to prevent reverse-engineering
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which compiler flag treats all warnings as errors, forcing developers to fix them?

   • A-g
   • B-O2
   • C-Werror
   • D-Wall
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A software vendor distributes a desktop application via direct download. To protect against an attacker modifying the binary and redistributing it with malware, the build team wants to ensure that any tampering is detected by the end user's operating system before execution. Which combination of build-time actions best achieves this?

   • AEmbed a hash of the executable in the file's version resource and verify it at runtime.
   • BSign the executable with a code-signing certificate and enable the /DYNAMICBASE and /NXCOMPAT compiler switches.
   • CEnable stack protection and compile with all warnings treated as errors.
   • DObfuscate the executable with a commercial protector and strip debug symbols from the release build.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A mobile app development team wants to protect their app's API keys from being easily extracted by static analysis of the binary. They also want to make it harder for an attacker to patch the app to remove license restrictions. Which build-time technique is most effective for both goals?

   • AApply obfuscation that encrypts strings and adds integrity checks on critical methods.
   • BEnable the compiler's stack protection and ASLR.
   • CCompile with the highest optimization level and strip all debug information.
   • DSign the app with a code-signing certificate.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company develops a proprietary algorithm for a client-side application. They are concerned about competitors extracting the algorithm through reverse engineering. The build team wants to make the code significantly harder to analyze while maintaining the application's functionality. Which approach should they take during the build process?

   • AApply an obfuscator that renames symbols, flattens control flow, and encrypts string literals.
   • BMove the algorithm to a separate DLL and load it dynamically at runtime.
   • CCompile with the /O2 optimization flag and disable debug information.
   • DSign the assembly with a strong-name key and enable Authenticode signing.
   Reveal Solution Discussion Select an answer first