Apply Security During the Build Process CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A development team is building a web server plugin in C that handles untrusted HTTP headers. They want to mitigate the risk of code execution via return-oriented programming (ROP) attacks. Which compiler switch should they enable?

   • A/WX (treat warnings as errors)
   • B/guard:cf (Control Flow Guard)
   • C/MD (dynamic CRT)
   • D/O1 (minimize size)
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which of the following is a common obfuscation technique?

   • AUsing descriptive function names
   • BRenaming variables to meaningless identifiers
   • CAdding comments to explain complex logic
   • DRemoving all whitespace to reduce file size
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A team is developing a Java application that will be distributed to customers. They want to apply obfuscation to protect their algorithms, but they are concerned that obfuscation might break the application's use of reflection to load classes dynamically. They also have a policy that all compiler warnings must be addressed. What is the best approach?

   • AEnable the /WX flag to treat all warnings as errors and fix them before obfuscation.
   • BApply obfuscation and then use a decompiler to verify the code is still correct.
   • CSkip obfuscation and rely on the Java compiler's built-in security features.
   • DConfigure the obfuscator to keep the names of classes and methods that are accessed via reflection, and run a full regression test after obfuscation.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A build engineer notices that the compiler is emitting a warning about a potential buffer overrun in a function that handles user input. The team has a policy that no known vulnerability can be released. What is the most appropriate action?

   • AEnable /GS to add a runtime check and leave the warning as is.
   • BSuppress the warning with a pragma and document it as a known issue.
   • CFix the code to eliminate the warning and enable /WX to prevent future regressions.
   • DIncrease the warning level to /W4 to get more details, but do not change the code.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   During a build, the compiler emits a warning about an uninitialized variable that is later used in a security decision. The team lead wants to ensure this class of issue is not silently ignored in future builds. What is the most effective build configuration change?

   • ASuppress the warning with a pragma to keep the build log clean.
   • BAdd a runtime check that validates the variable's value before use.
   • CEnable the /WX option to treat all warnings as errors.
   • DChange the compiler optimization level to /O1 to reduce false positives.
   Reveal Solution Discussion Select an answer first