Classify and Track Security Errors CSSLP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   A developer writes a line of code that incorrectly checks user input, allowing a buffer overflow. Which term best describes the developer's action that led to this flaw?

   • AAn error
   • BA defect
   • CA failure
   • DA vulnerability
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of documenting a security bug's lifecycle, from discovery to closure, in a bug tracking system?

   • ATo automatically fix the bug
   • BTo assign a CVE identifier to the bug
   • CTo provide a complete audit trail for compliance and accountability
   • DTo prevent all future bugs
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A development team is using a risk-scoring matrix to prioritize security defects. The matrix scores 'Likelihood' from 1 (rare) to 5 (almost certain) and 'Impact' from 1 (negligible) to 5 (severe). A defect is found in a feature that is rarely used but, if exploited, could lead to a complete database compromise. The team rates the likelihood as 2 and the impact as 5. What is the risk score, and how should it be interpreted?

   • AScore of 5; it is a low-priority risk because the likelihood is low.
   • BScore of 10; it is a high-priority risk that must be fixed immediately.
   • CScore of 7; it is a medium-priority risk that can be scheduled for the next release.
   • DScore of 2.5; it is a low-priority risk that can be accepted.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A QA tester finds that a user can access another user's profile by changing the ID in the URL. The tester logs this as a 'vulnerability'. A developer looks at the code and sees that the application is not checking if the logged-in user owns the profile. The developer fixes the code by adding an authorization check. In this scenario, what was the 'error'?

   • AThe tester's failure to identify the issue as a business logic flaw.
   • BThe developer's mistake of not including an authorization check in the original code.
   • CThe user's action of changing the ID in the URL.
   • DThe lack of a security requirement in the initial project specification.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team is triaging a list of newly discovered vulnerabilities. They have a limited development capacity and can only fix a few issues in the next sprint. The team lead proposes using a risk-scoring model that multiplies the likelihood of exploitation by the potential business impact. Why is this approach more effective than simply prioritizing by the number of affected users?

   • AIt is the only method accepted by regulatory compliance frameworks.
   • BIt simplifies the process by ignoring the technical details of the vulnerability.
   • CIt ensures that all vulnerabilities are fixed, regardless of their severity.
   • DIt provides a single, quantifiable metric that balances the chance of a breach against the cost of a breach to the organization.
   Reveal Solution Discussion Select an answer first