Develop Misuse and Abuse CSSLP Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A DevOps platform provides a webhook feature that sends HTTP POST requests to user-specified URLs. The threat model identified a misuse case where a user configures a webhook to point to an internal IP address (e.g., 169.254.169.254) to access cloud metadata and steal credentials. Which mitigating control is most effective?

   • ARequire the user to authenticate before configuring a webhook.
   • BLog all webhook delivery attempts for audit purposes.
   • CRate-limit webhook deliveries to prevent abuse.
   • DBlock webhook deliveries to private, link-local, and loopback IP addresses.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A misuse case describes an attacker exploiting a file upload feature to place a malicious executable on the server. Which mitigating control is most directly aligned with this abuse case?

   • ALog all upload attempts for audit purposes
   • BRestrict uploaded files to a whitelist of allowed extensions and MIME types
   • CRate-limit the upload endpoint
   • DEncrypt the uploaded files at rest
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   An e-commerce platform is adding a 'remember me' feature. The team identified a misuse case where an attacker with temporary physical access to a logged-in user's device could use the persistent cookie to access the account after the user leaves. The product owner wants to balance usability with security. Which mitigating control should be specified?

   • AStore the persistent token in localStorage instead of a cookie.
   • BUse a persistent cookie with a long expiration and no additional checks.
   • CIssue a persistent token that is invalidated after a period of inactivity or on explicit logout.
   • DRequire the user to re-authenticate only when accessing account settings.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A healthcare SaaS provider is designing a patient portal. The team identified a misuse case where an authenticated patient could tamper with URL parameters to view another patient's medical records (IDOR). The development team wants a control that is effective regardless of how the client constructs requests. Which mitigating control should the security lead specify?

   • AUse URL rewriting to obscure the patient ID with a random token.
   • BEnforce server-side authorization checks that verify the authenticated user has permission to access the requested resource.
   • CImplement client-side JavaScript to disable editing of URL parameters.
   • DAdd a hidden field to the form containing the patient ID and validate it server-side.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A healthcare application allows patients to book appointments. The team identified a misuse case where an attacker performs a denial-of-service attack by submitting hundreds of appointment requests in a short period, exhausting the booking system's resources. The system must remain available for legitimate users during the attack. Which mitigating control is most appropriate?

   • AImplement rate limiting per user account and per IP address.
   • BBlock all traffic from the attacker's IP address after detecting the attack.
   • CIncrease the server capacity to handle the peak load.
   • DAdd a CAPTCHA to the appointment booking form.
   Reveal Solution Discussion Select an answer first