Develop Misuse and Abuse CSSLP Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A content management system allows authors to upload images. The threat model identified a misuse case where an author uploads a file with a .html extension disguised as an image, which is then served to other users, enabling stored XSS. The team needs a control that prevents the file from being interpreted as active content. Which control is most effective?

   • AValidate the file's MIME type based on the file extension.
   • BScan the file with an antivirus before storing it.
   • CStore the file outside the web root and serve it via a script that forces a download and sets a non-executable Content-Type.
   • DRename the uploaded file to a random name with a .jpg extension.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A cloud-native application uses AWS Lambda functions to process user-uploaded images. The threat model identified a misuse case where a user uploads a malicious image that exploits a vulnerability in the image-processing library, allowing arbitrary code execution in the Lambda environment. The team must select a control that minimizes the blast radius of this attack. Which control is most appropriate?

   • AIncrease the Lambda function's memory and timeout to handle larger images.
   • BRun the image-processing code in a separate Lambda function with a minimal IAM role and no VPC access.
   • CUse a more secure image-processing library that has no known vulnerabilities.
   • DScan the image with an antivirus before processing.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A web application allows users to upload profile pictures. The team identified a misuse case where an attacker uploads a polyglot file that is both a valid image and a valid HTML page, leading to stored XSS when the file is served. The team must select a control that prevents the file from being rendered as HTML while still allowing the image to be displayed. Which control is most appropriate?

   • AUse a Content Security Policy (CSP) that disallows inline scripts.
   • BStore the file with a .txt extension and serve it as text/plain.
   • CRe-encode the uploaded image using a server-side image library and serve the re-encoded version.
   • DServe the uploaded file with a Content-Type of image/png and a Content-Disposition of inline.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A mobile banking app allows users to reset their password via SMS. The threat model identified a misuse case where an attacker performs SIM swapping to intercept the OTP and take over the account. The team must select a mitigating control that reduces the risk of this specific attack. Which control is most appropriate?

   • ARequire the user to answer a knowledge-based security question before sending the OTP.
   • BShorten the OTP validity period to 30 seconds.
   • CSend the OTP via email instead of SMS.
   • DUse a push notification to a registered device that requires biometric confirmation for password resets.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company's internal tool uses a shared service account to access a third-party API. The threat model identified a misuse case where a developer exfiltrates the API key from the source code and uses it to make unauthorized calls, incurring high costs. The team must select a control that prevents the key from being exposed in source code while allowing the application to authenticate. Which control is most appropriate?

   • AEncrypt the API key and store the decryption key in the source code.
   • BHardcode the API key in the application's configuration file.
   • CStore the API key in a secrets manager and inject it as an environment variable at runtime.
   • DUse a short-lived API key that is rotated daily.
   Reveal Solution Discussion Select an answer first