A network device vendor is designing a web-based management interface that will be used by administrators over the internet. The interface must support both routine configuration changes and emergency access during network outages. Which design choice best balances security and availability for this management interface?

Use a cloud-based management portal with no local authentication to simplify access during outages.

Expose the management interface on a dedicated VLAN with a public IP and rely on a strong password policy.

Implement the management interface on the same network segment as production traffic to reduce complexity.

Require VPN access for routine management and provide an out-of-band console port for emergency access.

A team is designing a protocol for a distributed system that uses a central coordinator to manage state. The protocol uses a session ID to identify each client session. An attacker has been able to hijack sessions by guessing the session ID. What is the most effective mitigation?

Use a longer session ID with more entropy.

Use HTTPS to encrypt session IDs in transit.

Use a cryptographically random session ID and transmit it only over TLS.

Use a short session timeout to limit the window of opportunity.

What is a key risk associated with sharing cryptographic keys between applications?

It simplifies key rotation because only one key is used

It eliminates the need for secure key storage

It increases the speed of cryptographic operations

If one application is compromised, the shared key can be used to access data in other applications

Which combination of controls is essential for securing a web-based administrative console?

Strong password policy, multi-factor authentication, and TLS encryption

Open network access, simple passwords, and HTTP for ease of use

Client-side input validation only, with no server-side checks

IP allowlisting alone, without authentication or encryption

A development team is designing a RESTful API for a mobile banking application. The API will handle financial transactions and must be secure against common web attacks. Which protocol design choice is most important to include?

Use session cookies with a long timeout for user convenience.

Implement OAuth 2.0 with short-lived access tokens and refresh tokens.

Rely on API keys passed in the URL for authentication.

Use HTTP Basic authentication with HTTPS to keep it simple.

Certified Secure Software Lifecycle Professional

Domain 4Objective 2

Perform Secure Interface Design CSSLP Practice Questions (Page 5)

Part of the Secure Software Architecture and Design domain, which accounts for 15% of the CSSLP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~11–18 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

9concepts

15%of the exam

Questions 21–25

21application · medium
A network device vendor is designing a web-based management interface that will be used by administrators over the internet. The interface must support both routine configuration changes and emergency access during network outages. Which design choice best balances security and availability for this management interface?
Select an answer first
22expert · medium
A team is designing a protocol for a distributed system that uses a central coordinator to manage state. The protocol uses a session ID to identify each client session. An attacker has been able to hijack sessions by guessing the session ID. What is the most effective mitigation?
Select an answer first
23foundation · easy
What is a key risk associated with sharing cryptographic keys between applications?
Select an answer first
24foundation · easy
Which combination of controls is essential for securing a web-based administrative console?
Select an answer first
25application · medium
A development team is designing a RESTful API for a mobile banking application. The API will handle financial transactions and must be secure against common web attacks. Which protocol design choice is most important to include?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CSSLP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CSSLP” is a trademark of its owner, used for identification only.