I85PREP
⌘ K
ISC2 CSSLP study materials
ISC2 CSSLP study resources

ISC2 CSSLP practice questions

One question at a time. Build your ISC2 CSSLP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secure Software Concepts

Which security objective is primarily concerned with ensuring that data has not been altered by an unauthorized party?

  1. Availability
  2. Confidentiality
  3. Non-repudiation
  4. Integrity Correct answer.

Explanation

Integrity assures that data remains accurate, complete and unmodified except through authorized changes. Confidentiality restricts disclosure, availability ensures timely access, and non-repudiation prevents a party from denying that an action occurred.

Question 2Secure Software Concepts

Which principle states that a user should be granted only the access necessary to perform their assigned job?

  1. Fail-safe defaults
  2. Separation of duties
  3. Defense in depth
  4. Least privilege Correct answer.

Explanation

Least privilege restricts each subject to the minimum access required for its task, which limits the damage that error or compromise can cause. Separation of duties divides conflicting tasks, defense in depth layers controls, and fail-safe defaults deny access when no rule grants it.

Question 3Secure Software Concepts

Which property best distinguishes a cryptographic hash from encryption?

  1. A hash is a one-way function that cannot be decrypted Correct answer.
  2. A hash requires a shared secret key
  3. A hash can be reversed using the correct key
  4. A hash produces output of variable length

Explanation

A cryptographic hash is a one-way function: it produces a fixed-length digest from which the input cannot be feasibly recovered, and no key is used. Encryption is reversible with the correct key and produces ciphertext whose length relates to the input.

Question 4Secure Software Concepts

Deploying a firewall, host-based monitoring and application input validation on the same system is an example of which concept?

  1. Open design
  2. Defense in depth Correct answer.
  3. Single sign-on
  4. Least common mechanism

Explanation

Defense in depth layers independent controls so that the failure of any one control does not expose the system. A firewall, host monitoring and input validation each address different attack paths.

Question 5Secure Software Concepts

Verifying a user's claimed identity before permitting access to a system is known as:

  1. Auditing
  2. Accounting
  3. Authorization
  4. Authentication Correct answer.

Explanation

Authentication establishes that a subject is who it claims to be. Authorization then determines which actions that identified subject may perform, while accounting and auditing record and review activity.

Question 6Secure Software Concepts

What is the primary purpose of classifying information as public, internal or confidential?

  1. To apply controls proportionate to the data's sensitivity Correct answer.
  2. To decide which employees should be terminated
  3. To reduce the cost of encrypting every stored file
  4. To satisfy the need for a firewall rule set

Explanation

Classification labels data by sensitivity so that handling controls such as encryption, access restriction and retention periods match the value and risk of the data. It is a governance decision, not an HR, procurement or network design decision.

Question 7Secure Software Concepts

In risk analysis, risk is best described as:

  1. Any weakness in a system that an attacker could exploit
  2. The absence of an effective security control in a system
  3. A potential cause of an unwanted incident
  4. Likelihood of a threat event combined with its impact Correct answer.

Explanation

Risk combines the probability that a threat will exploit a vulnerability with the resulting business impact. The weakness itself is a vulnerability, and the actor or cause is a threat.

Question 8Secure Software Concepts

A team incorporates an open-source library whose license requires any distributed derivative work to carry the same license terms. This is characteristic of:

  1. A proprietary end-user license
  2. A copyleft license Correct answer.
  3. A permissive open-source license
  4. A public domain dedication

Explanation

Copyleft licenses require derivative works to be distributed under the same terms, which can obligate source disclosure for linked or derived code. Permissive and public-domain-style terms do not impose that reciprocity.

Question 9Secure Software Concepts

A customer claims they never submitted a funds transfer that the bank's system recorded. Which evidence best supports non-repudiation?

  1. A firewall log of the source IP address
  2. A digital signature using the customer's private key Correct answer.
  3. Storage of a hash of the transaction record in the database
  4. Transport encryption of the transaction using TLS

Explanation

Non-repudiation requires evidence that uniquely binds the signer to the transaction; a signature made with the customer's private key provides that binding because only the customer should hold the key. Transport encryption and plain hashes do not attribute an action to a party, and an IP address is weak, shareable evidence.

Question 10Secure Software Concepts

A developer writes code and is also the only person who can approve and deploy it to production. Which principle is most directly violated?

  1. Economy of mechanism
  2. Separation of duties Correct answer.
  3. Least privilege
  4. Defense in depth

Explanation

Separation of duties requires that conflicting responsibilities, such as writing code and approving its release, be split among different people so that no single individual can subvert the process. Least privilege limits the scope of one identity's rights rather than dividing tasks.

Question 11Secure Software Concepts

At which point in the software development life cycle is threat modeling most cost-effective?

  1. During the final security review before release
  2. During design, before any code is written Correct answer.
  3. After the application has been deployed
  4. After penetration testing finds exploitable flaws

Explanation

Threat modeling is most effective during design, when architecture, trust boundaries and data flows can still be changed cheaply. Flaws found after code exists or after deployment cost far more to correct and may already have been exploited.

Question 12Secure Software Concepts

An organization purchases cyber insurance to cover losses from a data breach. Which risk treatment does this represent?

  1. Mitigation
  2. Transfer Correct answer.
  3. Avoidance
  4. Acceptance

Explanation

Insurance shifts the financial consequence of a risk to a third party, which is risk transfer. The likelihood of the event is unchanged, and the organization retains responsibility for managing the underlying exposure.

Question 13Secure Software Concepts

An intrusion detection system alerts administrators to suspicious network traffic. This is which type of control?

  1. Directive
  2. Detective Correct answer.
  3. Preventive
  4. Corrective

Explanation

Detective controls identify and report events while or after they occur, as an IDS does when it alerts on anomalous traffic. Preventive controls block activity, corrective controls restore normal operation, and directive controls instruct people how to behave.

Question 14Secure Software Concepts

Which document typically states mandatory, technology-specific requirements that support a high-level security policy?

  1. A mission statement
  2. A guideline
  3. A standard Correct answer.
  4. A procedure

Explanation

A standard is a mandatory requirement that supports policy and states what must be done, often for a specific technology or process. Procedures describe step by step how to perform a task, and guidelines are advisory.

Question 15Secure Software Concepts

A digital signature provides which combination of services?

  1. Anonymity and authorization
  2. Integrity and signer authenticity Correct answer.
  3. Confidentiality and availability
  4. Confidentiality and key exchange

Explanation

A signature created with the signer's private key and verified with the public key demonstrates that the data was not altered and identifies the originator. Confidentiality requires encryption, which signing alone does not provide.

Question 16Secure Software Concepts

Why do protocols combine asymmetric cryptography with symmetric cryptography when protecting bulk data?

  1. Asymmetric algorithms are computationally too slow for bulk data Correct answer.
  2. Asymmetric algorithms provide weaker confidentiality than hashes
  3. Asymmetric algorithms require no key management at all
  4. Asymmetric algorithms cannot be used for key exchange

Explanation

Asymmetric operations are computationally expensive, so protocols use them to establish or wrap a symmetric session key and then use fast symmetric ciphers for the data itself. Asymmetric algorithms are not keyless or weak.

Question 17Secure Software Concepts

Which change most directly reduces an application's attack surface?

  1. Enabling verbose error messages for troubleshooting
  2. Adding a web application firewall in front of the application
  3. Removing unused services and open ports from the host Correct answer.
  4. Increasing password complexity requirements for all users

Explanation

Attack surface is the set of entry points and functionality an attacker can reach; removing unused services and ports eliminates reachable paths. Added controls guard existing entry points but do not remove them.

Question 18Secure Software Concepts

Keeping a security design as simple and small as possible reflects which secure design principle?

  1. Complete mediation
  2. Open design
  3. Economy of mechanism Correct answer.
  4. Least common mechanism

Explanation

Economy of mechanism holds that security mechanisms should be simple and small, because complexity breeds errors and overlooked interactions. The other principles address secrecy of design, shared mechanisms and per-request checks.

Question 19Secure Software Concepts

A registration form requires a date of birth and gender that the service never uses. Which privacy principle does this most directly conflict with?

  1. Purpose limitation
  2. Right of erasure
  3. Data minimization Correct answer.
  4. Breach notification

Explanation

Data minimization requires collecting only the personal data that is necessary for the stated purpose, so unused fields should be removed at design time. Purpose limitation restricts how collected data may be used rather than how much is collected.

Question 20Secure Software Concepts

What is the primary purpose of an organizational software security maturity model such as BSIMM or OpenSAMM?

  1. To replace the organization's enterprise risk register
  2. To satisfy in full the requirements of PCI DSS
  3. To benchmark and improve a software security program Correct answer.
  4. To certify individual developers in secure coding practices

Explanation

Maturity models describe practices across the software security lifecycle so an organization can measure its program against a reference and plan improvements. They neither certify individuals nor substitute for risk management or compliance obligations.

Question 21Secure Software Concepts

An application caches the result of an authorization check after the first request and does not re-validate for later requests. Which principle is violated?

  1. Separation of duties
  2. Least privilege
  3. Fail-safe defaults
  4. Complete mediation Correct answer.

Explanation

Complete mediation requires that every access to every object be authorized on each request, because permissions and contextual conditions can change between requests. Caching a decision without revalidation bypasses that check.

Question 22Secure Software Concepts

A product publishes its cryptographic algorithm and relies on the secrecy of the keys for protection. Which design principle does this reflect?

  1. Open design Correct answer.
  2. Least common mechanism
  3. Weakest link
  4. Security through obscurity

Explanation

Open design, expressed in Kerckhoffs's principle, holds that security should depend on secret keys rather than on secrecy of the algorithm, so that public scrutiny can improve assurance. Obscurity may add friction but cannot be the foundation of protection.

Question 23Secure Software Concepts

A file-sharing application denies access whenever it cannot determine a user's group membership. This behavior illustrates:

  1. Defense in depth
  2. Complete mediation
  3. Least privilege
  4. Fail-safe defaults Correct answer.

Explanation

Fail-safe defaults mean that when a subject cannot be positively authorized, access is denied, so an error causes loss of function rather than loss of protection. Denying access on missing group information is exactly that outcome.

Question 24Secure Software Concepts

In an IaaS deployment, which security responsibility remains primarily with the customer?

  1. Patching of the hypervisor layer
  2. Maintenance of the provider's network backbone
  3. Hardening of the guest operating system Correct answer.
  4. Physical security of the data center

Explanation

Under the shared responsibility model for IaaS, the provider secures the facility, hardware, backbone network and hypervisor, while the customer owns the guest operating system, middleware, runtime and application, including patching and hardening.

Question 25Secure Software Concepts

Two applications run under the same service account and share a temporary directory, so compromising one lets an attacker read the other's temporary files. Which design principle was violated?

  1. Economy of mechanism
  2. Open design
  3. Complete mediation
  4. Least common mechanism Correct answer.

Explanation

Least common mechanism warns against sharing mechanisms such as accounts, directories and caches among users or applications, because shared state creates unintended communication paths. Isolation of shared resources, not simplification or per-request checking, is the corrective principle.

Question 26Secure Software Lifecycle Management

In a secure software lifecycle, at which point is a security defect generally cheapest to correct?

  1. During architecture and design Correct answer.
  2. During integration testing
  3. During production operations
  4. During user acceptance testing

Explanation

Remediation cost rises sharply as a defect moves downstream, because design changes propagate into code, tests, documentation, and deployed systems. A flaw corrected while the design is still a model requires only a document edit and a review.

Question 27Secure Software Lifecycle Management

Which secure design principle requires that each subject be granted only the access needed to complete its current task?

  1. Separation of duties
  2. Least privilege Correct answer.
  3. Open design
  4. Defense in depth

Explanation

Least privilege limits the rights of every user and process to the minimum required, which shrinks the blast radius when an account or service is compromised. Rights are granted per task rather than by broad role default.

Question 28Secure Software Lifecycle Management

Which STRIDE category addresses an attacker pretending to be a legitimate user or system?

  1. Spoofing Correct answer.
  2. Tampering
  3. Elevation of privilege
  4. Repudiation

Explanation

STRIDE stands for Spoofing identity, Tampering with data, Repudiation, Information disclosure, Denial of service, and Elevation of privilege. Spoofing covers illegitimately assuming another party's identity, such as forged credentials or a spoofed token.

Question 29Secure Software Lifecycle Management

Which form makes a security requirement usable in a secure SDLC?

  1. A testable acceptance criterion Correct answer.
  2. A marketing claim from the business
  3. A vendor product wish list
  4. A broad aspirational goal

Explanation

Requirements must be verifiable so that testers can demonstrate satisfaction and reviewers can inspect evidence. Security requirements are therefore written with measurable conditions rather than general statements of intent.

Question 30Secure Software Lifecycle Management

What is the main security purpose of peer code review?

  1. To find flaws before release Correct answer.
  2. To rank developer output
  3. To satisfy audit needs
  4. To enforce style rules

Explanation

Review is a human inspection technique that catches logic and design errors automated tools cannot reason about, at the stage where fixing them is still inexpensive. It complements, rather than duplicates, static analysis.

Question 31Secure Software Lifecycle Management

Which technique inspects source code for security weaknesses without executing the program?

  1. Fuzz testing
  2. Static application security testing Correct answer.
  3. Penetration testing
  4. Dynamic application security testing

Explanation

Static analysis operates on code or binaries at rest, building a model of control and data flow to identify unsafe patterns. The other techniques all require a running target.

Question 32Secure Software Lifecycle Management

Which lifecycle model organizes work into repeated cycles, each beginning with explicit risk analysis?

  1. Spiral Correct answer.
  2. Linear sequential
  3. V-model
  4. Waterfall

Explanation

The spiral model is risk-driven: every loop revisits objectives, identifies and evaluates risk, performs engineering, and ends with a go/no-go decision. This makes risk analysis a recurring activity rather than a single early step.

Question 33Secure Software Lifecycle Management

What is the primary objective of role-based security training in a secure SDLC?

  1. Satisfying insurance requirements
  2. Building role-specific skills Correct answer.
  3. Removing the need for threat modeling
  4. Replacing code review with training

Explanation

Architects, developers, testers, and product owners each perform different security tasks, so training is targeted at the knowledge each role must apply. Generic awareness sessions do not build the specific competencies those tasks demand.

Question 34Secure Software Lifecycle Management

For what purpose is the DREAD scheme used in threat modeling?

  1. Enumerating data flows across trust boundaries
  2. Deriving abuse cases from use cases
  3. Measuring test coverage of controls
  4. Ranking identified threats by relative risk Correct answer.

Explanation

DREAD scores damage, reproducibility, exploitability, affected users, and discoverability to produce a comparable number for each threat. That number is then used to prioritize which threats receive controls first.

Question 35Secure Software Lifecycle Management

A team must choose among accepting, mitigating, transferring, or avoiding an identified risk. What should drive the choice?

  1. Cost of treatment versus impact and likelihood Correct answer.
  2. The number of threats in the model
  3. The default option in the risk register
  4. The preference of the development team

Explanation

Risk treatment is an economic decision: the chosen option should bring exposure down to a level the organization is willing to bear at an acceptable cost. Impact and likelihood, compared against treatment cost, supply that judgment.

Question 36Secure Software Lifecycle Management

A critical vulnerability is published in a widely used open-source library. What is the most effective first step?

  1. Rewrite the affected module in-house immediately
  2. Check whether the vulnerable component is reachable Correct answer.
  3. Notify the vendor of the affected application
  4. Disable all outbound network traffic

Explanation

Exposure depends on whether the vulnerable component is present and whether the flawed code path can be reached in your usage. A component inventory such as an SBOM answers this quickly and prevents wasted emergency effort.

Question 37Secure Software Lifecycle Management

Which control best limits the damage an attacker can do after compromising a developer workstation in a CI/CD environment?

  1. Publishing build logs publicly
  2. Require signed commits and separated build credentials Correct answer.
  3. Weekly antivirus scans of build agents
  4. Longer password requirements

Explanation

Separation of duties combined with integrity verification means a single compromised endpoint cannot inject code into a release, because production credentials never reside on that workstation. Reviewed, signed changes create an auditable chain the pipeline can enforce.

Question 38Secure Software Lifecycle Management

How does penetration testing differ from vulnerability scanning?

  1. Testers chain findings and attempt real exploitation Correct answer.
  2. Scanners produce no false positives
  3. Testing requires no scope agreement
  4. Scanning replaces the need for manual review

Explanation

Scanning enumerates candidate weaknesses through signatures and heuristics, while a penetration test uses human judgment to combine findings into realistic attack paths and to validate business impact. Exploitation is what distinguishes the two.

Question 39Secure Software Lifecycle Management

What does a misuse case describe?

  1. A normal user journey through the application
  2. A test case for a functional requirement
  3. A user story written by the product owner
  4. An actor performing a harmful action against the system Correct answer.

Explanation

Misuse cases model adversary goals and interactions with the system so that designers can build controls against abuse. They complement use cases by describing what the system must resist, not only what it must do.

Question 40Secure Software Lifecycle Management

Why place a security gate that requires an approved threat model before the design is baselined?

  1. To slow the project for auditing purposes
  2. To force design changes while they are still inexpensive Correct answer.
  3. To eliminate the need for later testing
  4. To transfer risk to the security team

Explanation

Gates make security decisions explicit at the point where change is still cheap, preventing an insecure architecture from being built and then reworked. The gate is a decision point, not a delay tactic.

Question 41Secure Software Lifecycle Management

What advantage does an organization-wide secure coding standard give over team-by-team rules?

  1. It guarantees the absence of vulnerabilities
  2. It removes the need for developer training
  3. It eliminates the need for code review
  4. It provides consistent, enforceable criteria across projects Correct answer.

Explanation

A single standard makes rules unambiguous, auditable, and tool-enforceable, and it lets training, review checklists, and static analysis rule sets align. Consistency across teams also makes supply chain and acquisition assessment comparable.

Question 42Secure Software Lifecycle Management

What does the CVSS base score express?

  1. The vendor's patch release schedule
  2. The business criticality of the affected asset
  3. Intrinsic severity of a vulnerability's characteristics Correct answer.
  4. Likelihood the flaw is exploited in the wild

Explanation

Base metrics capture exploitability and impact characteristics that remain constant over time and across environments. Temporal and environmental metrics are applied afterward to reflect real-world context.

Question 43Secure Software Lifecycle Management

Why should security-relevant configuration be version-controlled alongside code?

  1. It improves application runtime performance
  2. It reduces the size of application binaries
  3. It makes drift detectable and changes auditable and reversible Correct answer.
  4. It removes the need for change approval

Explanation

Treating configuration as code establishes a known baseline, a diffable history, and the ability to roll back a change that weakened a control. It also exposes unauthorized drift between environments.

Question 44Secure Software Lifecycle Management

Which measure is a leading indicator of secure development performance?

  1. Annual count of reported incidents
  2. Number of vulnerabilities found in production
  3. Percentage of releases with completed threat models Correct answer.
  4. Mean time to patch after disclosure

Explanation

Leading indicators measure whether the preventive activities are actually being performed before release, which predicts future outcomes. The others describe results already realized and are therefore lagging indicators.

Question 45Secure Software Lifecycle Management

How should security requirements be handled in a Scrum-based secure SDLC?

  1. Written as backlog items with acceptance criteria Correct answer.
  2. Deferred to a hardening sprint at the end
  3. Assigned to a single security champion
  4. Documented in a separate security binder only

Explanation

In Scrum the backlog is the only durable work queue, so anything not written there is not planned, estimated, or delivered. Security work therefore enters as backlog items with verifiable acceptance criteria.

Question 46Secure Software Lifecycle Management

A team scores threats with DREAD and finds that very different threats receive almost identical totals. What is the most likely cause?

  1. The threat list was too short
  2. CVSS vectors were entered incorrectly
  3. The data flow diagram was too detailed
  4. Unanchored, subjective rating criteria applied inconsistently Correct answer.

Explanation

DREAD's factors are judgment-based with no calibrated scale, so raters drift toward the middle and the score loses discriminating power. Teams normally anchor each scale with worked examples or adopt a more quantitative method.

Question 47Secure Software Lifecycle Management

What security property do reproducible builds provide?

  1. A verifier can confirm the binary matches the source Correct answer.
  2. They prevent developers from committing secrets
  3. They remove the need for code signing
  4. They encrypt build artifacts at rest

Explanation

A deterministic build lets an independent party rebuild from the published source and compare hashes, exposing tampering anywhere in the build or distribution chain. It turns the build system into something that can be independently audited.

Question 48Secure Software Lifecycle Management

A service caches authorization decisions for 24 hours to cut latency. Which secure design principle does this most directly violate?

  1. Economy of mechanism
  2. Least common mechanism
  3. Complete mediation Correct answer.
  4. Open design

Explanation

Complete mediation requires every access request to be checked against current policy. A long-lived cache allows a revoked or reduced permission to remain effective, so the check is no longer performed on each access.

Question 49Secure Software Lifecycle Management

A SAST tool reports a SQL injection sink that is fed only by an integer constant declared in the same method. How should the finding be classified?

  1. A design flaw in the trust boundary model
  2. An architectural risk needing a threat model update
  3. A false positive because no untrusted input reaches the sink Correct answer.
  4. A true positive requiring immediate remediation

Explanation

Static analyzers flag sinks using patterns and taint propagation, and they report when they cannot prove the data is safe. Manual triage here shows no attacker-controlled path to the sink, so the finding is not exploitable.

Question 50Secure Software Lifecycle Management

After controls are implemented and verified, what is the remaining exposure called, and who must accept it?

  1. Inherent risk, accepted by the developer
  2. Control risk, accepted by the auditor
  3. Transferable risk, accepted by the insurer
  4. Residual risk, accepted by the business owner Correct answer.

Explanation

Residual risk is what remains after mitigation has been applied and validated. Because the consequence is a business one, the accountable business owner accepts it on the advice of the security function.