CSSLP. Set it up and run it.

1. Refer to the exhibit. The dashed line marks a trust boundary between the user's browser and the web application. Which activity is MOST important at this boundary?

• A. Compressing responses to save bandwidth
• B. Caching static assets at the edge
• C. Validating all input crossing into the application
• D. Renaming internal service endpoints

Correct answer: C. Trust boundaries are where data crosses from a less trusted zone into a more trusted one, so every input that crosses must be validated and its threats enumerated. Input arriving from the browser is untrusted and must be validated server-side.

Why the others are wrong. Compressing responses and caching static assets are performance measures unrelated to the trust decision at a boundary. Renaming endpoints is security through obscurity that provides no real protection. Only validating untrusted input crossing the boundary addresses the threats that arise as data enters a more trusted zone.

2. Which two capabilities are most essential for establishing accountability, allowing an organization to trace security-relevant actions in a software system back to a specific individual? (Choose two.)

• A. Unique per-user identities
• B. Shared administrative accounts
• C. Symmetric session encryption
• D. Tamper-resistant audit logging
• E. Client-side input validation

Correct answer: A. Accountability requires that each action be attributable to one person; unique per-user identities ensure attribution to an individual, and tamper-resistant audit logs create the reliable record that ties actions to those identities over time.

Why the others are wrong. Shared administrative accounts destroy attribution because many people use one credential, undermining accountability. Symmetric session encryption protects confidentiality in transit but records nothing about who acted. Client-side input validation improves data quality but is easily bypassed and does not identify or log the acting principal.

3. A healthcare application must ensure that patient records cannot be read by unauthorized users while stored and while transmitted. Which security property does this requirement primarily address?

• A. Confidentiality
• B. Availability
• C. Integrity
• D. Non-repudiation

Correct answer: A. Confidentiality is the property that ensures information is disclosed only to authorized parties, both at rest and in transit; encryption and access controls enforce it, directly matching the requirement to prevent unauthorized reading of records.

Why the others are wrong. Availability concerns whether the system and data are accessible when needed, not who may read them. Integrity ensures data is not altered without authorization, a different goal. Non-repudiation prevents a party from denying an action and does nothing to keep records secret from unauthorized viewers.

4. An organization wants developers to find and fix security defects as early as possible. Which practice BEST embodies this 'shift-left' approach to secure development?

• A. Penetration testing after production release
• B. Annual security audits of legacy systems
• C. Post-incident forensic reviews
• D. Threat modeling during the design phase

Correct answer: D. Shift-left means moving security activities earlier in the lifecycle. Threat modeling during design identifies flaws before any code exists, when remediation is cheapest and architectural changes are still feasible.

Why the others are wrong. Penetration testing after release finds defects late, when fixes are expensive and disruptive. Annual audits of legacy systems occur infrequently and target existing code, not new development. Post-incident forensic reviews happen only after a breach, the opposite of preventing defects early.

5. A requirement states that the checkout page must respond within two seconds under peak load. How is this requirement BEST classified?

• A. Non-functional requirement
• B. Functional requirement
• C. Security requirement
• D. Business rule

Correct answer: A. Response time under load is a quality attribute describing how well the system performs, not what feature it delivers, so it is a non-functional requirement measured through performance and load testing.

Why the others are wrong. A functional requirement describes a behavior the system must do, such as calculating a total, not how fast. A security requirement constrains confidentiality, integrity, or availability protections. A business rule expresses policy or a domain constraint, none of which is what a two-second response target specifies.

6. During threat modeling of a login service, an analyst documents an attacker presenting another user's credentials to impersonate them. Which STRIDE category best describes this threat?

• A. Repudiation
• B. Information disclosure
• C. Spoofing
• D. Tampering

Correct answer: C. Spoofing in STRIDE is falsely assuming another entity's identity, such as presenting stolen credentials to impersonate a legitimate user. It is countered by strong authentication controls like multi-factor authentication and mutual TLS.

Why the others are wrong. Repudiation is denying that an action occurred and is addressed with logging and non-repudiation controls. Information disclosure is exposing data to unauthorized parties, not impersonation. Tampering is unauthorized modification of data in transit or at rest, which differs from assuming another user's identity.

7. A developer wants to reject unexpected characters in a username field. Compared with blocking known-bad input, which approach gives stronger and more maintainable protection?

• A. Deny-list validation blocking known-bad characters
• B. A longer blocklist refreshed each week
• C. Client-side JavaScript length checking
• D. Allow-list validation accepting only permitted characters

Correct answer: D. Allow-list (whitelist) validation defines exactly what is acceptable and rejects everything else, so novel or obfuscated malicious input is denied by default. Deny-lists always miss variants, making allow-listing the stronger and more maintainable control.

Why the others are wrong. A deny-list blocking known-bad characters fails whenever an attacker finds an unlisted variant or encoding. A weekly-refreshed blocklist still lags behind new payloads and remains structurally incomplete. Client-side length checking runs in the browser where it is trivially bypassed and validates nothing on the server.

8. A security team wants to inspect an application's source code for injection flaws before the build runs, without executing the program. Which testing approach BEST fits this need?

• A. Dynamic application security testing
• B. Interactive application security testing
• C. Static application security testing
• D. Software composition analysis

Correct answer: C. SAST analyzes source code, bytecode, or binaries without running the program, tracing data flows to find injection and other coding flaws early in the pipeline, exactly the pre-build, no-execution inspection described here.

Why the others are wrong. Dynamic testing requires a running, deployed application and probes it from the outside, so it cannot run before the build. Interactive testing also needs the application executing with instrumentation attached. Software composition analysis inventories third-party dependencies rather than scanning the team's own source logic for injection defects.