Official (ISC)² CSSLP - Domain 4 Secure
Software Implementation - Coding
Questions and Complete Solutions
Graded A+
Broken authentication - Answer: A software vulnerability that is often introduced through ancillary
authentication functions such as logout, password management, timeout, remember me, secret
question, and account update. This vulnerability helps attackers gain control of the sessionof the
application.
Canonical name - Answer: The name to which equivalent forms of a name resolve.
Canonicalization - Answer: Multiple (alternate) representations of a name.
Cross-site request forgery - Answer: A software attack that tricks the victim into loading a page that
contains a malicious request. The attacker inherits the identity and privileges of the victim to perform an
undesired function on the victim's behalf, such as change the victim's email address, home address,or
password, or purchase something.
Cross-site scripting - Answer: A software vulnerability that refers to data from one site interacting with
data from another site by injecting client-side JavaScript or VBScript into a page.
Cryptographic agility - Answer: The ability of the code to be able to switch from insecure algorithms to
more secure and approved ones with ease, because the way the code is constructed is agnostic of the
algorithm to provide cryptographic operations such as encryption, decryption, and hashing.
CWE/SANS Top 25 list - Answer: A vulnerability database of the most dangerous programming errors.
Data Execution Prevention - Answer: A set of hardware and software technologies that perform
additional checks on memory to help prevent malicious code from running on a system.
Software Implementation - Coding
Questions and Complete Solutions
Graded A+
Broken authentication - Answer: A software vulnerability that is often introduced through ancillary
authentication functions such as logout, password management, timeout, remember me, secret
question, and account update. This vulnerability helps attackers gain control of the sessionof the
application.
Canonical name - Answer: The name to which equivalent forms of a name resolve.
Canonicalization - Answer: Multiple (alternate) representations of a name.
Cross-site request forgery - Answer: A software attack that tricks the victim into loading a page that
contains a malicious request. The attacker inherits the identity and privileges of the victim to perform an
undesired function on the victim's behalf, such as change the victim's email address, home address,or
password, or purchase something.
Cross-site scripting - Answer: A software vulnerability that refers to data from one site interacting with
data from another site by injecting client-side JavaScript or VBScript into a page.
Cryptographic agility - Answer: The ability of the code to be able to switch from insecure algorithms to
more secure and approved ones with ease, because the way the code is constructed is agnostic of the
algorithm to provide cryptographic operations such as encryption, decryption, and hashing.
CWE/SANS Top 25 list - Answer: A vulnerability database of the most dangerous programming errors.
Data Execution Prevention - Answer: A set of hardware and software technologies that perform
additional checks on memory to help prevent malicious code from running on a system.
