CSSLP Sample Exam (2024)

CSSLP Sample Exam (2024) QUESTION 1 An organization has signed a contract to build a large Information System (IS) for the United States government. Which framework, guideline, or standard would BEST meet government information processing requirements? A. Control Objectives for Information and Related Technology (COBIT) B. Information Technology Infrastructure Library (ITIL) C. National Institute of Standards and Technology (NIST) D. International Organization for Standardization (ISO) 27000 ️Correct Answer: C Explanation/Reference: NIST Special Publication 800-171 is rapidly emerging as the benchmark used by the civilian US government and Department of Defense for evaluating the security and privacy posture of nonfederal organizations that seek to contract with the US government. QUESTION 2 An organization deploys an Internet web application. A security researcher sends an e-mail to a mailing list stating that the web application is susceptible to Cross-Site Scripting (XSS) What type of testing could BEST discover this type of vulnerability? A. Simulation testing B. Automated regression testing C. Fuzz testing D. Integration testing ️Correct Answer: C Explanation/Reference: Intellifuzz is a Python script designed to not only determine if a cross-site scripting attack is possible, but also determine the exact payload needed to cleanly break out of the code. Many web scanners and fuzzers operate by using a long list of possible payloads and recording the response to see if the payload is reflected. However, just because a payload is reflected does not mean it will execute. For example, if the payload is reflected as an HTML attribute, a carefully crafted string must be created to first break out of the attribute using quotes, then potentially break out of the tag, then finally launch the script. Intellifuzz aims to take care of crafting the payload for you by first detecting the location of the parameter reflection, then using a number of tests to determine what characters are needed to cause a successful execution. QUESTION 3 Which of the following mitigates cryptographic keys from being stoles by cold-boot attacks? A. Use symmetric keys instead of asymmetric keys B. Overwrite the keys in memory once they are no longer needed C. Use passwords to derive the cryptographic keys D. Combine cryptographic keys with random salt values ️Correct Answer: B Explanation/Reference: After a computer is powered off, the data in RAM disappears rapidly, but it can remain in RAM up to several minutes after shutdown. An attacker having access to a computer before it disappears completely could recover important data from your session. This can be achieved using a technique called cold boot attack . To prevent this attack, the data in RAM is overwritten by random data when shutting down. This erases all traces from your session on that computer. QUESTION 4 A strong application architecture that provides separation and security between components is essential