Official (ISC)² CSSLP - Domain 4 Secure
Software Implementation - Coding
Questions and Complete Solutions
Graded A+
Broken authentication - Answer: A software vulnerability that is often introduced through ancillary
authentication functions such as logout, password management, timeout, remember me, secret
question, and account update. This vulnerability helps attackers gain control of the sessionof the
application.
Canonical name - Answer: The name to which equivalent forms of a name resolve.
Canonicalization - Answer: Multiple (alternate) representations of a name.
Cross-site request forgery - Answer: A software attack that tricks the victim into loading a page that
contains a malicious request. The attacker inherits the identity and privileges of the victim to perform an
undesired function on the victim's behalf, such as change the victim's email address, home address,or
password, or purchase something.
Cross-site scripting - Answer: A software vulnerability that refers to data from one site interacting with
data from another site by injecting client-side JavaScript or VBScript into a page.
Cryptographic agility - Answer: The ability of the code to be able to switch from insecure algorithms to
more secure and approved ones with ease, because the way the code is constructed is agnostic of the
algorithm to provide cryptographic operations such as encryption, decryption, and hashing.
CWE/SANS Top 25 list - Answer: A vulnerability database of the most dangerous programming errors.
Data Execution Prevention - Answer: A set of hardware and software technologies that perform
additional checks on memory to help prevent malicious code from running on a system.
,DOM-based XSS - Answer: XSS that occurs via DOM manipulation on the client.
Impersonation - Answer: An attack resulting from broken authentication in which identity assertions
cannot be verified and an attacker can pose (impersonate) as a valid user.
Injection flaw - Answer: A software vulnerability that occurs when user-supplied data is sent to an
interpreter as part of a command or query. An attacker's hostile data can trick the interpreter into
executing unintended commands or changing data.
Input validation - Answer: The verification process that ensures that trusted code is correct from the
range of data it can accept, the type and format of data it can process, and any canonical
representations of the data (such as path validation, directory browsing, etc.) that it can handle, since all
input data can have serious security impacts on your application.
Locality of reference - Answer: The principle that programs tend to reuse data and instructions they
have used recently
Man in the middle - Answer: An attack resulting from broken authentication an attacker takes advantage
of broken authentication and improper session management and places himself in between established
session conversations and control the sessions with the victim
National Vulnerability Database - Answer: A vulnerability database. NVD is the U.S. government
repository of standards based vulnerability management data represented using the Security Content
Automation (SCAP), which is a synthesis of interoperable specifications derived from community ideas.
Non-persistent XSS - Answer: XSS that occurs when the attacker's script that is injected is not stored in
the backend, and the Web-browser client simply echoes back the results of the script execution. It can
be over GET (QueryString) or POST (Forms) methods.
OWASP Top 10 List - Answer: A vulnerability database that considers the most common application
security issues from a weaknesses or vulnerabilities perspective and views application security issues
from an organizational risks (technical risk and business impact) perspective.
, Persistent XSS - Answer: XSS that occurs when the injected script or payload is persistent in the system
and executes every time a user visits the site that has been injected. The payload may be embedded
later by the vulnerable system in an HTML page provided to a victim.
Race condition - Answer: A flaw in a system design or process. The output and/or result of the process is
unexpectedly and critically dependent on the sequence or timing of other events.
Sandbox - Answer: A controlled and sequestered environment.
To prevent error conditions from propagating through a system, what should each function do?
A. Log all abnormal conditions
B. Include error trapping and handling
C. Clear all global variables upon completion
D. Notify users of errors before continuing - Answer: B. To prevent error conditions from cascading or
propagating through a system, each function should practice complete error mitigation, including error
trapping and complete handling, before returning to the calling routine.
Race conditions can be determined and controlled via what?
A. Multithreading
B. Mutual exclusion
C. Race windows
D. Atomic actions - Answer: C. Race conditions are defined by race windows, a period of opportunity
when concurrent threads can compete in attempting to alter the same object. They are caused by
multithreading and are resolved through atomic actions under mutual exclusion conditions. The key is in
detecting when they occur.
To deal with international distribution issues associated with cryptography, a clean method is via what?
A. Versioning
B. Use of international cryptography for all versions
C. Use of approved cryptographic libraries only
D. Use of cryptographic agility - Answer: D. Cryptographic agility can also assist in the international
problem of approved cryptography. In some cases, certain cryptographic algorithms are not permitted
Software Implementation - Coding
Questions and Complete Solutions
Graded A+
Broken authentication - Answer: A software vulnerability that is often introduced through ancillary
authentication functions such as logout, password management, timeout, remember me, secret
question, and account update. This vulnerability helps attackers gain control of the sessionof the
application.
Canonical name - Answer: The name to which equivalent forms of a name resolve.
Canonicalization - Answer: Multiple (alternate) representations of a name.
Cross-site request forgery - Answer: A software attack that tricks the victim into loading a page that
contains a malicious request. The attacker inherits the identity and privileges of the victim to perform an
undesired function on the victim's behalf, such as change the victim's email address, home address,or
password, or purchase something.
Cross-site scripting - Answer: A software vulnerability that refers to data from one site interacting with
data from another site by injecting client-side JavaScript or VBScript into a page.
Cryptographic agility - Answer: The ability of the code to be able to switch from insecure algorithms to
more secure and approved ones with ease, because the way the code is constructed is agnostic of the
algorithm to provide cryptographic operations such as encryption, decryption, and hashing.
CWE/SANS Top 25 list - Answer: A vulnerability database of the most dangerous programming errors.
Data Execution Prevention - Answer: A set of hardware and software technologies that perform
additional checks on memory to help prevent malicious code from running on a system.
,DOM-based XSS - Answer: XSS that occurs via DOM manipulation on the client.
Impersonation - Answer: An attack resulting from broken authentication in which identity assertions
cannot be verified and an attacker can pose (impersonate) as a valid user.
Injection flaw - Answer: A software vulnerability that occurs when user-supplied data is sent to an
interpreter as part of a command or query. An attacker's hostile data can trick the interpreter into
executing unintended commands or changing data.
Input validation - Answer: The verification process that ensures that trusted code is correct from the
range of data it can accept, the type and format of data it can process, and any canonical
representations of the data (such as path validation, directory browsing, etc.) that it can handle, since all
input data can have serious security impacts on your application.
Locality of reference - Answer: The principle that programs tend to reuse data and instructions they
have used recently
Man in the middle - Answer: An attack resulting from broken authentication an attacker takes advantage
of broken authentication and improper session management and places himself in between established
session conversations and control the sessions with the victim
National Vulnerability Database - Answer: A vulnerability database. NVD is the U.S. government
repository of standards based vulnerability management data represented using the Security Content
Automation (SCAP), which is a synthesis of interoperable specifications derived from community ideas.
Non-persistent XSS - Answer: XSS that occurs when the attacker's script that is injected is not stored in
the backend, and the Web-browser client simply echoes back the results of the script execution. It can
be over GET (QueryString) or POST (Forms) methods.
OWASP Top 10 List - Answer: A vulnerability database that considers the most common application
security issues from a weaknesses or vulnerabilities perspective and views application security issues
from an organizational risks (technical risk and business impact) perspective.
, Persistent XSS - Answer: XSS that occurs when the injected script or payload is persistent in the system
and executes every time a user visits the site that has been injected. The payload may be embedded
later by the vulnerable system in an HTML page provided to a victim.
Race condition - Answer: A flaw in a system design or process. The output and/or result of the process is
unexpectedly and critically dependent on the sequence or timing of other events.
Sandbox - Answer: A controlled and sequestered environment.
To prevent error conditions from propagating through a system, what should each function do?
A. Log all abnormal conditions
B. Include error trapping and handling
C. Clear all global variables upon completion
D. Notify users of errors before continuing - Answer: B. To prevent error conditions from cascading or
propagating through a system, each function should practice complete error mitigation, including error
trapping and complete handling, before returning to the calling routine.
Race conditions can be determined and controlled via what?
A. Multithreading
B. Mutual exclusion
C. Race windows
D. Atomic actions - Answer: C. Race conditions are defined by race windows, a period of opportunity
when concurrent threads can compete in attempting to alter the same object. They are caused by
multithreading and are resolved through atomic actions under mutual exclusion conditions. The key is in
detecting when they occur.
To deal with international distribution issues associated with cryptography, a clean method is via what?
A. Versioning
B. Use of international cryptography for all versions
C. Use of approved cryptographic libraries only
D. Use of cryptographic agility - Answer: D. Cryptographic agility can also assist in the international
problem of approved cryptography. In some cases, certain cryptographic algorithms are not permitted
